# Rename field problem

**URL:** https://discuss.elastic.co/t/rename-field-problem/289669
**Category:** Logstash
**Created:** [November 19, 2021, 9:50am UTC](https://discuss.elastic.co/t/rename-field-problem/289669 "2021-11-19T09:50:41Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [November 19, 2021, 9:50am UTC](https://discuss.elastic.co/t/rename-field-problem/289669/1 "2021-11-19T09:50:41Z")

</div>

Hello!

I have input data like

```auto
"abc":"123";"def":"456";"ghi":"789"

```

I use the following filter to parse data and rename `"abc"` field to `"blabla"`

```auto
filter {
  kv {
    source => "message"
    field_split => ";"
    value_split => ":"
    trim_key => " "
  }
  
  mutate {
    rename => { "abc" => "blabla" }
  }
}

```

Data are parsed but the field `"abc"` is not renamed.

How to solve the problem?

Note: I can rename the `"message"` field with no problem, but not `"abc"`

---

<div class="post-metadata">

### Author: ![Alex\_Marquardt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_marquardt/32/42925_2.png) [@Alex\_Marquardt](https://discuss.elastic.co/u/Alex_Marquardt)
#### Post date: [November 19, 2021, 1:51pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669/2 "2021-11-19T13:51:29Z")

</div>

I suspect that you are storing field names that are getting extracted including quotation characters in the field name. You could remove them with `remove_char_key`.

The pipeline below demonstrates how to get the rename to work for such a scenario:

```auto
input {
# The generator creates an input event
    generator {
        lines => '"abc":"123";"def":"456";"ghi":"789"'
        count => 1
    }
}
filter {
    kv {
      source => "message"
      field_split => ";"
      value_split => ":"
      trim_key => " "
      remove_char_key => "\""
    }

    mutate {
      rename => {"abc" => "blabla"}
    }
}

output {
    stdout { codec => "rubydebug" }
}

```

The output from the above pipeline is the following, which shows that the field has been renamed correctly:

```auto
{
        "blabla" => "123",
          "host" => "New2020MacBook",
    "@timestamp" => 2021-11-19T13:48:09.557Z,
           "def" => "456",
      "sequence" => 0,
           "ghi" => "789",
      "@version" => "1",
       "message" => "\"abc\":\"123\";\"def\":\"456\";\"ghi\":\"789\""
}

```

Without `remove_char_key` the output would look as follows (which is unlikely what you want):

```auto
{
       "\"abc\"" => "123",
          "host" => "New2020MacBook",
       "\"def\"" => "456",
       "\"ghi\"" => "789",
    "@timestamp" => 2021-11-19T13:45:12.219Z,
      "sequence" => 0,
      "@version" => "1",
       "message" => "\"abc\":\"123\";\"def\":\"456\";\"ghi\":\"789\""
}

```

---

<div class="post-metadata">

### Author: ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [November 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669/3 "2021-11-19T14:12:09Z")

</div>

@Alex_Marquardt thank you! You helped me a lot! 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rename-field-problem/289669/4 "2021-12-17T14:12:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.