Coerce processor

The coerce processor converts explicitly-named fields in rawLog to numeric types (int or float). Parsers like kv and regex emit every value as a string; coerce turns the fields you choose into real numbers.

Crucially, coerce keeps each field's type stable across every event. A field configured as int is always an integer (or absent) — never a number on some events and a string on others. That stability matters downstream where a column's type is fixed: a single unexpectedly non-numeric value can otherwise break ingestion or change a column's type.

This is intentionally explicit. There is no "parse anything that looks like a number" mode, because the same field arriving as 5 on one event and unknown on the next would produce an unstable column type.

Configuration

Chain coerce after the parser that produced the fields. In this example, a kv stage parses FortiGate syslog into top-level fields, and coerce types the numeric ones:

{
  "sources": {
    "fortigate": {
      "type": "coerce",
      "source": {
        "type": "kv",
        "source": {
          "type": "syslog",
          "addr": ":514"
        },
        "rules": [
          {
            "match": [{ "path": "sourceType", "value": "fortigate" }],
            "kvSep": "="
          }
        ]
      },
      "rules": [
        {
          "match": [{ "path": "sourceType", "value": "fortigate" }],
          "fields": [
            { "path": "srcport", "type": "int" },
            { "path": "dstport", "type": "int" },
            { "path": "sentbyte", "type": "int" },
            { "path": "rcvdbyte", "type": "int" },
            { "path": "cpu", "type": "float" }
          ],
          "onError": "drop"
        }
      ]
    }
  }
}

Options

Option	Type	Description
`source`	object	Required. Nested source configuration
`rules`	array	Required. List of coercion rules

Rule structure

Field	Type	Description
`match[].path`	string	JSONPath to the field to match (e.g. `"sourceType"`, `"rawLog.type"`)
`match[].value`	string	Value to match exactly
`fields[].path`	string	Path to the value within `rawLog` to convert (see below)
`fields[].type`	string	Target type: `"int"` or `"float"`
`onError`	string	What to do when a present value can't be parsed: `"drop"` (default) or `"zero"`

All conditions in a rule's match array must be true (AND logic). Rules are evaluated sequentially and the first match wins.

Choosing the field path

A field's path must mirror the shape the upstream stage produced in rawLog — coerce does not guess.

The kv and regex processors write their output in one of two shapes:

Top level (the typical setup): if the parser wrote PORT=1234 to the top of rawLog, the coerce path is just PORT. The parsing step is transparent — no prefix.
Nested: if a kv stage was configured in field mode with a target (e.g. parsed), the value lives at parsed.PORT, so the coerce path is parsed.PORT.

A leading rawLog. prefix is accepted and stripped, so srcport and rawLog.srcport are equivalent. To see the exact shape your pipeline produces, run reveald with a printer destination and inspect one event's rawLog.

Handling unparseable values

When a configured field is present but does not parse as the target type, the rule's onError policy decides what happens. A field that is absent is always left absent. In every case a warning is logged so unexpected data stays visible.

`onError`	Behavior	Result
`drop` (default)	Remove the field	Column stays numeric or null — never the wrong type
`zero`	Set the field to `0`	Column stays numeric; original value is lost

For example, with { "path": "dur", "type": "int" } and the default drop policy, a value of "0.042" does not silently truncate to 0 — it fails to parse as an integer and the field is dropped instead.

KV processor - Parse key-value pairs into rawLog, commonly chained before coerce
Regex processor - Extract fields with named capture groups
Processors overview - How processors wrap sources and chain together