# Rename field - input syslog

**URL:** <https://discuss.elastic.co/t/rename-field-input-syslog/249575>\
**Category:** Logstash\
**Created:** [September 22, 2020, 6:53pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575 "2020-09-22T18:53:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paulogbr](https://avatars.discourse-cdn.com/v4/letter/p/b5a626/32.png) [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\
**Post date:** [September 22, 2020, 6:53pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575/1 "2020-09-22T18:53:49Z")

</div>

Hello Team,

I tried rename field in logstash. I received syslog and save log in file.

This is my conf.

```
input {
  udp {
    port => "5133"
    type => "syslog"
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_ferramenta}: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss.SSS", "MMM dd HH:mm:ss.SSS"]
      timezone => "Europe/Spain"
    }
    json {
                source => "syslog_message"
        }
        mutate {
            rename => {
            "[_source][src_ip]" => "[_source][source_ip]"
            "[_source][proto]" => "[_source][protocol]"
            }
}
}
}

output {
 file {
   path => "/var/log/test/suricata.json"
   codec => line { format => "%{syslog_message}"}
}
}

```

The log save in file:

`{"timestamp":"2020-09-22T15:38:16.211953-0300","flow_id":0000000000000041,"in_iface":"ix3","event_type":"alert","lan":[200],"src_ip":"192.168.0.1","src_port":44669,"dest_ip":"192.168.0.1","dest_port":3389,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":65535003,"rev":1,"signature":"ProApps Unauthorized","category":"Attempted Denial of Service","severity":2},"app_proto":"ntp","flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":94,"bytes_toclient":0,"start":"2020-09-22T15:38:16.211953-0300"}}`

I dont have problem with this...i just tried use the mutate to rename.

I used

```
mutate {
                rename => {
                "[_source][src_ip]" => "[_source][source_ip]"
                "[_source][proto]" => "[_source][protocol]"
                }
    }

```

and

```
mutate {
                rename => {
                "[src_ip]" => "[source_ip]"
                "[proto]" => "[protocol]"
                }
    }

```

Can you help me ?

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [September 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575/2 "2020-09-23T13:25:25Z")

</div>

Can you try this ?

```auto
                rename => {
                "[lan][src_ip]" => "[source_ip]"
                "[lan][proto]" => "[protocol]"
                }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2020, 1:25pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575/3 "2020-10-21T13:25:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.