Rename field winlog.event_data.TargetUserName


I'm running ELK stack with winlogbeat and I would like to change the name of the field winlog.event_data.TargetUserName.


Currently I've put this in my logstash config:


if [winlog][event_data][TargetUserName]
mutate {
rename => { "winlog.event_data.TargetUserName" => "User" }

However, when I run logstash it doesnt seem to do anything. The field doesn't get renamed (as far as I can see in Kibana) and logstash runs just as normal.

Any pointers would be greatly appreciated!



rename => { "[winlog][event_data][TargetUserName]" => "User" }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.