How to change field name in all events in a list of json objects without splitting/with getting again a list of json objects in logstash?

For example if i give logstash the following input: [{"a": 1, "b": 2}, {"a": 14, "b": 65}] and I want to change all "b" field names to "c", so I will get the following output: [{"a": 1, "c": 2}, {"a": 14, "c": 65}]

The only way that I was able to change "b"s to "c"s is to use the "split" filter, but at the end I want to get a list of events again, this is what is did: input {...} filter { json { source => "message" target => "message" } split { field => "message" } } output {...}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.