Expand

Expand (expand)

expand data in various ways: events, XML, multiline events.

Transform json

Minimal example

actions:
  - expand:
      mode:
        csv: {}

JSON

{
  "actions": [
    {
      "expand": {
        "mode": {
          "csv": {}
        }
      }
    }
  ]
}

Contents

• Minimal example

• General

• Input

• Mode

• Output

• Schema

General

General

Field	Type	Required	Description
description	string		describe this step.
condition	lua-expression (string)		Only run this action if the specified condition is met. Examples: 2 * count()
delim	string		Optional delimiter used for multiline expansion helpers.
suppress-warnings ✓	boolean (bool)		Suppress warnings generated by this action. Default: false

Input

Input

Field	Type	Required	Description
input-field	field (string)		Select an input field to expand instead of using the full event. Examples: data_field
document-mode ✓	boolean (bool)		Treat each document as a standalone expansion boundary. Default: false

Mode

Mode

Field	Type	Required	Description
mode	Expand Mode	✅	Expansion strategy to apply. Allowed values: csv, key-value, events, xml, multiline, json

Output

Output

Field	Type	Required	Description
remove ✓	boolean (bool)		Remove the source field once expansion is complete. Default: false

Schema

• Expand Mode Options
• Expand Mode - Csv - Header Fields Fields
• Expand Mode - Csv Fields
• Expand Mode - Key Value Fields
• Expand Mode - Events Fields
• Expand Mode - Xml Fields
• Expand Mode - Csv - Fields Table
• Expand Mode - Multiline Table
• Expand Mode - Key Value - Multiple Options

Expand Mode Options

Option	Name	Type	Description
csv	Csv	object	Parse delimited payloads into structured records.
key-value	Key Value	object	Parse key=value formatted payloads.
events	Events	object	Split embedded arrays or records into multiple events.
xml	Xml	object	Expand XML arrays into individual events.
multiline	Multiline	map	Split multi-line text payloads using the delimiter map.
json	Json	bool	Treat payload as JSON lines (true) or arrays (false). Default: false

Expand Mode - Csv - Header Fields Fields

Field	Type	Required	Description
header-field	field (string)		Field containing header (CSV column names). Examples: data_field
header-field-types ✓	boolean (bool)		Field containing header has types specified (with name:type format). Default: false
header-field-on-change ✓	boolean (bool)		With ‘header-field, only write out headers if columns change.<br>Default: false`
null-value	string		A subSstitute string value to be used in the event that a field is null.

Expand Mode - Csv Fields

Field	Type	Required	Description
relaxed-schema ✓	boolean (bool)		Default: false
header ✓	boolean (bool)		Default: false
gen-headers ✓	boolean (bool)		Default: false
autoconvert ✓	boolean (bool)		Default: true
fields	map (string)
field-file	path (string)		Examples: /path/to/file, c:\users\joe\data\file.txt
header-fields	Header Fields

Expand Mode - Key Value Fields

Field	Type	Required	Description
autoconvert ✓	boolean (bool)		Default: false
key-value-delim	string		Default: =
multiple	Multiple		Allowed values: first, last, array

Expand Mode - Events Fields

Field	Type	Required	Description
output-split-field	field (string)		Examples: data_field
skip-list	regex[] (string)	✅	JSON Pointer patterns (regex) to skip flattening when splitting events. Examples: \d+[A-Z]*
exclude-non-empty-arrays ✓	boolean (bool)		Default: false

Expand Mode - Xml Fields

Field	Type	Required	Description
arrays	string[]		List of fields in an xml payload to be expanded into separate events.

Expand Mode - Csv - Fields Table

Field	Type
event.field	str

Key format: field.

Expand Mode - Multiline Table

Field	Regex
event.field	^pattern$

Key format: field. Value format: regex.

Expand Mode - Key Value - Multiple Options

Value	Name	Description
first	first	First
last	last	Last
array	array	Array