Rename fields in logstash

Elastic Stack Logstash
1

Hello team,
from below log i am trying to remove below fields from logstash but it is not working as expected.

Can you please help me on this:

This is how field is coming in kibana:

image
image1520×422 41.7 KB

value.com.softwareag.um.server:brokerName=umserver,type=Broker.PublicKey

I had tried with below code but not working:

mutate {
      remove_field => ["[value][com][softwareag][um][server\:brokerName\=umserver\,type\=Broker][PublicKey]"]
	                     
    }

Also:

 mutate {
      remove_field => ["[value][com][softwareag][um][server:brokerName=umserver,type=Broker][PublicKey]"]
	                     
    }

mutate {
      remove_field => ["value.com.softwareag.um.server:brokerName=umserver,type=Broker.PublicKey"]
	                     
    }
2

Please share how the json of the document looks like.

In Kibana expand the document and go to the json tab to see how it looks like.

Also, what does your parse looks like? It seems that something is wrong to create fields like that.

3

Hi @leandrojmp
PFB sample json
Here i need to rename ""com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/CallActivityReturn,destinationType=Topic,subtype=Configuration,type=Broker":"

{
    "request": {
        "mbean": "com.softwareag.um.server:brokerName=umserver,destinationName=*,destinationType=Topic,subtype=*,type=Broker",
        "type": "read"
    },
    "value": {
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/CallActivityReturn,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/CallActivityReturn",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/CallActivityStart,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/CallActivityStart",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/ProcessTransitionVol,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/ProcessTransitionVol",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/nullDoc,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/nullDoc",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/ProcessTransition,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/ProcessTransition",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=InvoiceTopic,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "InvoiceTopic",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/SubprocessReturn,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/SubprocessReturn",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/BR92bc8a40afd54a9b9b0655a215103a81_J_jRQtEolDEurgAVIwwwADXaZQs__RequestReplyClient,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/BR92bc8a40afd54a9b9b0655a215103a81_J_jRQtEolDEurgAVIwwwADXaZQs__RequestReplyClient",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/webservices/WebserviceReply,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/webservices/WebserviceReply",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/SubprocessStart,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/SubprocessStart",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/status/ChangeCommand,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/status/ChangeCommand",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=TestTopic,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "TestTopic",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/SubprocessDone,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/SubprocessDone",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/dispatch/Signal,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/dispatch/Signal",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/webservices/WebserviceRequest,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/webservices/WebserviceRequest",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        },
        "com.softwareag.um.server:brokerName=umserver,destinationName=/wm/is/wm/prt/debug/ProcessComplete,destinationType=Topic,subtype=Configuration,type=Broker": {
            "CacheOnReload": true,
            "TypeName": "UM TOPIC",
            "SynOnEachWrite": false,
            "SyncMaxBatchSize": 0,
            "StampDictionary": "default",
            "PerformAutoMaintenance": true,
            "MultiFileEventsPerSpindle": 50000,
            "AbsolutePath": "/wm/is/wm/prt/debug/ProcessComplete",
            "UsesMergeEngine": false,
            "UsesJMSEngine": true,
            "TTL": 0,
            "ClusterWide": false,
            "HonorCapacityWhenFull": true,
            "StoreType": "Mixed",
            "Type": 2,
            "SyncBatchTime": 0,
            "Capacity": 0,
            "EnableCaching": true,
            "External": false,
            "DeadEventStore": "None"
        }
    },
    "status": 200,
    "timestamp": 1730263910
}