Docs / dflux EdgeGuard
ContactGet started

Your first transformation rule

Add a request-phase rule that injects a correlation header and a second rule that masks a body field, then deploy both and verify they fire.

Before you start

  • The proxy running. See Quickstart.
  • A working policy rule so requests reach the transformation filter — even a single permissive rule from the policy tutorial is enough.

What we're building

Two request-phase transformation rules that fire on inbound Nudm SDM reads. Each rule carries exactly one action, so the two patterns are two rules:

  1. Inject a correlation header (X-Edge-Correlation) so producer logs can be tied back to the proxy request id.
  2. Mask the gpsi body field if present, replacing it with a fixed string.

Write the rules

A TransformationRule has one action and its inputs live in a nested config object. The condition selects which requests the rule applies to; its matchers (path_patterns, target_nf_types, methods) are flat fields. Set enabled explicitly — a rule created without it is disabled and will not fire.

The header rule (header_set), saved as correlate.json:

JSON

The masking rule (body_field_mask), saved as redact.json:

JSON
Templated values
The ${request_id} form expands to the proxy's per-request id at rule-fire time. Templates use the ${var} syntax; a header value with no ${ is injected literally. See Transformation schema for the full template variable list.

Deploy the rules

Bash

Each rule takes effect immediately, with no restart — the proxy applies admin changes by hot-reloading the affected filter. Within the transformation filter, rules in a phase run in priority order, lowest first.

Exercise on the wire

Bash

The response is whatever the producer returns. To verify the rules fired, scrape the Prometheus counter — the transformation filter reports under filter="transformation":

Bash

Iterate

Common follow-ons:

  • Scope tighter. Add methods to the condition so the rule only fires on the verbs that actually carry the body fields you care about.
  • Add a response-phase rule. Strip a sensitive header from the producer response before the consumer sees it. Use "phase": "response".
  • Order with priority. If you add another rule that touches the same field, set priority values so they fire in the order you expect — lowest runs first.

Update or remove

Bash