Rename fields names with logstash

[Paf]

Hello,

I want to rename the field name "identity.claims.http://schemas.microsoft.com/claims/authnclassreference" to "identity_claims_authnclassreference".
For this, i use mutate filter with rename as follwing:

filter {
        mutate {
                rename => { "[identity][claims][http://schemas][microsoft][com/claims/authnclassreference]" => "identity_claims_authnclassreference" }
        }
}

This configuration dosen't work, the field name was not renamed.

Someone help-me?

Thanks

[aaron-nimocks]

If the field name has dots in it and aren't nested then you can just use dots.

  mutate {
    rename => { "identity.claims.http://schemas.microsoft.com/claims/authnclassreference" => "identity_claims_authnclassreference" }
  }

If they are nested then this should work.

  mutate {
    rename => { "[identity][claims][http://schemas.microsoft.com/claims/authnclassreference]" => "identity_claims_authnclassreference" }
  }

But it really depends on what the data looks like.

[Paf]

Everything works, the field name was rename.

Thanks for your help