# How to rename json parsed field

**URL:** <https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059>\
**Category:** Logstash\
**Created:** [December 27, 2016, 12:17pm UTC](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059 "2016-12-27T12:17:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [December 27, 2016, 12:17pm UTC](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059/1 "2016-12-27T12:17:54Z")

</div>

Hi,

I am parsing json log file in Logstash. There is a field named @person.name. I tried to rename this field name before sending it to elasticsearch. I also tried to remove the field but I couldn't remove or delete that field because of that my data not getting indexed in Elasticsearch.

**Error recorded in elasticsearch**

```
> MapperParsingException[Field name [@person.name] cannot contain '.']
> at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:276)
> at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:221)
> at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parse(ObjectMapper.java:196)
> at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:308)
> at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:221)
> at org.elasticsearch.index.mapper.object.RootObjectMapper$TypeParser.parse(RootObjectMapper.java:138)
> at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:119)
> at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:100)
> at org.elasticsearch.index.mapper.MapperService.parse(MapperService.java:435)
> at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:257)
> at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:230)
> at org.elasticsearch.cluster.service.InternalClusterService.runTasksForExecutor(InternalClusterService.java:458)
> at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:762)
> at 

```

**My Logstash config**

> ```
> input {
> beats {
> port => 11153
> }
> }
> filter 
> {
> if [type] == "person_get" {
> ##Parsing JSON input to JSON Filter..
> json {    		
> source => "message"
> }
> mutate{
> rename => { "@person.name" => "@person-name" }
> remove_field => ["@person.name"]
> }
>     	
> fingerprint {
> source => ["ResponseTimestamp"]
> target => "fingerprint"
> key => "78787878"
> method => "SHA1"
> concatenate_sources => true
> }
>     	
> }
> }
>     	
> output{
> if [type] == "person_get" { 
> elasticsearch {		  
> index => "logstash-person_v1"
> hosts => ["xxx.xxx.xx:9200"]
> document_id => "%{fingerprint}" # !!! prevent duplication		  
> }
> stdout {
> codec => rubydebug
> }
> }
> 
> ```

> ```
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 31, 2016, 12:59pm UTC](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059/2 "2016-12-31T12:59:15Z")

</div>

This should work. Have you tried using the de\_dot filter?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2017, 12:59pm UTC](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059/3 "2017-01-28T12:59:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.