edx_keep_matching_keys

Learn about the edx_keep_matching_keys Edge Delta OTTL extension function.

  less than a minute  

Minimum Agent Version: v1.23.0

edx_keep_matching_keys enhances the standard OTTL keep_matching_keys function. While the default OTTL function accepts only a single regex pattern, this Edge Delta extension enables you to provide multiple regex patterns simultaneously. This allows you to retain keys matching any of several patterns in one operation, making complex filtering scenarios more efficient.

Syntax

edx_keep_matching_keys(input, ["key1", "key2"])
  • input: A map (e.g., resource or attributes) from which keys are selectively retained.
  • keys: An array of regex-like patterns for matching and retaining keys.

Input:

{
  "_type": "log",
  "timestamp": 1735796604731,
  "body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
  "resource": {...},
  "attributes": {
    "decoded_body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
    "kv_map": {
      "connection_id": "conn456",
      "debug_info": "verbose",
      "event_status": "success",
      "event_type": "login",
      "session_id": "abc123",
      "temp_data": "sensitiveData",
      "temp_file": "report_tmp.log",
      "user_id": "admin"
    }
  }
}

Example:

edx_keep_matching_keys(attributes["kv_map"], ["(.*_id$)", "(temp_.*|debug_.*)"])

Output:

{
  "_type": "log",
  "timestamp": 1735796570758,
  "body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
  "resource": {...},
  "attributes": {
    "decoded_body": "session_id=abc123 user_id=admin event_type=login event_status=success debug_info=verbose connection_id=conn456 temp_file=report_tmp.log temp_data=sensitiveData",
    "kv_map": {
      "connection_id": "conn456",
      "debug_info": "verbose",
      "session_id": "abc123",
      "temp_data": "sensitiveData",
      "temp_file": "report_tmp.log",
      "user_id": "admin"
    }
  }
}

The keys event_status and event_type have been removed as they do not match one of the patterns.