merge_maps

The merge_maps function combines key-value pairs from a source map into a target map. Using strategies such as insert, upsert, or update, this function allows for flexible handling of key conflicts and integration scenarios.

Syntax: merge_maps(target, source, strategy)

• Target: The target is the map where new entries will be merged or updated.
• Source: The source is another map containing entries to be merged into the target.
• Strategy: The merging strategy defines how key conflicts are handled:
  • insert: Adds entries only if they do not exist in the target.
  • upsert: Adds entries from the source and updates existing matching keys.
  • update: Only updates existing keys in the target if they appear in the source.

Input

{
	"_type": "log",
	"attributes": {
		"parsed_body": {
			"ed.tag": "log-gen",
			"eventCategory": "Management",
			"eventName": "ListStacks"
		}
	},
	"body": "...",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.org.id": "987654321",
		"ed.source.type": "memory_input",
		"ed.tag": "loggen",
		"service.name": "ed-tester"
	},
	"timestamp": 1733380292966
}

Statement

merge_maps(resource, attributes["parsed_body"], "upsert")

Output

{
	"_type": "log",
	"attributes": {
		"parsed_body": {
			"ed.tag": "log-gen",
			"eventCategory": "Management",
			"eventName": "ListStacks"
		}
	},
	"body": "...",
	"resource": {
		"ed.conf.id": "123456789",
		"ed.org.id": "987654321",
		"ed.tag": "log-gen",
		"eventCategory": "Management",
		"eventName": "ListStacks",
		"src_type": null
	},
	"timestamp": 1733380313647
}

The function merges attributes["parsed_body"] into resource using the upsert strategy, updating keys from the source or adding them if they don’t exist. For example, ed.tag in resources was updated with the value from attributes.