Logstash mutate rename

[Jokie74 (Jörg Kauke)]

hello dear community,

I have a question about the "mutate rename" filter option.
In my logstash filter I have this:

mutate {
            rename => {
                "[fields][host][name]" => "[host][name]"
                "[fields][host][domain]" => "[host][domain]"
                "[fields][log_topic]" => "log_topic"
                "[fields][log_type]" => "log_type"
                "[fields][os]" => "os"
            }

Logs are coming from filebeat with following fields added to the input config:

fields:
    log_topic: UnixSol-log-server-aix
    os: aix
    log_type: aix_syslog
    host:
      name: srvsinst.hs.domain.ch
      domain: hs.domain.ch

Unfortunately, the renaming is not working... Kibana shows the attributes as:
fields.host.domain
fields.host.name
fields.log_topic
fields.log_type
fields.os

What is wrong with the config???

Thanks a lot in advance for your support...

best regards,
Joerg

[Badger]

@Jokie74

What is wrong with the config???

I cannot see why that would not work, but have you considered setting fields_under_root so that it is not required?