Logstash mutate rename

Elastic Stack Logstash
1

hello dear community,

I have a question about the "mutate rename" filter option.
In my logstash filter I have this:

mutate {
            rename => {
                "[fields][host][name]" => "[host][name]"
                "[fields][host][domain]" => "[host][domain]"
                "[fields][log_topic]" => "log_topic"
                "[fields][log_type]" => "log_type"
                "[fields][os]" => "os"
            }

Logs are coming from filebeat with following fields added to the input config:

fields:
    log_topic: UnixSol-log-server-aix
    os: aix
    log_type: aix_syslog
    host:
      name: srvsinst.hs.domain.ch
      domain: hs.domain.ch

Unfortunately, the renaming is not working... Kibana shows the attributes as:
fields.host.domain
fields.host.name
fields.log_topic
fields.log_type
fields.os

What is wrong with the config???

Thanks a lot in advance for your support...

best regards,
Joerg

2

I cannot see why that would not work, but have you considered setting fields_under_root so that it is not required?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.