Rename json nested fields using mutate

Elastic Stack Logstash
1

Hi,

I have an issue with mutating a nested JSON fields using Logstash.
Example of my nested JSON:

"test_results_result_legacy_entities_hashtags": [
    {
      "indices": [
        34,
        43
      ],
      "text": "out"
    },
    {
      "indices": [
        44,
        50
      ],
      "text": "getout"
    }
]

I try mutate using the syntax rename => {"[test_results_result_legacy_entities_hashtags][text]" => "Hashtags"}, but seem it is not works. Any solution that you can suggest me?

Thanks

2

[test_results_result_legacy_entities_hashtags] is an array, if you want to rename fields within member of the array you would use

rename => {
    [test_results_result_legacy_entities_hashtags][0][text] => "newName"
    [test_results_result_legacy_entities_hashtags][1][text] => "otherNewName"
}

If you want to create a [Hashtags] array then I think you can do that using mutate+rename, but if the number of array entries varies then you will need to use a ruby filter.

3

Yeah Thanks bro. It works.

But, if there any method that can I rename that two fields within member of the array in one name?

Thanks.

4 
        rename => {
            "[test_results_result_legacy_entities_hashtags][0][text]" => "[Hashtags][0]"
            "[test_results_result_legacy_entities_hashtags][1][text]" => "[Hashtags][1]"
        }

will work.

6

Thanks!!! It works.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.