Template Field Action
This action enables you to construct a string, based on one or more event fields or tags, and copy the string to an output field.
Template
The template used to construct the output string. To reference a field or tag, use the following format:
${field-or-tag-name}
You can also include plain text in a template, for example:
${class} issue found in ${location}
Output field
Copy the output string to the following field.
Example
In one of your event streams, the source
field contains the hostname and the domain name is in a tag:
{ "source" : "myhost" .... "tags": { "domain": "mydomain.com" } }
Your data catalogs use the FQDNs for their source fields. You want to update the source
field in these events to include both the hostname and the domain name. You add a Template Field action to your workflow, before the Query Catalog action, and format it like this:
Template =
${source}.${tags.domain}
Output field =
source
Event Before | EventAfter |
---|---|
{ "source" : "myhost" .... "tags": { "domain": "mydomain.com" } } | { "source" : "myhost.mydomain.com" .... "tags": { "domain": "mydomain.com" } } |