Executes a JMESPath query on JSON documents and replaces the message with the resulting document.

# Common config fields, showing default values
query: ""

This processor is useful for performing large mappings in order to restructure JSON documents. In order to map documents using more advanced logic consider instead using the awk processor.



The JMESPath query to apply to messages.

Type: string
Default: ""


An optional array of message indexes of a batch that the processor should apply to. If left empty all messages are processed. This field is only applicable when batching messages at the input level.

Indexes can be negative, and if so the part will be selected from the end counting backwards starting from -1.

Type: array
Default: []


With the following query:

query: locations[?state == 'WA'].name | sort(@) | {Cities: join(', ', @)}

If the initial contents of a message were JSON document of the form:

"locations": [
{"name": "Seattle", "state": "WA"},
{"name": "New York", "state": "NY"},
{"name": "Bellevue", "state": "WA"},
{"name": "Olympia", "state": "WA"}

Then the resulting contents would be:

{"Cities": "Bellevue, Olympia, Seattle"}

It is possible to create boolean queries with JMESPath, in order to filter messages with boolean queries please instead use the jmespath condition.