Missing docs: Best practice for nested keys in record_transformer with high performance

[bensussman]

The only example in the record_transformer docs of a "nested key" is here: https://docs.fluentd.org/filter/record_transformer#enable_ruby and here: https://docs.fluentd.org/filter/record_transformer#use-dig-method-for-nested-field

However, these docs also state:

By historical reason, enable_ruby true is too slow. If you need this option, consider record_modifier filter instead. See also Need more performance? section.

Both the the aforementioned examples require enable_ruby. There are no examples of accessing a nested key on a log without using enable_ruby. Is there no way to do nested key access without using enable_ruby and paying a performance cost? It would be ideal if something like:

<filter /^kubernetes.var.log.containers.container-prefix.+_namespacename_.*/>
  @type record_transformer
  <record>
    label1 ${record.dig("kubernetes", "labels", "label1")}
  </record>
</filter>

I understand that enable_ruby is powerful because it allows arbitrary ruby execution, but a simple k1.k2.k3 (with .dig() behavior to handle nulls) would be hugely useful, and could be implemented without the performance hit of arbitrary Ruby.

If this IS indeed possible, the docs should be updated to include an example of this.

[kenhys]

FYI: I didn't measure actual performance, but the above example can be replaced by record_modifier plugin.

<filter kubernetes>
  @type record_modifier
  <record>
    label1 ${record.dig("kubernetes", "labels", "label1")}
  </record>
</filter>