Description
The Map unit is a Processor unit type.
This unit transforms input events by adding/overwriting/removing fields. New/overwritten fields are defined through expressions over existing fields. Expressions can refer to input event fields, as well as to previous expression results. In addition, existing fields can be removed.
An event enters through the in port. The expressions are evaluated and the input is modified to account for new/overwritten/removed fields. Then, the event is output through the out port.
If there are errors produced during the evaluation, these events are enriched with two additional fields, error and exception, and the event is output through the error port.
Configuration
After dragging this unit into the Flow canvas, double-click it to access its configuration options. The following table describes the configuration options of this unit:
Tab | Field | Description | |
|---|---|---|---|
General | Name | Enter a name for the unit. It must start with a letter, and cannot contain spaces. Only letters, numbers, and underscores are allowed. | |
Description | Enter a description detailing the scope of the unit. | ||
Language | Specify the language you will use to write the expression, e.g. Javascript, Groovy, etc. | ||
Fields to add | Event field | The name of an event field with the data you wish to convert to new columns, written in the correct format (expression, type, name, overwrite combination). Alternatively, the name of an input event field containing such a list can be entered below using the plus icon. | |
Fields | Click the plus icon to open the list (expression, type, name, overwrite combination). You can add as many fields as required. You can collapse and expand the fields using the You can also reorder the fields using drag and drop. | ||
Field name | The name of an output event field where the expression result will be inserted. | ||
Type | The expected type for the expression result. | ||
Expression | An expression written in the specified language. | ||
Overwrite | Whether to overwrite an existing input event field if one with the same name already exists. | ||
Fields to remove | Fields | A list of field names to remove. You can also reorder the fields using drag and drop. | |
Input ports
Port | Description |
|---|---|
in | All events enter through this port. You can refer to event fields using expressions. |
Output ports
Port | Description |
|---|---|
out | Outputs input events modified with new/overwritten/removed fields. New/Overwritten fields are those defined by expressions in the 'Fields to add' tab. Removed fields are those defined in the 'Fields to remove' tab. |
error | Outputs all events that produced an error during evaluation. These events have two additional fields, error, and exception, that describe the error. |
Example
In this example, we want to add a timestamp and timestamp + 10 mins fields to existing events and insert them into a to a new my.app table.
To do this, we will use a Tick unit to fire events. Then, we will link it to a Map unit and add the following Fields to add.
Finally, we will link its out output port to a Devo sink unit to send the filtered events to a my.app table.
📁 Download this example
You can try this flow by downloading this JSON and uploading it to your domain using the Import option: