expandobject

The expandobject command expands the direct child fields of object fields into top-level event fields.

Syntax

The expandobject command accepts a list of object field names. If any field is present and contains an object, each direct child key-value pair is added as a new top-level field on the event.

| expandobject <field> [<field> ...]

Example

For an example event where the field foo is an object with the following value:

{"bar": "baz"}

This command would add a new top-level field called bar to the event, with the value of "baz":

| expandobject foo