All Sources: How to Use Transforms
Use Transforms
Example Config
yaml
sources:
  demo:
    type: file
    include: /home/me/demo_log_file.log
    sink: logscale
    transforms:
      # regex_filter transform can filter events by either including or excluding events matching a regex pattern.
      - type: regex_filter
        mode: include
        pattern: ^category=(error|warning|info|debug)

      # static_fields transform adds configured key, value pairs as fields
      - type: static_fields
        fields:
          mykey: myvalue
          #fields to add must be indented 2 spaces under the fields: label
          # Passing environment variables is supported
          myenvvar: $MY_ENV_VAR

You can use multiple events on one single line (recommended) or on multiple lines:

Single Line Transforms( AND or OR can be used in the regex statement) 

transforms:
  - type: regex_filter
    mode: exclude
    pattern: (some pattern|another pattern)

Multi-Line Transforms (the statements are treat as AND) 

transforms:
  - type: regex_filter
    mode: exclude
    pattern: some pattern

  - type: regex_filter
    mode: exclude
    pattern: another pattern

Table: Transforms

ParameterTypeRequiredDefault ValueDescription
typetransformtyperequired   Must be set to "regex_filter" or "static_fields".
   Values
   regex_filter
   static_fields

Table: Static Fields

ParameterTypeRequiredDefault ValueDescription
fieldsstringrequired   An object containing field-value pairs.
typeconst:static_fieldsrequired   Must be set to "static_fields".

Table: Regex-filter

ParameterTypeRequiredDefault ValueDescription
fieldstringoptional[a]   The field to apply the regex pattern to.
moderegexfiltermoderequired   Determines whether to include or exclude events that match the pattern. Must be set to "include" or "exclude".
   Values
   exclude
   include
patternstringrequired   The regex pattern to match.
typeconst:regex_filterrequired   Must be set to "regex_filter".

[a] Optional parameters use their default value unless explicitly set.