Ingest pipeline doesnt work

Elastic Stack Elasticsearch
1

hi,
I want to send logs through ingest pipeline to rename them to a different name, now the pipeline does look like its running but the names arent changing.

if i try it with a random file from the index it said it worked and has all the processors check and green but the names just doesnt want to change

i try to deliver logs from hayabusa so every log has a different set of fields

tnx for every help i can get

2

Hi @Shahar_Argov Welcome to the community

We would like to help but you are going to have to provide a lot more detail

What Version are you on?
What / How are you ingesting the file Agent / Beats / OTEL etc
How are you trying to rename?
Please share the ingest pipelines / sample documents etc.
What do you mean rename.. rename the fields?

Provide more info perhaps someone can help

3

the elastic version is 8.19

i just upload the csv straight to the elastic and use a pipeline to ingest it

i am trying to rename using the rename processor

[
  {"dot_expander": {"field":"*"}},
  {
    "fingerprint":{
        "fields":["Computer","EventID","Timestamp","RuleTitle"]
        "target_field":"_id",
        "method":"MD5"
    },
    {
        "rename":{
            "ignore_failure": true,
            "ignore_missing": true,
            "field":"Computer",
            "target_field":"host.name"
        }
    },
    {
        "rename":{
            "ignore_failure": true,
            "ignore_missing": true,
            "field":"RuleTitle",
            "target_field":"rulename"
        }
    },

this is a sample from the ingest pipeline

i want to change the field name so it will be in sync with all the other indices

4

Can you share a sample of your document so this can be replicated?

5

i dont really know how but it started working...

tnx again​:raising_hands: