choose
Description
The choose
command removes all keypaths not explicitly specified. This allows you to extract and reshape only the data you need from a larger log document.
Note
The choose
command supports nested key paths and aliasing in the output, making it useful for simplifying complex documents.
Syntax
Example
Use case: Extract, flatten, and transform key values from log documents
We have logs containing detailed HTTP request metadata, but we only want to keep a few key fields—specifically the request path, status code, and number of bytes received. We’ll also add a static field to mark the report author and perform a calculation to convert bytes to megabytes.
Example data
{
"status_code": 200,
"user": "Chris",
"path": "/home",
"http_request": {
"metrics": {
"bytes_metrics": {
"bytes_received": 57819
}
}
}
}
Example query
Example output
The choose
command extracts only the requested fields, flattens nested keypaths, adds a calculated value, and includes a constant metadata field for easy tracking or reporting.