Mutate add_field and rename don't work

[Ernesto_Guerra]

Hi,
I'm trying to use mutate filter to change the name of a field. I've tried rename but it doesn't do anything, and tried creating a new field and passing the contents of the old one and didn't work either.

My first try was to rename field "o" to "operacion"

The code was:

mutate {
        rename => { "o" => "operacion" }
      }

It didn't do anything.

Then I tried adding a field and passing the value of "o".

My code is:

  mutate {
        add_field => { "operacion" => "%{o}"}
      }

And as a result I get the following result:

{
            "g1" => 0,
    "@timestamp" => 2021-02-10T12:07:31.282Z,
             "o" => "PILOTO",
            "g2" => 0,
          "host" => "ubuntu",
      "@version" => "1",
     "operacion" => "%{o}",
             "i" => "3780385637",
            "g3" => 0
}

It doesn't parse the data of the field it just adds the literal "%{o}"

Thanks in advance.

[aaron-nimocks]

The below works for me. Could it be where you are placing your mutate block?

input {
  generator {
    lines => [ '{ "o":"text" }' ]
    codec => "json"
  }
}
filter {
  mutate {
    rename => { "o" => "operacion" }
  }
}
output { stdout { } }

[Ernesto_Guerra]

Thank you. Both, add_field and rename worked perfectly in the moment that I specified the codec line

codec => "json"