I am currently parsing a json string into an object which gets mapped into a structure similar to this :
What I want to achieve is to rename all by just removing the
[parentobj] so it will look like this :
From what I've seen this can be achieve with mutate's rename function but this means that I will have to statically define every single rename statement and it doesn't scale that well .
Does anyone have a better idea on how to do this ?
Thank you in advance!
Unless you can rename
[childobj] I think you need to use a ruby filter.
code => "
event['childobj'] = event['parentobj']['childobj']
Thank you Magnus .
I could match till the
childobj so I can basically apply a
kv filter for the
parentobj and then json the
childobj and this way I wouldn't have to rename but this means again more scenarios to cover aka more match rules therefore this is why I was looking for a rename function .
The ruby code works well, now I have to choose if I want to use ruby to
rename or do a
kv on the
parentobj and json on the child . Either way I have to write multiple lines per scenario since I have multiple