Rename event fields

Elastic Stack Beats
1

Hi all,
I'm want to ship Rails' requests to ES but rename certain fields so it will match other indexes field names, mainly is the ip to true_ip.

Is there a configuration option for this in Filebeat?

I believe that renaming the fields on the Rails' side will result in performance hit.

Thank you,
Yarden

2

Filebeat can't rename fields. You can do this either in Logstash with the mutate filter or with an ingest pipeline in elasticsearch 5.0