# Filed names are not renaming in logstash pipeline **URL:** \ **Category:** Logstash\ **Created:** [July 30, 2025, 7:45am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583 "2025-07-30T07:45:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![upreddy253](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@upreddy253](https://discuss.elastic.co/u/upreddy253)\ **Post date:** [July 30, 2025, 7:45am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/1 "2025-07-30T07:45:27Z")
Hi All, I am using mutate filter to rename the fields. But only one field is renamed remaining fields are not renamed. Below the logstash configuration. ```auto json { source => "jsonmessage" target => "[x][data]" remove_field=>["jsonmessage"] tag_on_failure => ["_jsonparsefailure"] skip_on_invalid_json =>true } mutate { rename => ["[x][data][loglevel]", "loglevel" ] rename => ["[x][data][request][streetName]", "[x][request][streetname]" ] rename => ["[x][data][request][operate]", "[x][request][operate]" ] rename => ["[x][data][request][bookingID]", "bookkingid" ] rename => ["[x][data][response][paymeNT]", "payment" ] } ``` In above renaming section only first field renamed properly. remaining fields are not renamed. Similar type of configuration is working for other application logs.Please guide me on this? ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [July 30, 2025, 10:14am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/2 "2025-07-30T10:14:28Z")
Hello @upreddy253 Could you please share 1 logline from the log file. Thanks!! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 30, 2025, 1:42pm UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/3 "2025-07-30T13:42:19Z")
Please share some sample data and the output you are getting. Also, can you share your configuration using the Preformatted text option? the `` button? It is not clear what that check mark icon means. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 31, 2025, 12:44am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/4 "2025-07-31T00:44:33Z")
@leandrojmp I formatted the text ---
**Author:** ![upreddy253](https://avatars.discourse-cdn.com/v4/letter/u/d9b06d/32.png) [@upreddy253](https://discuss.elastic.co/u/upreddy253)\ **Post date:** [July 31, 2025, 6:17am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/5 "2025-07-31T06:17:53Z")
Hi @leandrojmp Below the sample json log. ```auto {"loglevel":"log","request":{"streetName":"abc","operate":"abc","bookingID":"xyz"},"response":{"paymeNT":"paymeNT-23290"}} ``` for above json message i have applied json parser and after that i have tried to rename fields. But only first field is renaming but other fields are not changed. ```auto json { source => "jsonmessage" target => "[x][data]" remove_field=>["jsonmessage"] tag_on_failure => ["_jsonparsefailure"] skip_on_invalid_json =>true } mutate { rename => ["[x][data][loglevel]", "loglevel" ] rename => ["[x][data][request][streetName]", "[x][request][streetname]" ] rename => ["[x][data][request][operate]", "[x][request][operate]" ] rename => ["[x][data][request][bookingID]", "bookkingid" ] rename => ["[x][data][response][paymeNT]", "payment" ] } ``` In kibana we are able to see only first 2 fields are renamed (loglevel,streetname) remaining fields are not renamed. remaining fields are getting like below. x.data.request.bookingID , x.data.request.paymeNT. @stephenb thanks for modifying query. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 31, 2025, 6:23am UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/6 "2025-07-31T06:23:36Z")
@upreddy253 please use 3 backticks ````` before and after your code so that it's readable as code it's marked down... When you do not, your code is impossible to read I fixed it this last time. You need to do it next time ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 31, 2025, 12:34pm UTC](https://discuss.elastic.co/t/filed-names-are-not-renaming-in-logstash-pipeline/380583/7 "2025-07-31T12:34:37Z")
What else do you have in your configuration? Can you share the full configuration? Also, what is the version of your Logstash? It works without any issue for me, all fields are renamed. One thing that you need to change is the syntax of the rename command, it needs to be like [this](https://www.elastic.co/docs/reference/logstash/plugins/plugins-filters-mutate#plugins-filters-mutate-rename). So the correct way to format your mutate rename would be this: ```auto mutate { rename => { "[x][data][loglevel]" => "loglevel" "[x][data][request][streetName]" => "[x][request][streetname]" "[x][data][request][operate]" => "[x][request][operate]" "[x][data][request][bookingID]" => "bookkingid" "[x][data][response][paymeNT]" => "payment" } } ```