RunReveal
SourcesRevealdProcessors

Refine processor

The refine processor applies rule-based matching to events and extracts or sets fields based on conditions. Use it to route different log types to different source types, or to extract structured fields from raw log data.

Configuration

{
  "sources": {
    "refined-journal": {
      "type": "refine",
      "source": {
        "type": "journald"
      },
      "rules": [
        {
          "match": [
            {
              "path": "rawLog.SYSLOG_IDENTIFIER",
              "value": "sshd"
            }
          ],
          "extract": [
            {
              "to": "sourceType",
              "from": "rawLog.SYSLOG_IDENTIFIER"
            }
          ]
        }
      ]
    }
  }
}

Options

OptionTypeDescription
sourceobjectRequired. Nested source configuration
rulesarrayRequired. List of matching and extraction rules

Rule structure

Each rule has a match array and an extract array:

FieldTypeDescription
match[].pathstringJSONPath to the field to match (e.g. "rawLog.SYSLOG_IDENTIFIER")
match[].valuestringValue to match exactly
extract[].tostringDestination field name (e.g. "sourceType", "service.name")
extract[].fromstringSource JSONPath to extract from

All conditions in a rule's match array must be true (AND logic) for the extraction to apply. Rules are evaluated sequentially.

Example: Route journal entries by service

{
  "sources": {
    "journal": {
      "type": "refine",
      "source": {
        "type": "journald"
      },
      "rules": [
        {
          "match": [
            { "path": "rawLog.SYSLOG_IDENTIFIER", "value": "nginx" }
          ],
          "extract": [
            { "to": "sourceType", "from": "rawLog.SYSLOG_IDENTIFIER" },
            { "to": "service.name", "from": "rawLog.SYSLOG_IDENTIFIER" }
          ]
        },
        {
          "match": [
            { "path": "rawLog.SYSLOG_IDENTIFIER", "value": "sshd" }
          ],
          "extract": [
            { "to": "sourceType", "from": "rawLog.SYSLOG_IDENTIFIER" }
          ]
        }
      ]
    }
  }
}

Previous

Processors

Next

KV

On this page