# Cannot rename sub-fields of cloud metadata added via add\_cloud\_metadata

**URL:** <https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157>\
**Category:** Beats\
**Created:** [September 26, 2019, 6:54am UTC](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157 "2019-09-26T06:54:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jalaziz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jalaziz/32/54901_2.png) [@jalaziz](https://discuss.elastic.co/u/jalaziz)\
**Post date:** [September 26, 2019, 6:54am UTC](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157/1 "2019-09-26T06:54:43Z")

</div>

I'm unable to rename sub-fields of the `cloud` field added via `add_cloud_metadata`.

In particular, this configuration results in missing fields for `serverId.id`, `serverId.datacenter.zone`, etc:

```auto
  - add_cloud_metadata: ~
  - rename:
      fields:
        - from: "cloud.instance.id"
          to: "serverId.id"
        - from: "cloud.availability_zone
          to: "serverId.datacenter.zone"
        - from: "cloud.region"
          to: "serverId.datacenter.region"
        - from: "cloud.provider"
          to: "serverId.datacenter.provider"
      ignore_missing: true

```

What's even more odd is that the original fields under `cloud` are removed from the output. In the case of `cloud.instance.id`, we're left with `cloud.instance: {}`.

If we remove the `ignore_missing` flag, we end up with an error about missing fields. What's odd is that `drop_fields` appears to work fine and can drop sub-fields of `cloud`. Also, renaming the top-level `cloud` field works fine.

For example, this works:

```auto
  - add_cloud_metadata: ~
  - drop_fields:
      fields: ["cloud.image", "cloud.machine", "cloud.account"]
  - rename:
      fields:
        - from: "cloud"
          to: "serverId.cloud"

```

I'm using journalbeat 7.3.2, but I don't believe this issue is specific to journalbeat.

I'm also able to rename sub-fields of the `host` field added by `add_host_metadata` just fine. This issue appears to be specific to `add_cloud_metadata`.

Comparing [https://github.com/elastic/beats/blob/master/libbeat/processors/add\_cloud\_metadata/add\_cloud\_metadata.go](https://github.com/elastic/beats/blob/master/libbeat/processors/add_cloud_metadata/add_cloud_metadata.go) to [https://github.com/elastic/beats/blob/master/libbeat/processors/add\_host\_metadata/add\_host\_metadata.go](https://github.com/elastic/beats/blob/master/libbeat/processors/add_host_metadata/add_host_metadata.go), could the issue be with the lack of cloning the underlying metadata fields?

---

<div class="post-metadata">

**Author:** ![jalaziz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jalaziz/32/54901_2.png) [@jalaziz](https://discuss.elastic.co/u/jalaziz)\
**Post date:** [September 26, 2019, 7:47am UTC](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157/2 "2019-09-26T07:47:34Z")

</div>

The issue did seem to be the lack of `Clone`-ing the injected map.

Posted a PR: [https://github.com/elastic/beats/pull/13808](https://github.com/elastic/beats/pull/13808)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 9:47am UTC](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157/3 "2019-10-24T09:47:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.