For example if i give logstash the following input: [{"a": 1, "b": 2}, {"a": 14, "b": 65}] and I want to change all "b" field names to "c", so I will get the following output: [{"a": 1, "c": 2}, {"a": 14, "c": 65}]
The only way that I was able to change "b"s to "c"s is to use the "split" filter, but at the end I want to get a list of events again, this is what is did: input {...} filter { json { source => "message" target => "message" } split { field => "message" } } output {...}