Skip to main content
Transforms modify events and logs as they flow through the pipeline. You can drop unwanted data, scrub PII, consolidate duplicates, and extract patterns from logs — all before data reaches your sinks. Transforms are chained in order within a routing rule. Each one receives a batch, modifies it, and passes it to the next.

​
Available transforms

TransformWhat it doesUse when…
FilterDrop or keep events by conditionYou want to exclude health checks, debug logs, or internal traffic
RedactRemove or pseudonymize PIIYou need GDPR compliance or want to scrub emails, IPs, phone numbers
ReduceConsolidate duplicate eventsError storms or repeated events are inflating your volume
PatternExtract log patterns with DrainYou want to cluster similar log messages for anomaly detection

​
Configuration

Add transforms to any routing rule in your tell.toml: 
[[routing.rules]]
match = { source = "app" }
sinks = ["analytics"]

[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"

[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
patterns = ["email", "ipv4"]
scan_all = true
Transforms run in the order listed. In this example, health check events are dropped first, then PII is hashed in the remaining events.

​
What’s next

  • Filter — drop or keep events by condition
  • Redact — scrub PII with 11 built-in patterns
  • Reduce — consolidate duplicate events
  • Pattern — extract log patterns
  • Routing — how transforms fit into routing rules