Skip to main content

The Flatten Function

Description​

The Flatten Function is used to flatten fields out of a nested structure. Let's flatten the _raw JSON object, to further reduce the event's size before we send it to the intended destination(s).

Steps – Adding a Flatten Function​

important
  1. Select the Add Function button at the top right.
  2. In the search bar, type flatten, and select the Flatten Function. It will be added at the bottom of the Pipeline.
  3. We don't need to change this Function's default configuration, so just select Save.

Flatten1

Results​

The nested JSON fields have been flattened to top-level fields below _raw.

Flatten2

note

Don't worry about the _raw field's deletion (red strikeout). This is the Flatten Function's default behavior. We'll restore _raw after we clean and reduce the event even more.

The flattened field names are lengthy and confusing. Let's rename them with the Rename Function.