Given a 'kv' processor, It's kind of essential to be able to add matching keys to the targetField, if exists, instead of completely override it.
For example:
{
"kv": {
"config": {
"field": "kv",
"fieldSplit": "\\|#",
"includeKeys": [
"key1",
"key2",
"key3"
],
"targetField": "@params",
"targetFieldMergeStrategy": "Replace" | "Concat" <-- suggestion
}
}
}
In the example above, given a log such as:
{
...
"message": "My log message|#key1=value1|#key2=value2|#key3=value3",
"@params":
"my": "param"
}
the final result shoud be:
{
...
"message": "My log message|#key1=value1|#key2=value2|#key3=value3",
"@params":
"my": "param",
"key1": "value1",
"key2": "value2",
"key3": "value3"
}
currently we are getting:
{
...
"message": "My log message|#key1=value1|#key2=value2|#key3=value3",
"@params":
"key1": "value1",
"key2": "value2",
"key3": "value3"
}