Bloblang Code

Utilize the Bloblang mapping language to transform an event.

• Bloblang Reference

Usage

• Operates On: Events
• Label: Optional
• Filter: Optional

Required Configuration

• Bloblang Mapping: A Bloblang mapping, ie. a code snippet.

Example

In Bloblang, each incoming event is stored in the variable this and on exit the outgoing event is taken from the root document root. Assigning values from this to root will copy the incoming event to the outgoing event.

Use the following Bloblang mapping to transform an event:

# assign incoming event values to the root document
root = this

# you can also copy only select fields
root.hostname = this.hostname

# hex encode the hostname
root.hostname = root.hostname.encode("hex")
root.num_fields = root.length()

# you can assign deleted() to root to drop the event
# if root.num_fields == 0 { root = deleted() }

# remap all top-level keys to their uppercase version, skip _meta
root = root.map_each_key(key -> if !key.has_prefix("_") {key.uppercase()})

# remove a given tag value from DDTAGS
root.DDTAGS = root.DDTAGS.filter(tag -> !tag.contains("badtag"))

Before

The top-level map field _meta is always injected into the this object and represents the metadata about the individual event. You should consider it read-only, it will be removed from the event after the Bloblang Code function has finished. If you rename the _meta key or move it to else where in the root document, it will be copied to the event.

{
	"_meta": {
		"source": {
			"type": "datadog_agent",
			"id": "",
			"name": "FAKE"
		},
		"http": {
			"path": "/api/v2/logs",
			"method": "POST",
			"headers": {
				"Content-Type": [
					"application/json"
				]
			}
		},
		"type": "log"
	},
	"message": "message",
	"status": "status",
	"timestamp": 1718144913,
	"hostname": "hostname",
	"service": "zookeeper",
	"ddsource": "ddsource",
	"ddtags": [
		"env:demo",
		"badtag:timestamp"
	]
}

After

{
	"_meta": {
		"source": {
			"id": "",
			"name": "FAKE",
			"type": "datadog_agent"
		},
		"http": {
			"headers": {
				"Content-Type": [
					"application/json"
				]
			},
			"path": "/api/v2/logs",
			"method": "POST"
		},
		"type": "log"
	},
	"DDTAGS": [
		"env:demo"
	],
	"STATUS": "status",
	"MESSAGE": "message",
	"HOSTNAME": "686f73746e616d65",
	"SERVICE": "zookeeper",
	"NUM_FIELDS": 7,
	"TIMESTAMP": 1718144880,
	"DDSOURCE": "ddsource"
}