# keep

Create new events containing only `fields` (`{destination: source[]}`).  Source fields are an array of fallback source fields where the first defined value wins.  Destination fields are always defined: set to null if no source has a value.

## Config

**Required:**
- `fields`: Mapping of destination fields to source fields

## Example

```yaml
pipeline:
  keep:
    config:
      fields:
        timestamp: [ts, timestamp, "@timestamp"]
        message: [msg, message, text]
        level: [severity, level]
```