Rename event fields

Hi all,
I'm want to ship Rails' requests to ES but rename certain fields so it will match other indexes field names, mainly is the ip to true_ip.

Is there a configuration option for this in Filebeat?

I believe that renaming the fields on the Rails' side will result in performance hit.

Thank you,
Yarden

Filebeat can't rename fields. You can do this either in Logstash with the mutate filter or with an ingest pipeline in elasticsearch 5.0

1 Like

This topic was automatically closed after 21 days. New replies are no longer allowed.