# How to rename fields

**URL:** <https://discuss.elastic.co/t/how-to-rename-fields/97077>\
**Category:** Logstash\
**Created:** [August 15, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077 "2017-08-15T09:07:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikygee](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mikygee](https://discuss.elastic.co/u/mikygee)\
**Post date:** [August 15, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077/1 "2017-08-15T09:07:29Z")

</div>

Hello,

I have grok rules that work fine to match the OS and user agent  
filter {  
if [program] == "nginx" {

```
    grok {
        break_on_match => true
        match => ["message", "%{IPORHOST:remote_addr} - - \[%{HTTPDATE:time_local}\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}" ]
        tag_on_failure => ["nginx_access_parsing_failed"]
        remove_tag => ["_grokparsefailure"]
        add_tag => ["Web"]
        add_tag => ["Nginx"]
    }
    if [http_user_agent] != "-" and [http_user_agent] != "" {
        useragent {
            source => "http_user_agent"
        }
    }
    if "UA" in [tags] {
        if [device] == "Other" { mutate { remove_field => "device" } }
        if [name] == "Other" { mutate { remove_field => "name" } }
        if [os] == "Other" { mutate { remove_field => "os" } }
    }
  }
}

```

However I would like to rename the terms device, name, os that seem to generic in http\_client\_device, http\_client\_browser, http\_client\_os,

How can I do that ?

Thank you

---

<div class="post-metadata">

**Author:** ![mikygee](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mikygee](https://discuss.elastic.co/u/mikygee)\
**Post date:** [August 15, 2017, 10:09am UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077/2 "2017-08-15T10:09:02Z")

</div>

I tried that but it doesn't work

```
grok {
    break_on_match => true
    match => ["message", "%{IPORHOST:remote_addr} - - \[%{HTTPDATE:time_local}\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}" ]
    tag_on_failure => ["nginx_access_parsing_failed"]
    remove_tag => ["_grokparsefailure"]
    add_tag => ["Web"]
    add_tag => ["Nginx"]
}
if [http_user_agent] != "-" and [http_user_agent] != "" {
    useragent {
        source => "http_user_agent"
    }
}
if "UA" in [tags] {
    if [device] == "Other" { mutate { remove_field => "device" } }
    if [name] == "Other" { mutate { remove_field => "name" } }
    if [os] == "Other" { mutate { remove_field => "os" } }
    mutate {
        rename => ["name", "http_client_browser"]
}
}
  }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 15, 2017, 11:05am UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077/3 "2017-08-15T11:05:18Z")

</div>

Where is the UA tag added? Please show an example of an event that Logstash has produced. Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![mikygee](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mikygee](https://discuss.elastic.co/u/mikygee)\
**Post date:** [August 15, 2017, 12:20pm UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077/4 "2017-08-15T12:20:31Z")

</div>

Thank you for your reply.  
The error was under my eyes but I couldn't see it. I had removed the UA tag thinking it was useless. But it was match by the if condition.  
Have a nice day

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2017, 12:20pm UTC](https://discuss.elastic.co/t/how-to-rename-fields/97077/5 "2017-09-12T12:20:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.