:plugin: alter
:type: filter

///////////////////////////////////////////
START - GENERATED VARIABLES, DO NOT EDIT!
///////////////////////////////////////////
:version: %VERSION%
:release_date: %RELEASE_DATE%
:changelog_url: %CHANGELOG_URL%
:include_path: ../../../../logstash/docs/include
///////////////////////////////////////////
END - GENERATED VARIABLES, DO NOT EDIT!
///////////////////////////////////////////

[id="plugins-{type}s-{plugin}"]

=== Alter filter plugin

include::{include_path}/plugin_header.asciidoc[]

==== Description

The alter filter allows you to do general alterations to fields 
that are not included in the normal mutate filter. 


NOTE: The functionality provided by this plugin is likely to
be merged into the 'mutate' filter in future versions.

[id="plugins-{type}s-{plugin}-options"]
==== Alter Filter Configuration Options

This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.

[cols="<,<,<",options="header",]
|=======================================================================
|Setting |Input type|Required
| <<plugins-{type}s-{plugin}-coalesce>> |<<array,array>>|No
| <<plugins-{type}s-{plugin}-condrewrite>> |<<array,array>>|No
| <<plugins-{type}s-{plugin}-condrewriteother>> |<<array,array>>|No
|=======================================================================

Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
filter plugins.

&nbsp;

[id="plugins-{type}s-{plugin}-coalesce"]
===== `coalesce` 

  * Value type is <<array,array>>
  * There is no default value for this setting.

Sets the value of field_name to the first nonnull expression among its arguments.

Example:
[source,ruby]
    filter {
      alter {
        coalesce => [
             "field_name", "value1", "value2", "value3", ...
        ]
      }
    }

[id="plugins-{type}s-{plugin}-condrewrite"]
===== `condrewrite` 

  * Value type is <<array,array>>
  * There is no default value for this setting.

Change the content of the field to the specified value
if the actual content is equal to the expected one.

Example:
[source,ruby]
    filter {
      alter {
        condrewrite => [ 
             "field_name", "expected_value", "new_value",
             "field_name2", "expected_value2", "new_value2",
             ....
           ]
      }
    }

[id="plugins-{type}s-{plugin}-condrewriteother"]
===== `condrewriteother` 

  * Value type is <<array,array>>
  * There is no default value for this setting.

Change the content of the field to the specified value
if the content of another field is equal to the expected one.

Example:
[source,ruby]
    filter {
      alter {
        condrewriteother => [ 
             "field_name", "expected_value", "field_name_to_change", "value",
             "field_name2", "expected_value2", "field_name_to_change2", "value2",
             ....
        ]
      }
    }



[id="plugins-{type}s-{plugin}-common-options"]
include::{include_path}/{type}.asciidoc[]