Rename fields with index suffix in field name

[rudok (Krejci Rudo)]

Hi,

Is it possible to rename field containing .index suffix to different name?

Like IF-MIB::ifAdminStatus.10 => AdminStatus

First try ( of course not workig" was:

filter {
 mutate {
   rename => [ "IF-MIB::ifAdminStatus.*", "AdminStatus" ]
 }

}

Thx

Rudolf

[Badger]

You could do that in ruby

    ruby {
        code => '
            event.to_hash.each { |k, v|
                newk = k.gsub(/^IF-MIB::if(.*)\.[0-9]+/, "\\1")
                if k != newk
                    event.set(newk, v)
                    event.remove(k)
                end
            }
        '
    }

BUT... if you have multiple occurrences of an item in a MIB (.1, .2, etc) this will lose all except the last.

[rudok (Krejci Rudo)]

Thx

It works as I expected

Rudolf