How to re-name field names in logstash

Hi all,
We have field names like and event.category , how can we re-name the names to this client geo name and event category.
"[event][category]" => "Event category"
"[client][geo][name]" => "client geo location"

We want to achieve this via ruby code


I already answered that question when you asked it here.

but that works only on the first part of the fields (that is there are 2 words in fields[event][category] ) how about 3 words in the fields ([client][geo][name]) and so on.. ?

You would have to write a ruby filter that recursively descends into the fields on the event. There is an example of that here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.