# Parsing metricbeat fields in logsatsh **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [May 28, 2018, 6:09am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465 "2018-05-28T06:09:56Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 6:09am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/1 "2018-05-28T06:09:56Z")
Hello, I want to parse/filter the fields in Logstash, which are crated by metricbeat. For example: I want to store system.cpu.total.pct -\> under custom field percentCpu Reason for this change is: I have 90% unix servers, where custom scripts are calculating 'percentCpu' and sending through filebeat. On Windows machine we dont have such scripts so metricbeat need to be used. Since visualization is using 'percentCpu' field for aggregation I have to do above change. br, Sunil. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2018, 7:31am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/2 "2018-05-28T07:31:43Z")
Hi, This functionality will be available in Beats 6.3 by the use of the [new rename processor](https://www.elastic.co/guide/en/beats/filebeat/master/rename-fields.html): ```auto processors: - rename: fields: from: 'system.cpu.total.pct' to: 'percentCpu' ``` If you don't want to wait until 6.3 is out you can give it a try by using one of our daily snapshots: [https://beats-package-snapshots.s3.amazonaws.com/index.html?prefix=metricbeat/](https://beats-package-snapshots.s3.amazonaws.com/index.html?prefix=metricbeat/) Otherwise, you can use Logstash [Mutate filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) or the [Rename processor](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/rename-processor.html) in Elasticsearch's Ingest Node. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 7:45am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/3 "2018-05-28T07:45:54Z")
It seems there are more features coming in Beats 6.3, Kibana 6.3 which I need desperately. When are you guys releasing this version at least for non-production use? What is the probable risk in using daily snapshot? Is 'rename' processor available in today's snapshot? br, Sunil. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2018, 8:09am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/4 "2018-05-28T08:09:21Z")
I'm sorry I can't give you a date when 6.3 will be out, as we don't announce release dates (delays happen and 6.3 involves many changes in the Elastic Stack). I think your best option is to use one of our release candidates for 6.3. This way you can replace them easily with the final 6.3 when it comes out. The snapshots I shared before are from master (7.0.0-alpha1) so it can be tricky if later you want to use the official 6.3. Here's [metricbeat 64bit for Windows](https://staging.elastic.co/6.3.0-be84d930/downloads/beats/metricbeat/metricbeat-6.3.0-windows-x86_64.zip) [Metricbeat 64bit for Linux (DEB)](https://staging.elastic.co/6.3.0-be84d930/downloads/beats/metricbeat/metricbeat-6.3.0-amd64.deb) [Metricbeat 64bit for Linux (RPM)](https://staging.elastic.co/6.3.0-be84d930/downloads/beats/metricbeat/metricbeat-6.3.0-x86_64.rpm) Hope that covers everything. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 8:12am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/5 "2018-05-28T08:12:15Z")
Indeed. its a precise help! thank you so much Tim! ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 8:16am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/6 "2018-05-28T08:16:29Z")
Sorry to bother you Tim again. How can I add more rename for example 4 fields to be renamed? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2018, 8:38am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/7 "2018-05-28T08:38:01Z")
The correct way is to make fields an array, like this: ```auto processors: - rename: fields: - from: 'original_a' to: 'new_a' - from: 'original_b' to: 'new_b' ``` Every `-` starts a new element in the array. See the documentation below, as you might be interested in using the `ignore_missing` or `fail_on_error` flags. [https://www.elastic.co/guide/en/beats/filebeat/master/rename-fields.html](https://www.elastic.co/guide/en/beats/filebeat/master/rename-fields.html) ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 10:04am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/8 "2018-05-28T10:04:02Z")
Hello Tim, rename is not working: my MB configuration is as below. > - module: system > period: 10s > metricsets: > - cpu > #- load > - memory > #- network > #- process > #- process\_summary > #- core > #- diskio > #- socket > processes: ['.\*'] > process.include\_top\_n: > by\_cpu: 5 # include top 5 processes by CPU > by\_memory: 5 # include top 5 processes by memory > > #- module: system > > # metricsets: > > # - core > > # - diskio > > # - socket > > - module: system > period: 1m > metricsets: > > - module: system > period: 15m > metricsets: > > #- module: system > > # period: 5m > > # metricsets: > > # - raid > > # raid.mount\_point: '/' ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2018, 10:34am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/9 "2018-05-28T10:34:12Z")
I think your indentation is bad, but I can't tell for sure. Can you enclose your configuration between triple-backtics? like this: ``` contents of configuration ``` ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 28, 2018, 10:45am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/10 "2018-05-28T10:45:04Z")
hi, It worked now. However, I cant change the 'beat.name' to 'myHost' How to change below fields? beat.name host.name beat.hostname using rename processor? Br, Sunil. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2018, 2:27pm UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/11 "2018-05-28T14:27:15Z")
It might be that these fields, being added automatically, still don't exist by the time the processor is run. We'll look into that. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 30, 2018, 4:24am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/12 "2018-05-30T04:24:28Z")
Hello Adrian, Any update on this? When can I have this in snapshot version? br, Sunil. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 27, 2018, 4:24am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465/13 "2018-06-27T04:24:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.