# How to change field name in all events in a list of json objects without splitting/with getting again a list of json objects in logstash?

**URL:** <https://discuss.elastic.co/t/how-to-change-field-name-in-all-events-in-a-list-of-json-objects-without-splitting-with-getting-again-a-list-of-json-objects-in-logstash/328807>\
**Category:** Logstash\
**Created:** [March 29, 2023, 9:57am UTC](https://discuss.elastic.co/t/how-to-change-field-name-in-all-events-in-a-list-of-json-objects-without-splitting-with-getting-again-a-list-of-json-objects-in-logstash/328807 "2023-03-29T09:57:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fosota8](https://avatars.discourse-cdn.com/v4/letter/f/2bfe46/32.png) [@fosota8](https://discuss.elastic.co/u/fosota8)\
**Post date:** [March 29, 2023, 9:57am UTC](https://discuss.elastic.co/t/how-to-change-field-name-in-all-events-in-a-list-of-json-objects-without-splitting-with-getting-again-a-list-of-json-objects-in-logstash/328807/1 "2023-03-29T09:57:00Z")

</div>

For example if i give logstash the following input: `[{"a": 1, "b": 2}, {"a": 14, "b": 65}]` and I want to change all "b" field names to "c", so I will get the following output: `[{"a": 1, "c": 2}, {"a": 14, "c": 65}]`

The only way that I was able to change "b"s to "c"s is to use the "split" filter, but at the end I want to get a list of events again, this is what is did: `input {...} filter { json { source => "message" target => "message" } split { field => "message" } } output {...}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2023, 9:57am UTC](https://discuss.elastic.co/t/how-to-change-field-name-in-all-events-in-a-list-of-json-objects-without-splitting-with-getting-again-a-list-of-json-objects-in-logstash/328807/2 "2023-04-26T09:57:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.