How logstash change the id to custom with kv

Elastic Stack Logstash
1

with kv configure
now in kibana the data is like
_source": {
"1": "1",
"2": "0",
"3": "0",
"4": "0",
"5": "1",
"6": "0",
"7": "1",
"8": "0",
"9": "0",
"10": "0",
"11": "0",
"12": "0",
"13": "0",
"14": "0",
"15": "0",
"16": "0",
"code": "1=1 2=0 3=0 4=0 5=1 6=0 7=1 8=0 9=0 10=0 11=0 12=0 13=0 14=0 15=0 16=0",

how change the "16": "0", to "testname": "0", not use the id use the custom name
it change in logstash configure file or with es mapping ?
how can do it thanks.
@Christian_Dahlqvist
@warkolm

2

Please don't ping people like this, if you have a question then please be patient.

3

I imagine renaming the appropriate fields using the mutate filter's rename command would be your best bet here:

# ...
filter {
  # ...
  mutate {
    rename => {
      "1" => "somename"
      "2" => "anothername"
      # ...
      "16" => "testname"
    }
  }
}
4

the data is in kv
mutate source is kv? or kv add a tage test mutate source is test?
thanks
@yaauie

5

soory i will know it.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.