Drop part of a fieldname

Elastic Stack Logstash
1

Looking for a more efficient way to drop the top part of Windows fields (winlog) for 50+ fields.

The less efficient way would be to have unique mutate > rename entries for each field. Any ideas on achieving this would be appreciated.

mutate {
rename    => { "[winlog][event_data][CommandLine]"               => "[event_data][commandline]" }
rename    => { "[winlog][event_data][Company]"                   => "[event_data][company]" }
rename    => { "[winlog][event_data][CurrentDirectory]"          => "[event_data][current_directory]" }
rename    => { "[winlog][event_data][Description]"               => "[event_data][description]" }}
2

You can rename [winlog][event_data] and that will take all the subfields with it.

3

Thanks, just tested this and it seems to solve it.

Cheers.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.