# How to rename a field after extracting it from another field
**URL:** https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050
**Category:** Logstash
**Created:** [November 22, 2019, 11:21am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050 "2019-11-22T11:21:01Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [November 22, 2019, 11:21am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/1 "2019-11-22T11:21:01Z")
```
kv {
source => "remain"
field_split => ","
value_split => "=" }
mutate {
rename => ["USERNAME", "user.name"]
}
```
I am using KV filter to extract fields from` 'remain'` field , which is working good. But then I want to rename the filed` 'USERNAME'` which is extracted from the` 'remain'`
field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 22, 2019, 2:04pm UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/2 "2019-11-22T14:04:01Z")
Do you want a period in the field name, or do you want a nested field, which would be [user][name].
What makes you think it is not currently working?
---
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [November 22, 2019, 4:37pm UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/3 "2019-11-22T16:37:48Z")
When i renamed the field to 'user.name' no such field is created in elasticsearch
I am trying to map the fields in my logs , with the ECS fields. My logs contain a field 'USERNAME' which i am extracting using KV filter . I want to rename it as 'user.name' so that it populates in the SIEM app of elasticsearch
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [November 22, 2019, 5:00pm UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/4 "2019-11-22T17:00:32Z")
I have exact same syntax and it works.
how is your output looks like?
I didn't like (y) so I change the name.
`mutate { rename => ["hwage(y)","hardwareage_years"] }`
---
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [November 23, 2019, 8:58am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/5 "2019-11-23T08:58:01Z")
It works fine while with grok. But when I use it with KV filter it is not working.
I am extracting 'USERNAME' field using KV filter . Then when I apply mutate to rename it , its not working
---
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [November 25, 2019, 5:42am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/6 "2019-11-25T05:42:25Z")
Guys please help me find solution.
---
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [November 25, 2019, 9:14am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/7 "2019-11-25T09:14:48Z")
Thank you @Badger @elasticforme for your response, the syntax was right . Actually my fieldname had space
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2019, 9:14am UTC](https://discuss.elastic.co/t/how-to-rename-a-field-after-extracting-it-from-another-field/209050/8 "2019-12-23T09:14:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.