Standard Enricher enriches the parsed event with additional fields. The enrichment takes place after one of the cascade parsers within the parsing group successfully matched and parsed the original input.
--- define: name: Example of standard enricher type: enricher/standard field_alias: field_alias.default enrich: - !DICT with: !EVENT set: myEnrichedField: !LOWER what: "You Have Been Enriched"
This section contains the common definition and meta data.
Shorter human-readable name of the enricher’s declaration.
The type of this declaration, must be
Name of the field alias lookup to be loaded, so that alias names of event attributes can be used in the declaration alongside their canonical names.
Longed, possibly multiline, human-readable description of the declaration.
This section specifies the actual enrichment of the incoming event. It expects a dictionary to be returned.
Typical statements in
!DICT statement allows to add fields / attributes to the already parsed event