Rename fields names with logstash


I want to rename the field name "" to "identity_claims_authnclassreference".
For this, i use mutate filter with rename as follwing:

filter {
        mutate {
                rename => { "[identity][claims][http://schemas][microsoft][com/claims/authnclassreference]" => "identity_claims_authnclassreference" }

This configuration dosen't work, the field name was not renamed.

Someone help-me?


If the field name has dots in it and aren't nested then you can just use dots.

  mutate {
    rename => { "" => "identity_claims_authnclassreference" }

If they are nested then this should work.

  mutate {
    rename => { "[identity][claims][]" => "identity_claims_authnclassreference" }

But it really depends on what the data looks like.

Everything works, the field name was rename.

Thanks for your help

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.