Rename field after extracting it from another field

I'm using kv filter in order to extract several fields out of "attributes" field, which works just fine.
But then, I need to apply a mutate filter (rename in my case on one of this key-value pair that was extracted)

I tried the following:

json {
source => "message"
grok {
match => [ "message", "%{DATESTAMP:time}|\s+%{DATA:trackingid}|\s+%{DATA:attributes}|\s+%{NUMBER:responsetime}?" ]
add_field => {
"level" => "info"
"application_name" => "sample_app"
kv {
source => "attributes"
field_split => ", "
mutate {
rename => { "originalValue" => "newValue" }

The "originalValue" exists in the attributes, but the rename is not working in that case.
Any suggestions?


Please show an example of a processed event. Use a stdout { codec => rubydebug } output to dump the raw event.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.