Expand

Expand (expand)

expand data in various ways: events, XML, multiline events.

Transform json

Minimal example

actions:
  - expand:
      mode:
        csv: {}

JSON

{
  "actions": [
    {
      "expand": {
        "mode": {
          "csv": {}
        }
      }
    }
  ]
}

Contents

• Minimal example

• Fields

• General

• Input

• Output

• Mode

• Schema

Fields

Field	Type	Required	Description
mode Mode	Mode	✅	Expansion strategy to apply.
description General	string		describe this step.
condition General	lua-expression (string)		Only run this action if the specified condition is met. Examples: 2 * count()
delim General	string		Optional delimiter used for multiline expansion helpers.
suppress-warnings General	boolean (bool)		Suppress warnings generated by this action.
input-field Input	field (string)		Select an input field to expand instead of using the full event. Examples: data_field
document-mode Input	boolean (bool)		Treat each document as a standalone expansion boundary.
remove Output	boolean (bool)		Remove the source field once expansion is complete.

General

Show fields

Field	Type	Required	Description
description	string		describe this step.
condition	lua-expression (string)		Only run this action if the specified condition is met. Examples: 2 * count()
delim	string		Optional delimiter used for multiline expansion helpers.
suppress-warnings	boolean (bool)		Suppress warnings generated by this action.

Input

Show fields

Field	Type	Required	Description
input-field	field (string)		Select an input field to expand instead of using the full event. Examples: data_field
document-mode	boolean (bool)		Treat each document as a standalone expansion boundary.

Output

Show fields

Field	Type	Required	Description
remove	boolean (bool)		Remove the source field once expansion is complete.

Mode

Show fields

Field	Type	Required	Description
mode	Mode	✅	Expansion strategy to apply.

Schema

• Mode Options
• Mode - Csv - Header Fields Fields
• Mode - Csv Fields
• Mode - Key Value Fields
• Mode - Events Fields
• Mode - Xml Fields
• Mode - Csv - Fields Table
• Mode - Multiline Table
• Mode - Key Value - Multiple Options

Mode Options

Option	Name	Type	Description
csv	Csv	object	Parse delimited payloads into structured records.
key-value	Key Value	object	Parse key=value formatted payloads.
events	Events	object	Split embedded arrays or records into multiple events.
xml	Xml	object	Expand XML arrays into individual events.
multiline	Multiline	map	Split multi-line text payloads using the delimiter map.
json	Json	bool	Treat payload as JSON lines (true) or arrays (false).

Mode - Csv - Header Fields Fields

Field	Type	Required	Description
header-field	field (string)		Field containing header (CSV column names). Examples: data_field
header-field-types	boolean (bool)		Field containing header has types specified (with name:type format).
header-field-on-change	boolean (bool)		With ‘header-field`, only write out headers if columns change.
null-value	string		A subSstitute string value to be used in the event that a field is null.

Mode - Csv Fields

Field	Type	Required	Description
relaxed-schema	boolean (bool)
header	boolean (bool)
gen-headers	boolean (bool)
autoconvert	boolean (bool)
fields	map (string)
field-file	path (string)		Examples: /path/to/file, c:\users\joe\data\file.txt
header-fields	Header Fields

Mode - Key Value Fields

Field	Type	Required	Description
autoconvert	boolean (bool)
key-value-delim	string
multiple	Multiple		Allowed values: first, last, array

Mode - Events Fields

Field	Type	Required	Description
output-split-field	field (string)		Examples: data_field
skip-list	regex[] (string)	✅	JSON Pointer patterns (regex) to skip flattening when splitting events. Examples: \d+[A-Z]*
exclude-non-empty-arrays	boolean (bool)

Mode - Xml Fields

Field	Type	Required	Description
arrays	string[]		List of fields in an xml payload to be expanded into separate events.

Mode - Csv - Fields Table

Field	Type
event.field	str

Key format: field.

Mode - Multiline Table

Field	Regex
event.field	^pattern$

Key format: field. Value format: regex.

Mode - Key Value - Multiple Options

Value	Description
first	First
last	Last
array	Array