# Issue in renaming fieldname which contains dots

**URL:** <https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477>\
**Category:** Logstash\
**Created:** [October 8, 2018, 2:30pm UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477 "2018-10-08T14:30:41Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [October 8, 2018, 2:30pm UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/1 "2018-10-08T14:30:41Z")

</div>

Hi All,

I have been breaking my head in renaming a field value in logstash and got no solution.

Here is my field value **result.caller\_id.location.latitude** and i'm trying to rename it to **lalitude** , the renaming filter accepts only single dots if i have two or more than two dots it simply doesnot do any work.

This is my filter

```
filter {
mutate { rename => { "result.caller_id.location.longitude" => "Longitude" } }
}

```

Have tried this as well, but no luck

```
filter {
mutate { rename => { "[result][caller_id][location][longitude]" => "Longitude" } }
}

```

Any help here please.

Thanks  
Gauti

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 8, 2018, 7:33pm UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/2 "2018-10-08T19:33:12Z")

</div>

Show us an example document (raw JSON please) so we can see exactly what it looks like.

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [October 9, 2018, 7:10am UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/3 "2018-10-09T07:10:17Z")

</div>

@magnusbaeck here is the document, its an xml file.

\<result\>  
\<close\_code\>null\</close\_code\>  
\<assignment\_group\>Network\</assignment\_group\>  
\<description\>  
I just moved from floor 2 to floor 3 and my laptop cannot connect to any wireless network.  
\</description\>  
\<child\_incidents/\>  
\<closed\_by/\>  
\<number\>INC0000003\</number\>  
\<contact\_type\>Chat Bot\</contact\_type\>  
\<urgency\>1 - High\</urgency\>  
\<sys\_created\_on\>2014-02-23 06:41:46\</sys\_created\_on\>  
\<problem\_id/\>  
**\<caller\_id.location.longitude\>-79.839616\</caller\_id.location.longitude\>**  
\<company\>ACME North America\</company\>  
\<state\>Active\</state\>  
\<reassignment\_count\>2\</reassignment\_count\>  
**\<caller\_id.location.latitude\>36.046332\</caller\_id.location.latitude\>**  
\<sys\_created\_by\>admin\</sys\_created\_by\>  
\<assigned\_to\>Beth Anglin\</assigned\_to\>  
\<knowledge\>false\</knowledge\>  
\<severity\>1 - High\</severity\>  
\<closed\_at/\>  
\<cmdb\_ci/\>  
\<impact\>1 - High\</impact\>  
\<reopen\_count\>1\</reopen\_count\>  
\<priority\>1 - Critical\</priority\>  
\<caller\_id.location\>3030 High Point Rd, Greensboro NC\</caller\_id.location\>  
\<escalation\>Normal\</escalation\>  
\<resolved\_at/\>  
\<location\>Salt Lake City\</location\>  
\<category\>Network\</category\>  
\</result\>

Thanks  
Gauti

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 9, 2018, 6:39pm UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/4 "2018-10-09T18:39:09Z")

</div>

No, the JSON document that Logstash _produces_. Copy/paste from Kibana's JSON tab or use `stdout { codec => rubydebug }` output (which doesn't produce JSON, but it does dump the raw event).

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [October 10, 2018, 9:43am UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/5 "2018-10-10T09:43:50Z")

</div>

@magnusbaeck here is the json from kibana

```
{
  "_index": "servicenow",
  "_type": "doc",
  "_id": "2Yj1XGYBMgAiRwMBIhZo",
  "_version": 1,
  "_score": null,
  "_source": {
    "http_poller_metadata": {
      "name": "url",
      "response_message": "OK",
      "request": {
        "url": "https://demo1.service-now.com/api/now/table/incident?sysparm_display_value=true&sysparm_exclude_reference_link=True&sysparm_fields=number%2Ccategory%2Cpriority%2Cstate%2Cassignment_group%2Cassigned_to%2Cchild_incidents%2Cclose_code%2Cclosed_at%2Cclosed_by%2Ccompany%2Ccmdb_ci%2Ccontact_type%2Csys_created_on%2Csys_created_by%2Cdescription%2Cescalation%2Cimpact%2Cknowledge%2Cproblem_id%2Creassignment_count%2Creopen_count%2Cresolved_at%2Cseverity%2Curgency%2Ccaller_id.location.latitude%2Ccaller_id.location.longitude",
        "method": "get"
      },
      "response_headers": {
        "set-cookie": "glide_session_store=1A3C023D4F89634054C8B1828110C7B0; Expires=Wed, 10-Oct-2018 09:26:56 GMT; Path=/; HttpOnly;Secure",
        "x-is-logged-in": "true",
        "expires": "0",
        "x-total-count": "117",
        "pragma": "no-store,no-cache",
        "server": "ServiceNow",
        "content-type": "application/json;charset=UTF-8",
        "date": "Wed, 10 Oct 2018 09:25:56 GMT",
        "x-transaction-id": "5a1b1af14fc9",
        "transfer-encoding": "chunked",
        "strict-transport-security": "max-age=63072000; includeSubDomains",
        "cache-control": "no-cache,no-store,must-revalidate,max-age=-1"
      },
      "times_retried": 0,
      "host": "0.0.0.0",
      "code": 200,
      "runtime_seconds": 0.289799
    },
    "@timestamp": "2018-10-10T07:51:00.847Z",
    "result": {
      "severity": "3 - Low",
      "resolved_at": "2015-10-21 12:56:12",
      "closed_by": "Don Goodliffe",
      "urgency": "3 - Low",
      "category": "Inquiry / Help",
      "problem_id": "",
      "escalation": "Normal",
      "description": "",
      "impact": "3 - Low",
      "state": "Closed",
      "sys_created_on": "2015-08-03 16:58:44",
      "reopen_count": "",
      "company": "ACME North America",
      "child_incidents": "",
      "contact_type": "Phone",
      "knowledge": "false",
      "caller_id.location.latitude": "39.691429",
      "closed_at": "2015-07-19 16:58:58",
      "close_code": "Closed/Resolved by Caller",
      "sys_created_by": "don.goodliffe",
      "assigned_to": "Don Goodliffe",
      "cmdb_ci": "",
      "assignment_group": "Service Desk",
      "number": "INC0000028",
      "caller_id.location.longitude": "-104.940104",
      "reassignment_count": "2",
      "priority": "5 - Planning"
    },
    "@version": "1"
  },
  "fields": {
    "result.resolved_at": [
      "2015-10-21T12:56:12.000Z"
    ],
    "result.sys_created_on": [
      "2015-08-03T16:58:44.000Z"
    ],
    "@timestamp": [
      "2018-10-10T07:51:00.847Z"
    ],
    "result.closed_at": [
      "2015-07-19T16:58:58.000Z"
    ]
  },
  "sort": [
    1539157860847
  ]
} 

```

Thanks  
Gauti

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 14, 2018, 2:50pm UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/6 "2018-10-14T14:50:23Z")

</div>

You need to reference the fields like this: `[result][caller_id.location.longitude]`.

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [October 15, 2018, 10:51am UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/7 "2018-10-15T10:51:46Z")

</div>

got it @magnusbaeck thank you very much.....this worked like a charm....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2018, 10:51am UTC](https://discuss.elastic.co/t/issue-in-renaming-fieldname-which-contains-dots/151477/8 "2018-11-12T10:51:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.