# Drop part of a fieldname

**URL:** <https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660>\
**Category:** Logstash\
**Created:** [February 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660 "2020-02-10T19:11:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![olatunde.tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde.tokun/32/110546_2.png) [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\
**Post date:** [February 10, 2020, 7:11pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660/1 "2020-02-10T19:11:23Z")

</div>

Looking for a more efficient way to drop the top part of Windows fields ( **winlog** ) for 50+ fields.

The less efficient way would be to have unique mutate \> rename entries for each field. Any ideas on achieving this would be appreciated.

```
mutate {
rename => { "[winlog][event_data][CommandLine]" => "[event_data][commandline]" }
rename => { "[winlog][event_data][Company]" => "[event_data][company]" }
rename => { "[winlog][event_data][CurrentDirectory]" => "[event_data][current_directory]" }
rename => { "[winlog][event_data][Description]" => "[event_data][description]" }}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 10, 2020, 7:12pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660/2 "2020-02-10T19:12:20Z")

</div>

You can rename [winlog][event\_data] and that will take all the subfields with it.

---

<div class="post-metadata">

**Author:** ![olatunde.tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde.tokun/32/110546_2.png) [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\
**Post date:** [February 10, 2020, 7:43pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660/3 "2020-02-10T19:43:53Z")

</div>

Thanks, just tested this and it seems to solve it.

Cheers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2020, 7:57pm UTC](https://discuss.elastic.co/t/drop-part-of-a-fieldname/218660/4 "2020-03-09T19:57:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.