Mutate rename multiple fields, how to improve performance?


I have a pipeline where I need to rename something around 1100 fields, the documents do not have all the fields, but in total I need to rename near 1100 fields.

Currently I have one mutate filter with a rename action for every field.

mutate {
    rename => { "field1" => "newField1"}
    rename => { "field2" => "newField2"}
    rename => { "fieldN" => "newFieldN"}

Would using one mutate filter and one rename action with the fields make any difference? Or in the end it will be the same thing?

mutate {
    rename {
        "field1" => "newField1"
        "field2" => "newField2"
        "fieldN" => "newFieldN"

Anyone has a similar use case?

If there are multiple instances of an option on a filter they are merged when the configuration is parsed, so the two would be equivalent.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.