Dot Expander

Transform Elastic Compatible

Synopsis

Expands fields containing dots in their names into nested objects.

Schema

dot_expander:
  field: <ident>
  path: <string>
  description: <text>
  if: <script>
  ignore_failure: <boolean>
  on_failure: <processor[]>
  on_success: <processor[]>
  tag: <string>

Configuration

Field	Required	Default	Description
field	Y	-	Field containing dot-separated names to expand
path	N	-	Target location for expanded structure
description	N	-	Explanatory note
if	N	-	Conditional expression
ignore_failure	N	false	Continue processing on errors
on_failure	N	-	Processors to run on failure
on_success	N	-	Processors to run on success
tag	N	-	Identifier for logging

Details

The processor converts flat field names with dot notation into nested object structures. This is particularly useful for transforming flattened data into hierarchical formats, improving data readability and standardizing field structures for nested processing.

note

The field must contain at least one dot. Also, nested expansions create complex object structures.

By default, the processor automatically creates intermediate objects as needed, preserving original field values while removing the original dot-separated field. It also supports custom target paths for expanded structures.

warning

Deeply nested fields can lead to performance issues.

Examples

Basic

Expanding a dotted field into nested objects...	{ "foo.bar.baz": 123 } dot_expander: field: foo.bar.baz
creates a nested structure:	{ "foo": { "bar": { "baz": 123 } } }

Path Expansion

Placing an expanded structure on a specific path...	{ "source.field.value": 123 } dot_expander: field: source.field.value path: target
creates the structure at specified location:	{ "target": { "source": { "field": { "value": 123 } } } }

Conditionals

Expand only when a condition is met...	{ "foo.bar.baz": 123, "condition": true } dot_expander: field: foo.bar.baz if: ctx.condition == true
result:	{ "condition": true, "foo": { "bar": { "baz": 123 } } }

Error Handling

When a field doesn't contain any dots...	{ "foo": 123 } dot_expander: field: foo ignore_failure: true on_failure: - set: field: error value: "No dots in field name"
handle the error:	{ "foo": 123, "error": "No dots in field name" }