# How to rename the field “event\_data.TargetUserName”

**URL:** <https://discuss.elastic.co/t/how-to-rename-the-field-event-data-targetusername/116064>\
**Category:** Logstash\
**Created:** [January 18, 2018, 1:36pm UTC](https://discuss.elastic.co/t/how-to-rename-the-field-event-data-targetusername/116064 "2018-01-18T13:36:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![camelliuxu](https://avatars.discourse-cdn.com/v4/letter/c/9e8a1a/32.png) [@camelliuxu](https://discuss.elastic.co/u/camelliuxu)\
**Post date:** [January 18, 2018, 1:36pm UTC](https://discuss.elastic.co/t/how-to-rename-the-field-event-data-targetusername/116064/1 "2018-01-18T13:36:57Z")

</div>

Hello everyone, I am using the winlogbeat in Windows Server security event analysis, a hash field "event\_data" was generated, now I want to rename the "TargetUserName" field in the  
"event\_data" field using logstash filter, and keep the new field to the "\_source" in the root directory, I tried many methods are unable to achieve this goal, what plugins can be simple to achieve this demand, thank you very much!

winlogbeat original massage :

"\_source": {  
"event\_data": {  
"Workstation": "ad-test01",  
"Status": "0x0",  
"PackageName": "MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0",  
"TargetUserName": "test01"  
},  
......  
},

target massage :

"\_source": {  
"Workstation": "ad-test01",  
"Status": "0x0",  
"PackageName": "MICROSOFT\_AUTHENTICATION\_PACKAGE\_V1\_0,  
"TargetUserName": "test01"  
......  
},

Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2018, 1:37pm UTC](https://discuss.elastic.co/t/how-to-rename-the-field-event-data-targetusername/116064/2 "2018-02-15T13:37:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.