# keep

Create new events containing only fields ({destination: source[]}). Source fields are an array of fallback source fields where the first defined value wins. Destination fields are always defined: set to null if no source has a value.

# Config

Required:

fields: Mapping of destination fields to source fields

# Example

pipeline:
  keep:
    config:
      fields:
        timestamp: [ts, timestamp, "@timestamp"]
        message: [msg, message, text]
        level: [severity, level]