limit

The limit function reduces the number of elements in a pcommon.Map to be no greater than the specified limit. It ensures key-value pairs are restricted to a specific count while maintaining essential, prioritized keys.

Syntax: limit(target, limit, priority_keys[])

• Target: The target is a path expression to a pcommon.Map type field within the log entry to be limited.
• Limit: A non-negative integer specifying the maximum number of items to retain in the map.
• Priority Keys: A list of strings indicating attribute keys that should not be dropped when limiting. These keys ensure that critical data is preserved.

Input

{
	"_type": "log",
	"attributes": {...},
	"body": "...",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.domain": "pipeline",
		"ed.org.id": "987654321",
		"ed.source.name": "Kubernetes Source",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"host.ip": "10.0.0.1",
		"host.name": "ED_TEST",
		"service.name": "ed-tester",
		"src_type": null
	},
	"timestamp": 1733378647488
}

Statement

limit(resource, 5, ["ed.org.id", "ed.tag", "ed.conf.id"])

Output

{
	"_type": "log",
	"attributes": {...},
	"body": "...",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.org.id": "987654321",
		"ed.source.name": "Kubernetes Source",
		"ed.tag": "loggen",
		"host.name": "ED_TEST"
	},
	"timestamp": 1733378762172
}

The resource field is limited to 5 entries, retaining specified priority keys ed.org.id, ed.tag, and ed.conf.id while randomly selecting two additional entries until the limit is reached.