How do I add fields or routing tags to Fluentd events?

Use Fluentd's built-in record_transformer filter to add fields to a log record. If you need to change which output receives the event, change its routing tag instead. A record field and a Fluentd tag serve different purposes.

Add fields to the record

Place this filter before the matching output in your configuration:

<filter app.**>
  @type record_transformer
  <record>
    hostname "#{Socket.gethostname}"
    env production
    tag_part ${tag}
  </record>
</filter>

Events tagged app.** gain hostname, env, and tag_part fields. Here, tag_part contains the whole original tag despite its name. Use ${tag_parts[1]} if you specifically want its second dot-separated component.

You can also read an environment variable with configuration interpolation, such as env "#{ENV['APP_ENV']}". Set that variable in the Fluentd process environment and decide how to handle a missing value.

Route error events with a different tag

The rewrite_tag_filter output plugin re-emits matching records with a new tag. Ensure fluent-plugin-rewrite-tag-filter is installed in your Fluentd distribution before using it.

The following block follows the enrichment filter above:

<match app.**>
  @type rewrite_tag_filter
  <rule>
    key level
    pattern /^ERROR$/
    tag error.${tag}
  </rule>
  <rule>
    key tag_part
    pattern /.+/
    tag other.${tag}
  </rule>
</match>

<match error.**>
  @type stdout
</match>

<match other.**>
  @type stdout
</match>

An ERROR event tagged app.checkout becomes error.app.checkout. The fallback rule sends other records, including records with no level, to other.app.checkout; it relies on the tag_part field added by the preceding filter. The stdout outputs make both routes observable while you test. Replace them with your intended destinations afterward.

Include a fallback when non-error events must be retained. Records that match no rewrite rule are not automatically passed to a later output under the original tag. Also keep the new tags outside app.** so that re-emitted records do not enter the same rewrite block repeatedly.

Set the tag at collection time

For a tail input, tag app.* expands the single * from the file path. With /var/log/app.log, the resulting tag is app.var.log.app.log. Use a fixed tag such as app.checkout when path-based routing is unnecessary. The input still needs its normal path, position-file, and parser configuration; the tag only identifies the event stream.

Does the tag appear in the output record?

Not automatically as a record field. The tag is routing metadata; an output's protocol or formatter may carry it separately. If the destination needs it inside the record, explicitly copy ${tag} into a field, as in the first example.

Can I add a timestamp field?

Yes. Enable Ruby expressions and format the event's time:

<filter app.**>
  @type record_transformer
  enable_ruby true
  <record>
    event_time ${time.utc.strftime('%Y-%m-%dT%H:%M:%SZ')}
  </record>
</filter>

This records the event time in UTC to whole-second precision. It is not the wall-clock time when the filter processes the event. Place this filter before the rewrite output if you use both examples.

See Fluentd's record transformer, tag rewrite, and tail input documentation for the supported syntax and options.