code: def populate_fields(alert, publication):
      """This publisher moves all requested fields to the top level and ignores everything else.
  
      It uses the context to determine which fields to keep. Example:
  
      context={
        'populate_fields': [ 'field1', 'field2', 'field3' ]
      }
  
      "populate_fields" should be an array of strings that are exact matches to the field names.
  
      The algorithm deeply searches the publication for any dict key that exactly matches one of the
      given fields. It then takes the contents of that field and moves them up to the top level.
      It discovers ALL values matching each field, so if a field is returned multiple times, the
      resulting top level field will be an array. In the special case where exactly one entry is
      returned for a populate_field, the value will instead be equal to that value (instead of an
      array with 1 element being that value). In the special case when no entries are returned for
      an extract_field, the value will be None.
  
      Aside from the moved fields, this publisher throws away everything else in the original
      publication.
  
      NOTE: It is possible for moved fields to continue to contain nested dicts, so do not assume
            this publisher will result in a flat dictionary publication.
      """
  
      new_publication = {}
      for populate_field in alert.context.get("populate_fields", []):
          extractions = get_keys(publication, populate_field)
          new_publication[populate_field] = extractions
  
      return new_publication
  
file_path: streamalert/publishers/community/generic.py
imports: from collections import deque, OrderedDict
  import re
  from streamalert.shared.publisher import Register, AlertPublisher
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import get_keys
label_desc: Use image node_id 8 for calling a global function with example usage: populate_fields(alert, publication) and returns: new_publication