Drop part of a fieldname

[olatunde.tokun (ola)]

Looking for a more efficient way to drop the top part of Windows fields (winlog) for 50+ fields.

The less efficient way would be to have unique mutate > rename entries for each field. Any ideas on achieving this would be appreciated.

mutate {
rename    => { "[winlog][event_data][CommandLine]"               => "[event_data][commandline]" }
rename    => { "[winlog][event_data][Company]"                   => "[event_data][company]" }
rename    => { "[winlog][event_data][CurrentDirectory]"          => "[event_data][current_directory]" }
rename    => { "[winlog][event_data][Description]"               => "[event_data][description]" }}

[Badger]

You can rename [winlog][event_data] and that will take all the subfields with it.

[olatunde.tokun (ola)]

Thanks, just tested this and it seems to solve it.

Cheers.