Access Metadata

[coredump17]

Hi All,

I have a socket

sources:
  src_syslog:
    type: socket
    address: 0.0.0.0:514
    mode: udp


transforms:
  add_tags:
    type: remap
    inputs:
      - src_syslog
    source: |-
       .meta.listener = "src_syslog"

When i tap the transform 'add_tags' with -m (meta) i see component_id. I want to use the vrl to .meta.listener = %component_id instead of hard coding it but it shows as null.

i tried .meta.listener = %component_id and .meta.listener = .component_id

  vector tap -m  --outputs-of add_tags
{"component_id":"src_syslog","component_kind":"source","component_type":"socket","event"...blah}

any help would be greatly appreciated.

[jszwedko]

This is a bit confusing, but the metadata referred to by vector tap is actually different than event metadata. To see the metadata available on the event itself, I'd recommend adding a remap transform and log(%) to log the metadata fields.

We plan to add support to vector tap to display event metadata in addition to what it currently calls metadata (which is really just where the event was tapped from).