Expand

Expand (expand)

expand data in various ways: events, XML, multiline events.

Transform json

Minimal example

actions:
  - expand:
      mode:
        csv: {}

JSON

{
  "actions": [
    {
      "expand": {
        "mode": {
          "csv": {}
        }
      }
    }
  ]
}

Contents

• Minimal example

• General

• Input

• Mode

• Output

• Schema

A ✓ marks a field that accepts a context variable such as {{ VARIABLE }}.

General

General

Field	Type	Required	Description
description	string		describe this step.
condition	lua-expression (string)		Only run this action if the specified condition is met. Examples: 2 * count()
delim	string		Optional delimiter used for multiline expansion helpers.
suppress-warnings ✓	boolean (bool)		Suppress warnings generated by this action. Default: false

Input

Input

Field	Type	Required	Description
input-field	field (string)		Select an input field to expand instead of using the full event. Examples: data_field
document-mode ✓	boolean (bool)		Treat each document as a standalone expansion boundary. Default: false

Mode

Mode

Field	Type	Required	Description
mode	Mode	✅	Expansion strategy to apply. Allowed values: csv, key-value, events, xml, multiline, json

Output

Output

Field	Type	Required	Description
remove ✓	boolean (bool)		Remove the source field once expansion is complete. Default: false

Schema

• Mode Options
• Mode - CSV - Header Fields Fields
• Mode - CSV Fields
• Mode - Key/Value Fields
• Mode - Events Fields
• Mode - XML Fields
• Mode - CSV - Fields Table
• Mode - Multiline Table
• Mode - Key/Value - Multiple Options

Mode Options

Option	Name	Type	Description
csv	CSV	object	Parse delimited payloads into structured records.
key-value	Key/Value	object	Parse key=value formatted payloads.
events	Events	object	Split embedded arrays or records into multiple events.
xml	XML	object	Expand XML arrays into individual events.
multiline	Multiline	map	Split multi-line text payloads using the delimiter map.
json	JSON Lines	bool	Treat payload as JSON lines (true) or arrays (false). Default: false

Mode - CSV - Header Fields Fields

Field	Type	Required	Description
header-field	field (string)		Field containing header (CSV column names). Examples: data_field
header-field-types ✓	boolean (bool)		Field containing header has types specified (with name:type format). Default: false
header-field-on-change ✓	boolean (bool)		With ’header-field, only write out headers if columns change.<br>Default: false`
null-value	string		A subSstitute string value to be used in the event that a field is null.

Mode - CSV Fields

Field	Type	Required	Description
relaxed-schema ✓	boolean (bool)		Default: false
header ✓	boolean (bool)		Default: false
gen-headers ✓	boolean (bool)		Default: false
autoconvert ✓	boolean (bool)		Default: true
fields	map (string)
field-file	path (string)		Examples: /path/to/file, c:\users\joe\data\file.txt
header-fields	Header Fields

Mode - Key/Value Fields

Field	Type	Required	Description
autoconvert ✓	boolean (bool)		Default: true
key-value-delim	string		Default: =
multiple	Multiple		Allowed values: first, last, array

Mode - Events Fields

Field	Type	Required	Description
output-split-field	field (string)		Examples: data_field
skip-list	regex[] (string)	✅	JSON Pointer patterns (regex) to skip flattening when splitting events. Examples: \d+[A-Z]*
exclude-non-empty-arrays ✓	boolean (bool)		Default: false

Mode - XML Fields

Field	Type	Required	Description
arrays	string[]		List of fields in an xml payload to be expanded into separate events.

Mode - CSV - Fields Table

Field	Type
event.field	str

Key format: field.

Mode - Multiline Table

Field	Regex
event.field	^pattern$

Key format: field. Value format: regex.

Mode - Key/Value - Multiple Options

Value	Aliases	Name	Description
first		first
last		last
array		array