Removing parent object names with ingest pipeline

I'm trying to figure out how to clean up my fields and remove some of the top level parents in my documents. I want to turn Properties.Status and Properties.Status.StatusName into Status and Status.StatusName, respectively.

With logstash this is done with a ruby filter that looks like:

            ruby {
                code => '
                    if (event.get("Properties"))
                        event.get("Properties").each { |j,p|

But I need to do this with an ingest pipeline and I'm not as familiar with painless. Any help?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.