Q&A - Asking for help with json transform

[soda-pop-ice-cream]

Question

Can anyone please help with VRL that will move all fields to top level of json?

When I do . = flatten!(.report.hubs) I get:

[
	{
		"foo": 0.378,
		"bar": 0.184,
		"baz": 0
	},
	{
		"foo": 0.759,
		"bar": 0.465,
		"baz": 0,
	},
	{
		"foo": 0.86,
		"bar": 0.726,
		"baz": 0,
	}
]

When I do . = unnest!(.report.hubs) I get:

[
	{
		"dst": "example.org",
		"host": "vector",
		"report": {
			"hubs": {
				"foo": 0.378,
				"bar": 0.184,
				"baz": 0
			}
		},
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
	{
		"dst": "example.org",
		"host": "vector",
		"report": {
			"hubs": {
				"foo": 0.759,
				"bar": 0.465,
				"baz": 0
			}
		},
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
	{
		"dst": "example.org",
		"host": "vector",
		"report": {
			"hubs": {
				"foo": 0.86,
				"bar": 0.726,
				"baz": 0
			}
		},
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
]

Unnest do almost that I need, but I can't understand how to pop content of .report.hubs on same level with dst and host.

Thank you!

Vector Config

sources:
  mtr_tcp_443:
    type: exec
    command:
      - "mtr"
      - "-4"
      - "--no-dns"
      - "--report-cycles"
      - "4"
      - "--tcp"
      - "--port"
      - "443"
      - "--json"
      - "--order"
      - "LSRDNBAWVGJMXI"
      - "example.org"
    mode: scheduled
    scheduled:
      exec_interval_secs: 60
    include_stderr: false
    decoding:
      codec: json
    framing:
      method: bytes

Vector Logs

{
  "host": "vector",
  "report": {
    "hubs": [
      {
        "foo": 0.378,
        "bar": 0.184,
        "baz": 0
      },
      {
        "foo": 0.759,
        "bar": 0.465,
        "baz": 0
      },
      {
        "foo": 0.86,
        "bar": 0.726,
        "baz": 0
      }
    ],
    "mtr": {
      "dst": "example.org",
      "src": "vector",
      "tests": 4,
      "tos": 0
    }
  },
  "timestamp": "2025-10-27T15:17:57.093229337Z"
}

[thomasqueirozb]

Hi @soda-pop-ice-cream, I'm not sure I understand what your desired output is. Can you paste an example input and a desired output?

You can also use the VRL playground and share a link here

[soda-pop-ice-cream]

Hi there!

Desired output is:

[
	{
		"dst": "example.org",
		"host": "vector",
		"foo": 0.378,
		"bar": 0.184,
		"baz": 0
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
	{
		"dst": "example.org",
		"host": "vector",
		"foo": 0.759,
		"bar": 0.465,
		"baz": 0
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
	{
		"dst": "example.org",
		"host": "vector",
		"foo": 0.86,
		"bar": 0.726,
		"baz": 0
		"src": "vector",
		"tests": 4,
		"timestamp": "2025-10-27T15:17:57.093229337Z",
		"tos": 0
	},
]

[thomasqueirozb]

I think you are looking to do something like this. Merge ordering matters so please take a look at the merge documentation also