Rename and sub field dont work

[nigdav007 (NigelD)]

Hay All

I am trying to rename and field called "@fields.ctxt_file" to "file" but it does not work

the config i am using is

	json {
	    source => "message"
	}
	      mutate {
                  replace => [ "message", "%{@message}" ]
                  replace => [ "host", "%{@source}" ]
                  replace => [ "programname", "%{@type}" ]
                  rename => { "'@fields.ctxt_file'" => "file" }
                  rename => { "'@fields.ctxt_line'" => "line" }
                  rename => { "'@fields.ctxt_user_uuid'" => "user_id" }
                  remove_field => ["@message","@tags", "@version", "@source","@type", "sysloghost"]
            }
 }

any advise is welcome and gratefull

[Nico-DF]

@nigdav007

"'@fields.ctxt_file'"

The double quote is what you wrote or you just made a mistake here?

[nigdav007 (NigelD)]

I tried
"'@fields.ctxt_file'" and
"@fields.ctxt_file"

both failed to work

[nigdav007 (NigelD)]

Worked it out
it should be

rename => { "[@fields][ctxt_file]" => "file" }