hash_value_field support (from fluentd) for fluent-bit's filter_parsers #8893
Description
Is your feature request related to a problem? Please describe.
Using filter_parser you can parse a field into a new value. For example
[FILTER]
Name parser
Match systemd.json
Parser systemd_json
Key_name MESSAGE
Reserve_Data On
Allows me to take a MESSAGE field from some incoming systemd (journald) logs, and parse them.
One minor issue, is that it all gets merged down into the original hash value
# Input
{"MESSAGE": '{"some":"value"}}
# Output
{"MESSAGE": '{"some":"value"}, "some":value}
Fluentd's version of filter_parser supports a hash_value_field field, that lets us control where this goes.
# Input
{"MESSAGE": '{"some":"value"}}
# Output
{"MESSAGE": '{"some":"value"}, "parsed": {"some":value}}
What would be involved in allowing fluent-bit's filter_parser to support a similar hash_value_field target, to avoid a case where something parsed out might overwrite another field
I think it's not really possible to use filter_lua to parse it, and I think there's no way to have filter_record_modifer to make a copy either. I'm trying to simplify a few things to avoid deploying fluentd, so I'm hoping there might be a way to handle this within fluent-bit alone.