How to re-name multiple field names at once in logstash

Hie All,
I want to rename fields names from this : "[url][path]" => to "url path" and "[server][domain]" => "Server domain"
We can use mutate filter plugin (as mutate uses lot of cpu) ,but I have nearly 50 fields names to be renames is their any other alternative to achieve this ?

mutate {
rename [ "[url][path]" => "url path",
"[server][domain]" => "Server domain"]
}

TIA.

You could do that in a ruby filter

    ruby {
        code => '
            event.to_hash.each { |k1, v1|
                if v1.is_a? Hash
                    v1.each { |k2, v2|
                        event.set("#{k1} #{k2}", v2)
                    }
                    event.remove(k1)
                end
            }
        '
    }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.