# Mutate logstash netflow codec variable name to user defined names

**URL:** <https://discuss.elastic.co/t/mutate-logstash-netflow-codec-variable-name-to-user-defined-names/86352>\
**Category:** Logstash\
**Created:** [May 19, 2017, 4:42am UTC](https://discuss.elastic.co/t/mutate-logstash-netflow-codec-variable-name-to-user-defined-names/86352 "2017-05-19T04:42:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://discuss.elastic.co/u/tharu85)\
**Post date:** [May 19, 2017, 4:42am UTC](https://discuss.elastic.co/t/mutate-logstash-netflow-codec-variable-name-to-user-defined-names/86352/1 "2017-05-19T04:42:38Z")

</div>

I need to change default logstash netflow codec variable name to my own names . How can I do it.

I have tried it as below. In the output, for stdout { codec =\> rubydebug } shows rename variables names, but gelf output shows and stored Elasticsearch as netflow defualt variable names

mutate  
{  
rename =\> ["[netflow][l4\_src\_port]" , "[netflow][srcport]" ]  
rename =\> ["[netflow][l4\_dst\_port]" , "[netflow][dstport]" ]  
rename =\> ["[netflow][src\_mask]" , "[netflow][srcmask]" ]  
rename =\> ["[netflow][dst\_mask]" , "[netflow][dstmask]" ]  
}

please tell me anyone who knows to change netflow default variable names

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [May 19, 2017, 2:09pm UTC](https://discuss.elastic.co/t/mutate-logstash-netflow-codec-variable-name-to-user-defined-names/86352/2 "2017-05-19T14:09:45Z")

</div>

In the mutate plugin the rename option takes a hash see [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-rename](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-rename)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2017, 2:10pm UTC](https://discuss.elastic.co/t/mutate-logstash-netflow-codec-variable-name-to-user-defined-names/86352/3 "2017-06-16T14:10:09Z")

</div>

Closed on June 16, 2017, 2:10pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.