Use the Insert String transformation type to insert strings into a record. Insert strings by building an expression of tokens. An Insert String transformation does not perform conditional processing, so it transforms and forwards all the records that it receives.
You can configure the following properties for the Insert String transformation type:
- Entity Name
- Name of the transformation. Maximum length is 32 characters.
- Description of the transformation. Maximum length is 256 characters.
- String Expression
- Token expression that describes how to transform each record.
- Apply Transformation On
- Select the source service, target service, or aggregator on which you want to apply the transformation.
- You can collect and monitor the following statistics:
- Events Received
- Bytes Received
- Events Sent
- Bytes Sent
- Time Taken for Transformation (Milliseconds)
Tokens begin with the pound sign (#). Use a built-in token to add a time stamp, host name, or delimiter. Use the custom-string token to add a custom string to the record that you want to transform.
EDS also provides a token for the input data, and you must include that token in your expression. Delimiters are optional.
Use the following tokens to construct an expression:
- #HOSTNAME. Name of the host on which the source service runs.
- #TIMESTAMP. System time, in milliseconds, recorded from the host that runs the source. The time stamp indicates the time at which the transformation transformed the record.
- #DATA. Data to transform.
- #<custom_string>. Custom string to insert.
- #LF. Line feed delimiter.
- #CRLF. Carriage return line feed delimiter.
- #TIMEUUID. Unique identifier to append or prepend to the event based on timestamp and IP address.
- #RANDOMUUID. Random unique identifier to append or prepend to the event.
You can insert a token multiple times in an expression. For example, you can insert the host name twice, as follows:
EDS does not validate token expressions. Use the following rules to verify that the token expression is valid:
- The token must begin with the pound sign (#).
- Use only upper case characters in the token. For example, enter
#HOSTNAME, and not
#hOSTNAME. If you try to insert a host name with the token
hOSTNAME as a custom string. Custom string tokens can contain both uppercase and lowercase characters. If all the characters in a string use uppercase, verify that the string does not match the strings in the built-in tokens, such as
- Insert delimiter tokens at the end of your expression.
- Always include the
- Do not use an expression that includes only the
If you specify an erroneous token expression for an Insert String transformation, it forwards the record to the targets without performing any transformation.
The following token expression prefixes the host name and the system time to the input data:
The following token expression appends the custom string
MyCustomString to the input data:
The following example appends a line feed delimiter to the input data:
The following example appends a unique identifier based on timestamp and IP address to the input data:
The following example appends a random unique identifier to the input data:
If you are transforming raw data, you cannot predict where the strings that you specify in the token expression will appear in a line of data. If the source service breaks a line down into blocks, the transformation appends and prefixes strings to each block of raw data. After transformation, the line includes multiple instances of the prefixed and appended strings.
For example, if you configure the Insert String transformation to prefix the time stamp and append the host name to data, and the source service breaks a line down into three data blocks, the transformed line includes multiple instances of the time stamp and host name strings, as follows: