"rename" filter didn't rename the field in events


(Kavya Sabu) #1

I used the filter plugin "rename" to rename a field in my events. Logstash didn't show any error on restart. But there doesn't seem to be any changes to the field name(checked in sense plugin). I added "rename" after indexing the file. How can I rename a field after indexing? I'm using LS-2.0, ES-2.0. This is a piece of my logstash.conf file:

filter {
	grok {
			match => {"message" => "^(?<EventTime>[0-9 \-\:]*)\s(?<MovieName>[\w.\-\']*)\s(?<Rating>[\d.]+)\s(?<NoOfDownloads>\d+)\s(?<NoOfViews>\d+)" }
		}
		
	mutate {
		convert => {"Rating" => "float"}
		}
	mutate {
		convert => {"NoOfDownloads" => "integer"}
		}
	mutate {
		convert => {"NoOfViews" => "integer"}
		}
		
	mutate{
		rename => { "NoOfViews" => "TotalViews" }
		}
>     }

(Mark Walkom) #2

You need to reindex the data.


(system) #3