Rename and sub field dont work


(NigelD) #1

Hay All

I am trying to rename and field called "@fields.ctxt_file" to "file" but it does not work

the config i am using is

	json {
	    source => "message"
	}
	      mutate {
                  replace => [ "message", "%{@message}" ]
                  replace => [ "host", "%{@source}" ]
                  replace => [ "programname", "%{@type}" ]
                  rename => { "'@fields.ctxt_file'" => "file" }
                  rename => { "'@fields.ctxt_line'" => "line" }
                  rename => { "'@fields.ctxt_user_uuid'" => "user_id" }
                  remove_field => ["@message","@tags", "@version", "@source","@type", "sysloghost"]
            }
 }

any advise is welcome and gratefull


#2

The double quote is what you wrote or you just made a mistake here?


(NigelD) #3

I tried
"'@fields.ctxt_file'" and
"@fields.ctxt_file"

both failed to work


(NigelD) #4

Worked it out
it should be

rename => { "[@fields][ctxt_file]" => "file" }

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.