Issue in renaming fieldname which contains dots

(Gautham) #1

Hi All,

I have been breaking my head in renaming a field value in logstash and got no solution.

Here is my field value result.caller_id.location.latitude and i'm trying to rename it to lalitude , the renaming filter accepts only single dots if i have two or more than two dots it simply doesnot do any work.

This is my filter

filter {
mutate { rename => { "result.caller_id.location.longitude" => "Longitude" } }

Have tried this as well, but no luck

filter {
mutate { rename => { "[result][caller_id][location][longitude]" => "Longitude" } }

Any help here please.


(Magnus Bäck) #2

Show us an example document (raw JSON please) so we can see exactly what it looks like.

(Gautham) #3

@magnusbaeck here is the document, its an xml file.

I just moved from floor 2 to floor 3 and my laptop cannot connect to any wireless network.
<contact_type>Chat Bot</contact_type>
<urgency>1 - High</urgency>
<sys_created_on>2014-02-23 06:41:46</sys_created_on>
<company>ACME North America</company>
<assigned_to>Beth Anglin</assigned_to>
<severity>1 - High</severity>
<impact>1 - High</impact>
<priority>1 - Critical</priority>
<caller_id.location>3030 High Point Rd, Greensboro NC</caller_id.location>
<location>Salt Lake City</location>


(Magnus Bäck) #4

No, the JSON document that Logstash produces. Copy/paste from Kibana's JSON tab or use stdout { codec => rubydebug } output (which doesn't produce JSON, but it does dump the raw event).

(Gautham) #5

@magnusbaeck here is the json from kibana

  "_index": "servicenow",
  "_type": "doc",
  "_id": "2Yj1XGYBMgAiRwMBIhZo",
  "_version": 1,
  "_score": null,
  "_source": {
    "http_poller_metadata": {
      "name": "url",
      "response_message": "OK",
      "request": {
        "url": "",
        "method": "get"
      "response_headers": {
        "set-cookie": "glide_session_store=1A3C023D4F89634054C8B1828110C7B0; Expires=Wed, 10-Oct-2018 09:26:56 GMT; Path=/; HttpOnly;Secure",
        "x-is-logged-in": "true",
        "expires": "0",
        "x-total-count": "117",
        "pragma": "no-store,no-cache",
        "server": "ServiceNow",
        "content-type": "application/json;charset=UTF-8",
        "date": "Wed, 10 Oct 2018 09:25:56 GMT",
        "x-transaction-id": "5a1b1af14fc9",
        "transfer-encoding": "chunked",
        "strict-transport-security": "max-age=63072000; includeSubDomains",
        "cache-control": "no-cache,no-store,must-revalidate,max-age=-1"
      "times_retried": 0,
      "host": "",
      "code": 200,
      "runtime_seconds": 0.289799
    "@timestamp": "2018-10-10T07:51:00.847Z",
    "result": {
      "severity": "3 - Low",
      "resolved_at": "2015-10-21 12:56:12",
      "closed_by": "Don Goodliffe",
      "urgency": "3 - Low",
      "category": "Inquiry / Help",
      "problem_id": "",
      "escalation": "Normal",
      "description": "",
      "impact": "3 - Low",
      "state": "Closed",
      "sys_created_on": "2015-08-03 16:58:44",
      "reopen_count": "",
      "company": "ACME North America",
      "child_incidents": "",
      "contact_type": "Phone",
      "knowledge": "false",
      "caller_id.location.latitude": "39.691429",
      "closed_at": "2015-07-19 16:58:58",
      "close_code": "Closed/Resolved by Caller",
      "sys_created_by": "don.goodliffe",
      "assigned_to": "Don Goodliffe",
      "cmdb_ci": "",
      "assignment_group": "Service Desk",
      "number": "INC0000028",
      "caller_id.location.longitude": "-104.940104",
      "reassignment_count": "2",
      "priority": "5 - Planning"
    "@version": "1"
  "fields": {
    "result.resolved_at": [
    "result.sys_created_on": [
    "@timestamp": [
    "result.closed_at": [
  "sort": [


(Magnus Bäck) #6

You need to reference the fields like this: [result][caller_id.location.longitude].

(Gautham) #7

got it @magnusbaeck thank you very much.....this worked like a charm....

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.