If you’re looking to transform data directly in the action inputs editor, check out Tracecat inline functions.

Data transforms allow you to filter, reshape, and manipulate data within your workflows. Tracecat supports the following transform actions:

  • core.transform.reshape: Organize data into a value or object.
  • core.transform.filter: Filter a list of items.
  • core.transform.is_in: Check if an item is in a list.
  • core.transform.is_not_in: Check if an item is not in a list.
  • core.transform.deduplicate: Deduplicate a list of JSON objects given a list of keys.
  • core.transform.apply: Apply a python_lambda function to a value.
  • core.transform.map: Apply a python_lambda function to each item in a list.

​
Reshape

Reshape is a simple action that takes a single input value or object, evaluates any expressions, and returns the result. It is also one of the most powerful transform actions in Tracecat.

The ${{ ACTIONS.<reshape_action_name>.result }} returns the evaluated value of the reshape action.

Use the core.transform.reshape action to rename and restructure data from previous actions or the trigger into a value or object. Transform data in the reshape using one of many inline functions.

Check out the functions cheatsheet for a list of all the available functions.

Examples

# Get one value from a previous action
value: ${{ ACTIONS.get_user.result.data.user.name }}

# Get multiple values from a previous action
value:
  name: ${{ ACTIONS.get_user.result.data.user.name }}
  email: ${{ ACTIONS.get_user.result.data.user.email }}

# Get data from the trigger
value: ${{ TRIGGER.data.user }}

​
Deduplicate

Deduplicate a list of JSON objects given a list of keys.

Examples

# Deduplicate alerts by ID - keeps only the most recent alert with the same ID
value: [
  {"id": 1, "name": "Suspicious Login", "status": "New"},
  {"id": 2, "name": "Malware Detected", "status": "New"},
  {"id": 1, "name": "Suspicious Login", "status": "Updated"},
]
keys: ["id"]

# Result:
# [
#   {"id": 1, "name": "Suspicious Login", "status": "Updated"},
#   {"id": 2, "name": "Malware Detected", "status": "New"},
# ]

​
Lambda Transforms

The following transforms accept an action input called python_lambda. python_lambda is a Python Lambda function given as a string.

It allows you to use small snippets of Python code to transform data and define conditions. For security, we only support a limited set of core Python features.

Python lambda functions are small anonymous functions that are used to define simple functions that are passed to other functions. You can learn more about them here.

lambda x: x["name"] == "John"

It can be hard to escape special characters in YAML. Werecommend using python_lambda with the >- and > YAML block modifiers to avoid these issues:

# ✅ Do this:
python_lambda: >-
  lambda x: x["name"] == "John"

# ❌ This will fail:
python_lambda: "lambda x: x["name"] == "John""

​
Filter

Filter a list of items given a Python lambda function. This function should return a truthy or falsy value.

Examples

value: [{"name": "John", "age": 30}, {"name": "Jane", "age": 25}]
python_lambda: "lambda x: x['age'] > 25"

​
Apply

This action is for simple oneline Python functions only. If you want to use custom Python code in Tracecat, we recommend syncing these functions into Tracecat as Python UDF actions.

Check out more in the custom integrations tutorial.

Apply a Python lambda function to a value.

value: {"name": "John", "age": 30}
python_lambda: "lambda x: x['name'] == 'John'"

​
Map

Apply a Python lambda function to each item in a list.

value: [{"name": "John", "age": 30}, {"name": "Jane", "age": 25}]
python_lambda: "lambda x: x['name']"

Was this page helpful?