# Rename fields using a dictionary

**URL:** <https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413>\
**Category:** Logstash\
**Created:** [August 26, 2020, 8:44am UTC](https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413 "2020-08-26T08:44:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![frank\_esg](https://avatars.discourse-cdn.com/v4/letter/f/b19c9b/32.png) [@frank\_esg](https://discuss.elastic.co/u/frank_esg)\
**Post date:** [August 26, 2020, 8:44am UTC](https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413/1 "2020-08-26T08:44:05Z")

</div>

Hi Folks,

is it possible in Logstash to rename fields (received as json) based on a dictionary File? Basically the same function like the translate filter does, but not for values but for field names.

Background: At the moment our applications are sending there logs in json format to logstash. Problem is that the applications don´t use a unified fieldname set, some fieldnames are the same some not.  
We´re now want to implement ECS to harmonize all Fields over all different Logtypes.  
Because it would now take a very long time until all teams had converted all their applications to ecs-compliant logging, we would like to rename the old field names in logstash to the new ecs field names. For this we would like to use a dictionary just like the translate filter does.

Is this possible within Logstash?

regards,  
Frank

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 26, 2020, 4:31pm UTC](https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413/2 "2020-08-26T16:31:12Z")

</div>

> [@frank\_esg](#):
>
> is it possible in Logstash to rename fields (received as json) based on a dictionary File? Basically the same function like the translate filter does, but not for values but for field names.

It is not built in but you could do it in a ruby filter. You can do anything in a ruby filter. You could also re-purpose the translate filter code and build a custom filter.

---

<div class="post-metadata">

**Author:** ![frank\_esg](https://avatars.discourse-cdn.com/v4/letter/f/b19c9b/32.png) [@frank\_esg](https://discuss.elastic.co/u/frank_esg)\
**Post date:** [September 3, 2020, 2:20pm UTC](https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413/3 "2020-09-03T14:20:05Z")

</div>

Hi,

thank you for your Answer. Then i have to figure out how to do that with ruby.

regards,  
Frank

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 2:20pm UTC](https://discuss.elastic.co/t/rename-fields-using-a-dictionary/246413/4 "2020-10-01T14:20:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.