Rename or Change Available Fields

How do I rename an available field? So for example we pull logs from GCP and use a json filter before outputting it to elasticsearch. The message field shows an event named "bytes_sent" but in Kibana under Available Fields it shows as jsonPayload.bytes_sent. Is there a way to strip the jsaonPayload. so it just shows as bytes_sent? I have tried rename and mutate filters within logstash but they dont appear to do anything.....provided this is even the right thing to do.

08%20AM 43%20AM

Use a mutate filter. Perhaps you are confusing jsonPayload.bytes_sent (a field with a period in its name) with [jsonPayload][bytes_sent] (a field within the jsonPayload object). The two appear the same in Kibana, but you need to use different names for them in logstash.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.