Mutate rename using field value


I'm trying to rename a field using the value of another metadata field, here is what I have tried:

filter {
  grok {
    match => {
      "path" => "%{GREEDYDATA}/%{GREEDYDATA:[@metadata][metric_name]}\.csv"

  csv {
    skip_header => true
    columns => ["t","value"]

  mutate {
    rename => {
      "value" => "%{metric_name}"

Which basically uses grok to pull out the filename, excluding it's extension as metric_name. Then later on I'm trying to this in mutate to rename value to the value of metric_name.

Is this possible with mutate?

I believe it is. The code sprintf's both the old and new values. But [metric_name] and [@metadata][metric_name] do not match.

I managed to figure this out by using %[@metadata][metric_name] in mutate

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.