How to re-name multiple field names at once in logstash

You could do that in a ruby filter

    ruby {
        code => '
            event.to_hash.each { |k1, v1|
                if v1.is_a? Hash
                    v1.each { |k2, v2|
                        event.set("#{k1} #{k2}", v2)
                    }
                    event.remove(k1)
                end
            }
        '
    }
1 Like