Rename json array field names

Elastic Stack Beats
1

{
"Network IP Gateway": "165.10.2.3",
"network details": [
{
"Adapter Name": "Intel(R) Network Connection",
"Manufacturer": "Intel Corporation",
"Adapter Type": "Ethernet 802.3",
"MAC Address": "00:50:56:A3:2F:36",
"Speed": "100 Mbps",
"Network Connection ID": "Ethernet0"
}
]}

I am able to rename for eg: network details to network_details but unable to rename the array fields for Eg: Adapter Name to adapter_name.

Here is the filebeat config:

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • /temp/sample.json
      #json.message_key: event
      json.keys_under_root: true
      json.add_error_key: true

processors:

  • drop_fields:
    fields: ["@metadata", "prospector","input","beat","host","source","offset","log"]
  • decode_json_fields:
    fields: ["message"]
    #process_array: true
    #max_depth: 100
  • rename:
    fields:
    • from: "network details"
      to: "network_details"
    • from: "Adapter Name"
      to: "adapter_name"
2

any ideas.

3

I have noticed java script processor but not sure what code to put in which servers my purpose.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.