Transforms - Tell

Transforms modify events and logs as they flow through the pipeline. You can drop unwanted data, scrub PII, consolidate duplicates, and extract patterns from logs — all before data reaches your sinks. Transforms are chained in order within a routing rule. Each one receives a batch, modifies it, and passes it to the next.

Available transforms

Transform	What it does	Use when…
Filter	Drop or keep events by condition	You want to exclude health checks, debug logs, or internal traffic
Redact	Remove or pseudonymize PII	You need GDPR compliance or want to scrub emails, IPs, phone numbers
Reduce	Consolidate duplicate events	Error storms or repeated events are inflating your volume
Pattern	Extract log patterns with Drain	You want to cluster similar log messages for anomaly detection

Configuration

Add transforms to any routing rule in your tell.toml:

[[routing.rules]]
match = { source = "app" }
sinks = ["analytics"]

[[routing.rules.transformers]]
type = "filter"
action = "drop"
field = "path"
operator = "eq"
value = "/health"

[[routing.rules.transformers]]
type = "redact"
strategy = "hash"
hash_key = "your-secret-key"
patterns = ["email", "ipv4"]
scan_all = true

Transforms run in the order listed. In this example, health check events are dropped first, then PII is hashed in the remaining events.

What’s next

Filter — drop or keep events by condition
Redact — scrub PII with 11 built-in patterns
Reduce — consolidate duplicate events
Pattern — extract log patterns
Routing — how transforms fit into routing rules