# Rename fields name with Logstash

**URL:** https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861
**Category:** Logstash
**Created:** [August 7, 2025, 10:06am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861 "2025-08-07T10:06:10Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 7, 2025, 10:06am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/1 "2025-08-07T10:06:10Z")

</div>

How to rename for clarity

Can someone kindly help with this? Thank you.

`filter { `  
` mutate { `  
` rename => { "[test][rex-platform"\\"]" => "[test][rex-platform]" }`  
` } `  
`} `

Output Display Field is like this:

Table format  
Column1  
test.rex-platform"\

Column2  
Windows"",

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 7, 2025, 10:22am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/2 "2025-08-07T10:22:03Z")

</div>

Welcome to the community!

How did you import data? Which input plugin? CSV perheps

Can you show us pic, screen shoot, how does exactly field look like? You can use debug

---

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 7, 2025, 10:46am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/3 "2025-08-07T10:46:04Z")

</div>

through udp

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 7, 2025, 10:55am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/4 "2025-08-07T10:55:24Z")

</div>

And the pic please

---

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 7, 2025, 11:05am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/5 "2025-08-07T11:05:20Z")

</div>

Here it is.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2eb8acd81a61eb3d9c32248f1b74e27ee729fec.png)

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 7, 2025, 11:25am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/6 "2025-08-07T11:25:59Z")

</div>

According to my tests, try with the single quotes:

```auto
  mutate { 
      rename => { '[test][rex-platform"\\"]' => "[test][rex-platform]" }
 }

```

---

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 8, 2025, 4:09am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/7 "2025-08-08T04:09:26Z")

</div>

Still having the isuues

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1cafbf2f2bea70f7726e38fc9f73e033f7db3246.png)

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 8, 2025, 5:10am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/8 "2025-08-08T05:10:50Z")

</div>

As I said, provide the debug screens from Logstash

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [August 8, 2025, 5:23am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/9 "2025-08-08T05:23:23Z")

</div>

Hello,

Yes i see with single quotes it is working

```auto
rename => { '[test][rex-platform"\]' => '[test][rex-platform]' }

```

Still , if issue persists please share the debug screens as requested by Rio.

Thanks!!

---

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 8, 2025, 6:24am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/10 "2025-08-08T06:24:39Z")

</div>

Thank you so much, fix the rename field. How about in the value field? It’s still `Windows““,`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a04d3293aec2db77e4188a3ad30690af77c69ef4.png)

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [August 8, 2025, 7:09am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/11 "2025-08-08T07:09:12Z")

</div>

Hello,

For value you can try to use gsub

```auto
rename => { '[test][rex-platform"\]' => '[test][rex-platform]' }
	  gsub => [
      '[test][rex-platform]', '"', '',
      '[test][rex-platform]', ',', ''
    ]

```

Thanks!!

---

<div class="post-metadata">

### Author: ![yelinaung](https://avatars.discourse-cdn.com/v4/letter/y/d78d45/32.png) [@yelinaung](https://discuss.elastic.co/u/yelinaung)
#### Post date: [August 8, 2025, 9:30am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861/12 "2025-08-08T09:30:48Z")

</div>

Now fully got it. Thanks for your support.
