Ask Your Question

Revision history [back]

If you want to stick with the off-the-shelf processors, you can do as @iamontheinet suggests, and add a Field Remover processor configured to keep only the `/alert_details' field. Alternatively, you can use a script evaluator to restructure the record.

Here's an example in Jython:

for record in records:
  try:
    # Put old root in a new map, under /alert_details
    record.value = {'alert_details' : record.value}    

    # Write record to processor output
    output.write(record)

  except Exception as e:
    # Send record to error
    error.write(record, str(e))

Note that using off-the-shelf processors is almost always much faster than reaching for a script evaluator, but some things are easy to do in a script that are much more convoluted without a few lines of code.