Filebeat Processors: Rename does not work

Elastic Stack Beats
1

Hello Community!

I want to delete and rename some fields in filebeat with following configurations:

processors:
- rename:
fields:
  - from: "beat.hostname"
    to: "host"

- drop_fields:
fields: ["beat.name", "beat.version"]

Dropping works perfectly but not the renaming. What is wrong?

Kind regards

Rhino

2

"rename" is a rather new processor. Filebeat version?

Is your formatting correct? Given the snipper you posted, the indentation of the fields settings is off.

3

Used Filebeat version is 6.3.2 and indentation checked and same problem persists.

4

Is your formatting correct? Given the snipper you posted, the indentation of the fields settings is off.

Some fields are added by filebeat after all processing. These can not be removed or renamed. The beat field is not available yet, as it's added as part of the outputs.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.