Rename event fields


(Yarden Bar) #1

Hi all,
I'm want to ship Rails' requests to ES but rename certain fields so it will match other indexes field names, mainly is the ip to true_ip.

Is there a configuration option for this in Filebeat?

I believe that renaming the fields on the Rails' side will result in performance hit.

Thank you,
Yarden


(ruflin) #2

Filebeat can't rename fields. You can do this either in Logstash with the mutate filter or with an ingest pipeline in elasticsearch 5.0


(system) #3

This topic was automatically closed after 21 days. New replies are no longer allowed.