Move all fields to a subfield?

[sliddjur]

I want to move all my fields to a specified subfield. However, I don't know all the field names.

Alternatively if there is a way for grok filter to set the target field or similar?

I found an old post that did this, which crashed my logstash (v7.6)

    ruby {
        code => "
            event['new_val'].each {|k,v|
                event[k] = v
                }
            }
            event.remove('new_val')
        "
    }

[Badger]

Referring to the event as a hash was disabled years ago, you need to use the event API, like this.

[sliddjur]

For future reference, this was what I was looking for:

    ruby {
        code => '
            event.to_hash.each { |k, v|
                event.set("[field][" . k . "]" , v)
            }
        '
    }

But what was even better, is that I found out that the new grok-filter version 4.3.0 does indeed come with a target option, which is essentially what I actually wanted.