Rename json nested fields using mutate


I have an issue with mutating a nested JSON fields using Logstash.
Example of my nested JSON:

"test_results_result_legacy_entities_hashtags": [
      "indices": [
      "text": "out"
      "indices": [
      "text": "getout"

I try mutate using the syntax rename => {"[test_results_result_legacy_entities_hashtags][text]" => "Hashtags"}, but seem it is not works. Any solution that you can suggest me?


[test_results_result_legacy_entities_hashtags] is an array, if you want to rename fields within member of the array you would use

rename => {
    [test_results_result_legacy_entities_hashtags][0][text] => "newName"
    [test_results_result_legacy_entities_hashtags][1][text] => "otherNewName"

If you want to create a [Hashtags] array then I think you can do that using mutate+rename, but if the number of array entries varies then you will need to use a ruby filter.

Yeah Thanks bro. It works.

But, if there any method that can I rename that two fields within member of the array in one name?


        rename => {
            "[test_results_result_legacy_entities_hashtags][0][text]" => "[Hashtags][0]"
            "[test_results_result_legacy_entities_hashtags][1][text]" => "[Hashtags][1]"

will work.

Thanks!!! It works.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.