Add prefixes to many examples in documentation (#453)

docs/operators/add.md

@@ -21,8 +21,8 @@ Add a string to the body
 
 ```yaml
 - type: add
-  field: key2
-  value: val2
+  field: body.key2
+  value: body.val2
 ```
 
 <table>
@@ -63,7 +63,7 @@ Add a value to the body using an expression
 
 ```yaml
 - type: add
-  field: key2
+  field: body.key2
   value: EXPR(body.key1 + "_suffix")
 ```
 
@@ -105,7 +105,7 @@ Add an object to the body
 
 ```yaml
 - type: add
-  field: key2
+  field: body.key2
   value: 
     nestedkey: nestedvalue
 ```

docs/operators/copy.md

@@ -20,7 +20,7 @@ Copy a value from the body to resource
 
 ```yaml
 - type: copy
-  from: key
+  from: body.key
   to: resource.newkey
 ```
 
@@ -63,7 +63,7 @@ Copy a value from the body to resource
 Copy a value from the body to attributes
 ```yaml
 - type: copy
-  from: key2
+  from: body.key2
   to: attributes.newkey
 ```
 
@@ -109,7 +109,7 @@ Copy a value from attributes to the body
 ```yaml
 - type: copy
   from: attributes.key
-  to: newkey
+  to: body.newkey
 ```
 
 <table>
@@ -156,8 +156,8 @@ Copy a value from attributes to the body
 Copy a value within the body
 ```yaml
 - type: copy
-  from: obj.nested
-  to: newkey
+  from: body.obj.nested
+  to: body.newkey
 ```
 
 <table>

docs/operators/csv_parser.md

@@ -64,7 +64,7 @@ Configuration:
 
 ```yaml
 - type: csv_parser
-  parse_from: message
+  parse_from: body.message
   header: id,severity,message
   delimiter: "\t"
 ```
@@ -107,7 +107,7 @@ Configuration:
 - type: csv_parser
   header: 'timestamp_field,severity,message'
   timestamp:
-    parse_from: timestamp_field
+    parse_from: body.timestamp_field
     layout_type: strptime
     layout: '%Y-%m-%d'
 ```

docs/operators/flatten.md

@@ -22,7 +22,7 @@ Flatten an object to the base of the body
 
 ```yaml
 - type: flatten
-  field: key1
+  field: body.key1
 ```
 
 <table>
@@ -70,7 +70,7 @@ Flatten an object within another object
 
 ```yaml
 - type: flatten
-  field: wrapper.key1
+  field: body.wrapper.key1
 ```
 
 <table>

docs/operators/json_parser.md

@@ -25,7 +25,7 @@ The `json_parser` operator parses the string-type field selected by `parse_from`
 Configuration:
 ```yaml
 - type: json_parser
-  parse_from: message
+  parse_from: body.message
 ```
 
 <table>
@@ -63,9 +63,9 @@ Configuration:
 Configuration:
 ```yaml
 - type: json_parser
-  parse_from: message.embedded
-  parse_to: parsed
-  preserve_to: message.embedded
+  parse_from: body.message.embedded
+  parse_to: body.parsed
+  preserve_to: body.message.embedded
 ```
 
 <table>
@@ -110,9 +110,9 @@ Configuration:
 Configuration:
 ```yaml
 - type: json_parser
-  parse_from: message
+  parse_from: body.message
   timestamp:
-    parse_from: seconds_since_epoch
+    parse_from: body.seconds_since_epoch
     layout_type: epoch
     layout: s
 ```

docs/operators/move.md

@@ -18,8 +18,8 @@ The `move` operator moves (or renames) a field from one location to another.
 Rename value
 ```yaml
 - type: move
-  from: key1
-  to: key3
+  from: body.key1
+  to: body.key3
 ```
 
 <table>
@@ -61,8 +61,8 @@ Move a value from the body to resource
 
 ```yaml
 - type: move
-  from: uuid
-  to: $resoruce.uuid
+  from: body.uuid
+  to: resoruce.uuid
 ```
 
 <table>
@@ -103,7 +103,7 @@ Move a value from the body to attributes
 
 ```yaml
 - type: move
-  from: ip
+  from: body.ip
   to: attributes.ip
 ```
 
@@ -144,7 +144,7 @@ Move a value from the body to attributes
 Replace the body with an individual value nested within the body
 ```yaml
 - type: move
-  from: log
+  from: body.log
   to: body
 ```
 
@@ -183,7 +183,7 @@ Replace the body with an individual value nested within the body
 Remove a layer from the body
 ```yaml
 - type: move
-  from: wrapper
+  from: body.wrapper
   to: body
 ```
 
@@ -231,7 +231,7 @@ Remove a layer from the body
 Merge a layer to the body
 ```yaml
 - type: move
-  from: object
+  from: body.object
   to: body
 ```
 

docs/operators/recombine.md

@@ -38,7 +38,7 @@ Configuration:
 - type: regex_parser
   regex: '^(?P<timestamp>[^\s]+) (?P<stream>\w+) (?P<logtag>\w) (?P<message>.*)'
 - type: recombine
-  combine_field: message
+  combine_field: body.message
   combine_with: ""
   is_last_entry: "body.logtag == 'F'"
   overwrite_with: "newest"
@@ -100,7 +100,7 @@ This can be expressed with the following configuration:
 
