Move Field

Moves a telemetry field from one location to another. Choose a source (an attributes or body field) and a destination (an attributes, body, or resource field). The processor reads the source value, writes it to the destination, and removes it from the original location. It runs on a single signal type per instance and applies to all matching records unless a condition narrows it.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux	✓	✓	✓
Windows	✓	✓	✓
macOS	✓	✓	✓
AIX	✓	✓	✓
Kubernetes Node	✓	✓	✓
Kubernetes Cluster	✓	✓	✓
Kubernetes Gateway	✓	✓	✓
OpenShift Node	✓	✓	✓
OpenShift Cluster	✓	✓	✓
OpenShift Gateway	✓	✓	✓
Google SecOps Pipelines	✓	✓	✓

Choose Telemetry Type picks one signal per processor instance. Add another instance to handle a second signal.

Configuration

When to apply

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The signal this instance runs on: Logs, Metrics, or Traces (one at a time).
Condition	OTTL Condition	No	(empty)	An OTTL condition that must evaluate to true for the move to apply. Leave empty to apply to all telemetry.

Move From

Parameter	Type	Required	Default	Description
Move From	Enum: Attributes, Body	Yes	Attributes	The telemetry base to move the field from.
Attributes Field	OTTL Field	No	(empty)	The attributes field to move from. Use bracket notation for nested fields. An empty value moves all attribute fields. Shown when Move From is Attributes.
Body Field	OTTL Field	No	(empty)	The body field to move from. Use bracket notation for nested fields. An empty value moves all body fields. Shown when Move From is Body.

Move To

Parameter	Type	Required	Default	Description
Move To	Enum: Attributes, Body, Resource	Yes	Attributes	The telemetry base to move the field to.
Attributes Field	OTTL Field	No	(empty)	The attributes field to move to. Use bracket notation for nested fields. An empty value overwrites all attribute fields. Shown when Move To is Attributes.
Body Field	OTTL Field	No	(empty)	The body field to move to. Use bracket notation for nested fields. An empty value overwrites all body fields. Shown when Move To is Body.
Resource Field	OTTL Field	No	(empty)	The resource field to move to. Use bracket notation for nested fields. An empty value overwrites all resource fields. Shown when Move To is Resource.

Examples

Move an attribute into a resource field

Promote a host.name attribute to the resource so it describes the source of the telemetry rather than an individual record. This applies to logs.

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: move-field
spec:
  type: move_field_2
  parameters:
    - name: telemetry
      value:
        - Logs
    - name: from_base
      value: Attributes
    - name: from_attributes
      value: host.name
    - name: to_base
      value: Resource
    - name: to_resource
      value: host.name

Nest a body field under another body field

Move a top-level body field named time_local under a parent field named time, only for records where it is present. This standardizes the structure of incoming logs. Note the bracket notation for the nested destination.

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: move-field
spec:
  type: move_field_2
  parameters:
    - name: telemetry
      value:
        - Logs
    - name: condition
      value: body["time_local"] != nil
    - name: from_base
      value: Body
    - name: from_body
      value: time_local
    - name: to_base
      value: Body
    - name: to_body
      value: time["local"]

Move an entire body into an attribute

Leave the source field empty to move the whole body. This is useful for destinations that ignore or mishandle the body field.

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: move-field
spec:
  type: move_field_2
  parameters:
    - name: telemetry
      value:
        - Logs
    - name: from_base
      value: Body
    - name: from_body
      value: ""
    - name: to_base
      value: Attributes
    - name: to_attributes
      value: body_nested

Configuration Tips

• Leave the source field empty to move the entire base (all attributes, or the whole body). Leave the destination field empty to overwrite the entire destination base.

• Use bracket notation (time["local"]) in the destination field to create or address nested fields.

• A move with the same source and destination is a no-op and renders nothing. The destination overwrites whatever already exists at that location.

• Resource is a destination only. You cannot move a field out of resource with this processor.

Troubleshooting

The field does not appear at the destination

Symptoms: after the processor runs, the destination is unchanged.

Solutions:

1. Confirm the source field exists and the Condition evaluates to true for the affected records. A missing source value leaves the destination untouched.

2. Verify the Move From base matches where the field actually lives (Attributes vs. Body).

The original field is still present

Symptoms: the value is copied to the destination but not removed from the source.

Solutions:

1. Check that the source path is exact, including bracket notation for nested fields. The delete targets the same path that was read.

2. Confirm the source and destination are not identical, which is treated as a no-op.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: move-field
spec:
  type: move_field_2
  parameters:
    - name: telemetry
      value:
        - Logs
    - name: condition
      value: ""
    - name: from_base
      value: Attributes
    - name: from_attributes
      value: host.name
    - name: to_base
      value: Resource
    - name: to_resource
      value: host.name

Related Resources

• Transform Processor — OpenTelemetry Collector Contrib

• Rename Fields

• Delete Fields

• Add Fields