Transform operators :: Kloudfuse Docs
Transform operators
decolorize
Removes ANSI terminal color codes from the log line, leaving plain text. Development tools and container runtimes often emit colored output; decolorize makes such lines readable in query results and safe for downstream parsing.
Syntax
| decolorize
Example
Strip any color escape sequences from JVM garbage-collection log lines before reading them.
{source="busybox"} | decolorize
Expected output
[1728193.358s][info][gc] GC(89702) Pause Young (Mixed) (G1 Evacuation Pause) 32237M->7943M(40960M) 52.316ms
[2486072.473s][info][gc] GC(168886) Pause Young (Normal) (G1 Evacuation Pause) 40968M->12435M(49152M) 37.498ms
[1980334.497s][info][gc] GC(98036) Pause Young (Normal) (G1 Evacuation Pause) 33254M->9208M(40960M) 32.426ms
Lines without color codes pass through unchanged, so decolorize is safe to apply unconditionally. |
drop
Removes the named labels from each line’s label set. Use it after a parser that extracted more fields than you need — fewer labels means fewer distinct series when the pipeline feeds a metric query, and less noise in log results.
Syntax
| drop <label> [, <label> ...] [, <label>="<value>"]
Parameters
| Parameter | Required | Description |
|---|---|---|
<label> |
Required | One or more label names to remove. |
<label>="<value>" |
Optional | Conditional form: the label is dropped only on lines where it equals the given value. |
Example
Parse Filebeat JSON events, then drop the source-code location fields that the json parser extracted but the investigation does not need.
{source="filebeat"}
| json
| drop log_origin_file_name, log_origin_file_line
Expected output
{"log.level":"info","@timestamp":"2026-07-04T15:36:22.411Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:36:52.410Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:37:52.411Z","log.logger":"monitoring","log.origin":{"file.name ...
drop affects only the pipeline label set, not the stored log data.When most labels should go, keep is the shorter way to express the same intent. |
keep
Removes every label except the ones named. keep is the complement of drop: state what you want instead of what you do not, which is usually shorter after a parser that extracts many fields.
Syntax
| keep <label> [, <label> ...] [, <label>="<value>"]
Parameters
| Parameter | Required | Description |
|---|---|---|
<label> |
Required | One or more label names to retain; all other labels are removed. |
<label>="<value>" |
Optional | Conditional form: the label is kept only on lines where it equals the given value. |
Example
Parse Filebeat JSON events and reduce the label set to just the log level and message.
{source="filebeat"} | json | keep log_level, message
Expected output
{"log.level":"info","@timestamp":"2026-07-04T15:41:52.411Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:41:22.410Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:40:52.410Z","log.logger":"monitoring","log.origin":{"file.name ...
Stream labels can be kept or removed like any other label — keep applies to the whole label set. |
label_format
Renames a label or assigns it a value rendered from a Go template. label_format status=statusCode renames statusCode to status; a double-quoted right-hand side is treated as a template, so labels can also be derived from other labels.
Syntax
| label_format <new>=<old> [, <label>="<template>"]
Parameters
| Parameter | Required | Description |
|---|---|---|
<new>=<old> |
Required | Renames label <old> to <new>. The right-hand side is a bare label name. |
<label>="<template>" |
Optional | Sets <label> to the rendered Go template value; reference other labels as {{.label}}. |
Example
Rename the parsed statusCode label to the shorter status and keep only successful requests using the new name.
{source="grafana"} |= "duration="
| logfmt
| label_format status=statusCode
| status="200"
Expected output
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
| Renaming with a bare label name moves the value — the old label is removed. Multiple assignments in one label_format are separated by commas, but a label can be assigned only once per stage. |
line_format
Replaces the log line with text rendered from a Go template. The template can reference any label as {{.label}}, which makes line_format the tool for trimming noisy lines down to the fields that matter, or for assembling a new line from parsed fields.
Syntax
| line_format "<template>"
Parameters
| Parameter | Required | Description |
|---|---|---|
<template> |
Required | A Go template string. {{.label}} inserts a label value; template functions such as upper, trunc, and printf are available. |
Example
Reduce verbose Grafana datasource lines to a compact summary built from three parsed fields.
{source="grafana"} |= "duration="
| logfmt
| line_format "{{.level}} {{.endpoint}} took {{.duration}}"
Expected output
info queryData took 96.062µs
info queryData took 213.193168ms
info queryData took 128.308µs
line_format changes only the line content; the label set is untouched.A pipeline stage after line_format sees the new line — including line filters and parsers. |