 ```yaml
 - type: recombine
-  combine_field: message
+  combine_field: body.message
   is_first_entry: body.message matches "^[^\s]"
 ```
 

docs/operators/regex_parser.md

@@ -29,7 +29,7 @@ This operator makes use of [Go regular expression](https://github.com/google/re2
 Configuration:
 ```yaml
 - type: regex_parser
-  parse_from: message
+  parse_from: body.message
   regex: '^Host=(?P<host>[^,]+), Type=(?P<type>.*)$'
 ```
 
@@ -69,10 +69,10 @@ Configuration:
 Configuration:
 ```yaml
 - type: regex_parser
-  parse_from: message.embedded
-  parse_to: parsed
+  parse_from: body.message.embedded
+  parse_to: body.parsed
   regex: '^Host=(?P<host>[^,]+), Type=(?P<type>.*)$'
-  preserve_to: message.embedded
+  preserve_to: body.message.embedded
 ```
 
 <table>
@@ -121,7 +121,7 @@ Configuration:
 - type: regex_parser
   regex: '^Time=(?P<timestamp_field>\d{4}-\d{2}-\d{2}), Host=(?P<host>[^,]+), Type=(?P<type>.*)$'
   timestamp:
-    parse_from: timestamp_field
+    parse_from: body.timestamp_field
     layout_type: strptime
     layout: '%Y-%m-%d'
 ```
@@ -161,7 +161,7 @@ Configuration:
 ```yaml
 - type: regex_parser
   regex: '^Host=(?<host>)$'
-  parse_from: message
+  parse_from: body.message
   if: 'body.type == "hostname"'
 ```
 
@@ -228,7 +228,7 @@ Configuration:
 ```yaml
 - type: regex_parser
   regex: '^Host=(?<host>)$'
-  parse_from: message
+  parse_from: body.message
   if: 'body.type == "hostname"'
 ```
 

docs/operators/remove.md

@@ -19,7 +19,7 @@ The `remove` operator removes a field from a record.
 Remove a value from the body
 ```yaml
 - type: remove 
-  field: key1
+  field: body.key1
 ```
 
 <table>
@@ -57,7 +57,7 @@ Remove a value from the body
 Remove an object from the body
 ```yaml
 - type: remove 
-  field: object
+  field: body.object
 ```
 
 <table>

docs/operators/retain.md

@@ -23,8 +23,8 @@ Retain fields in the body
 ```yaml
 - type: retain
   fields:
-    - key1
-    - key2
+    - body.key1
+    - body.key2
 ```
 
 <table>
@@ -69,7 +69,7 @@ Retain an object in the body
 ```yaml
 - type: retain
   fields:
-    - object
+    - body.object
 ```
 
 <table>
@@ -216,7 +216,7 @@ Retain fields from all sources
   fields:
     - resource.key1
     - attributes.key3
-    - key5
+    - body.key5
 ```
 
 <table>

docs/operators/uri_parser.md

@@ -41,12 +41,12 @@ The following fields are returned. Empty fields are not returned.
 ### Example Configurations
 
 
-#### Parse the field `message` as absolute URI
+#### Parse the field `body.message` as absolute URI
 
 Configuration:
 ```yaml
 - type: uri_parser
-  parse_from: message
+  parse_from: body.message
 ```
 
 <table>
@@ -90,12 +90,12 @@ Configuration:
 </tr>
 </table>
 
-#### Parse the field `message` as relative URI
+#### Parse the field `body.message` as relative URI
 
 Configuration:
 ```yaml
 - type: uri_parser
-  parse_from: message
+  parse_from: body.message
 ```
 
 <table>
@@ -133,12 +133,12 @@ Configuration:
 </tr>
 </table>
 
-#### Parse the field `query` as URI query string
+#### Parse the field `body.query` as URI query string
 
 Configuration:
 ```yaml
 - type: uri_parser
-  parse_from: query
+  parse_from: body.query
 ```
 
 <table>

docs/types/field.md

@@ -21,7 +21,7 @@ If a field does not start with `resource`, `attributes`, or `body`, then `body`
 Config:
 ```yaml
 - type: add
-  field: key3
+  field: body.key3
   value: val3
 - type: remove
   field: body.key2.nested_key1