# Filebeat Processors: Rename does not work

**URL:** <https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 19, 2018, 11:05am UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163 "2018-10-19T11:05:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhino](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rhino](https://discuss.elastic.co/u/rhino)\
**Post date:** [October 19, 2018, 11:05am UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163/1 "2018-10-19T11:05:23Z")

</div>

Hello Community!

I want to delete and rename some fields in filebeat with following configurations:

```
processors:
- rename:
fields:
  - from: "beat.hostname"
    to: "host"

- drop_fields:
fields: ["beat.name", "beat.version"]

```

Dropping works perfectly but not the renaming. What is wrong?

Kind regards

Rhino

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 22, 2018, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163/2 "2018-10-22T13:37:23Z")

</div>

"rename" is a rather new processor. Filebeat version?

Is your formatting correct? Given the snipper you posted, the indentation of the fields settings is off.

---

<div class="post-metadata">

**Author:** ![rhino](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rhino](https://discuss.elastic.co/u/rhino)\
**Post date:** [October 24, 2018, 6:10am UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163/3 "2018-10-24T06:10:24Z")

</div>

Used Filebeat version is 6.3.2 and indentation checked and same problem persists.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 24, 2018, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163/4 "2018-10-24T18:41:47Z")

</div>

Is your formatting correct? Given the snipper you posted, the indentation of the fields settings is off.

Some fields are added by filebeat after all processing. These can not be removed or renamed. The `beat` field is not available yet, as it's added as part of the outputs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-processors-rename-does-not-work/153163/5 "2018-11-21T18:41:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.