Template Field Action

This action enables you to construct a string, based on one or more event fields or tags, and copy the string to an output field.

  • Template

    The template used to construct the output string. To reference a field or tag, use the following format: ${field-or-tag-name}

    You can also include plain text in a template, for example: ${class} issue found in ${location}

  • Output field

    Copy the output string to the following field.

Example

In one of your event streams, the source field contains the hostname and the domain name is in a tag:

{
    "source" : "myhost"
     ....
    "tags": {
        "domain": "mydomain.com"
    }
}

Your data catalogs use the FQDNs for their source fields. You want to update the source field in these events to include both the hostname and the domain name. You add a Template Field action to your workflow, before the Query Catalog action, and format it like this:

  • Template = ${source}.${tags.domain}

  • Output field = source

Event Before

EventAfter

{
    "source" : "myhost"
     ....
    "tags": {
        "domain": "mydomain.com"
    }
}

{
    "source" : "myhost.mydomain.com"
     ....
    "tags": {
        "domain": "mydomain.com"
    }
}
In this section: