JSON rename

Elastic Stack Logstash
1

Hello everyone,

I am currently parsing a json string into an object which gets mapped into a structure similar to this :

[parentobj][childobj][attr1]
[parentobj][childobj][attr2]
[parentobj][childobj][attr2]

What I want to achieve is to rename all by just removing the [parentobj] so it will look like this :

[childobj][attr1]
[childobj][attr2]
[childobj][attr3]

From what I've seen this can be achieve with mutate's rename function but this means that I will have to statically define every single rename statement and it doesn't scale that well .

Does anyone have a better idea on how to do this ?

Thank you in advance! :smile:

2

Unless you can rename [parentobj][childobj] to [childobj] I think you need to use a ruby filter.

filter {
  ruby {
    code => "
      event['childobj'] = event['parentobj']['childobj']
    "
  }
}
3

Thank you Magnus .

I could match till the childobj so I can basically apply a kv filter for the parentobj and then json the childobj and this way I wouldn't have to rename but this means again more scenarios to cover aka more match rules therefore this is why I was looking for a rename function .
The ruby code works well, now I have to choose if I want to use ruby to rename or do a kv on the parentobj and json on the child . Either way I have to write multiple lines per scenario since I have multiple childobj per parentobj .