Mutate rename filter not working on nested fields

Elastic Stack Logstash
1

I'm trying to rename a field to work with my data. The field I'm attempting to rename is nested.
My config:

filter {

mutate {rename => { "[message][context][payload][geolocation][latitude]" => "[message][context][payload][geolocation][lat]" } }

}

but this is not working.

my data:
{
"message": "User",
"context": {
"uuid": "06bb5548-0585-4243-92ee-4bd6764b6b93",
"payload": {
"id": "06bb5548-0585-4243-92ee-4bd6764b6b93",
"geolocation": {
"latitude": 40.4047,
"longitude": 2.997135,
"accuracy": 20,
"altitude": 0,
},
"addedAt": "2020-11-16T10:03:08.000000+00:00",
"createdAt": "2020-11-16T10:03:17.904974+00:00"
}
}
}

2

If your event is already parsed as json, then you can access field directly without message like this

mutate {rename => { "[context][payload][geolocation][latitude]" => "[context][payload][geolocation][lat]" } }

{
  "message": "User",
  "context": {
    "uuid": "06bb5548-0585-4243-92ee-4bd6764b6b93",
    "payload": {
      "id": "06bb5548-0585-4243-92ee-4bd6764b6b93",
      "geolocation": {
        "latitude": 40.4047,
        "longitude": 2.997135,
        "accuracy": 20,
        "altitude": 0
      },
      "addedAt": "2020-11-16T10:03:08.000000+00:00",
      "createdAt": "2020-11-16T10:03:17.904974+00:00"
    }
  }
}
3

I tried it and it doesn't work it. If I try to rename only the message field, it works.
mutate {rename => { "[message]" => "[xxx]" } }

the problem is when I try to rename nested fields.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.