# Rename snmp dynamic fields
**URL:** https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236
**Category:** Logstash
**Created:** [November 17, 2019, 7:45pm UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236 "2019-11-17T19:45:40Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@richard\_N](https://discuss.elastic.co/u/richard_N)
#### Post date: [November 17, 2019, 7:45pm UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/1 "2019-11-17T19:45:41Z")
How can I strip off everything after the . in my fields. Using SNMP the field names a very dynamic across devices and interfaces.
ifDescr.27 to IfDescr
ifInOctects.50 to IfInOctects
IfInErrors.19 to IfInErrors
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 17, 2019, 11:59pm UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/2 "2019-11-17T23:59:58Z")
You would have to do it in a ruby filter. [This](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645/5) is an example of using ruby to modify field names.
---
### Author:  [@richard\_N](https://discuss.elastic.co/u/richard_N)
#### Post date: [November 18, 2019, 1:31pm UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/3 "2019-11-18T13:31:44Z")
Yeah, i've gotten that far. I've got this put together but doesn't seem to work.
ruby {
code =\> "
begin
keys = event.to\_hash.keys
keys.each{ |key|
if ( key =~ /ifDescr/ )
event.set('ifDescr', event.remove(key))
elsif ( key =~ /ifInDiscards/ )
event.set('ifInDiscards', event.remove(key))
elsif ( key =~ /ifInErrors/ )
event.set('ifInErrors', event.remove(key))
elsif ( key =~ /ifInOctects/ )
event.set('ifInOctects', event.remove(key))
elsif ( key =~ /ifOperStatus/ )
event.set('ifOperStatus', event.remove(key))
elsif ( key =~ /ifOutDiscards/ )
event.set('ifOutDiscards', event.remove(key))
elsif ( key =~ /ifOutErrors/ )
event.set('ifOutErrors', event.remove(key))
elsif ( key =~ /ifOutErrors/ )
event.set('ifOutErrors', event.remove(key))
elsif ( key =~ /ifOutOctects/ )
event.set('ifOutOctects', event.remove(key))
elsif ( key =~ /sysName/ )
event.set('sysName', event.remove(key))
end
}
rescue Exception =\> e
event.set('logstash\_ruby\_exception', e.message)
end
"
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 18, 2019, 3:01pm UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/4 "2019-11-18T15:01:26Z")
Try
```
ruby {
code => '
event.to_hash.each { |k, v|
if k =~ /^(ifDescr|ifInDiscards|ifInErrors|ifInOctects|ifOperStatus|ifOutDiscards|ifOutErrors|ifOutErrors|ifOutOctects)/
newk = k.gsub(/\.[0-9]+$/, "")
event.set(newk, v)
event.remove(k)
end
}
'
}
```
The if statement is probably optional.
---
### Author:  [@richard\_N](https://discuss.elastic.co/u/richard_N)
#### Post date: [November 23, 2019, 1:44am UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/5 "2019-11-23T01:44:54Z")
> [@Badger](#):
>
> ruby { code =\> ' event.to\_hash.each { |k, v| if k =~ /^(ifDescr|ifInDiscards|ifInErrors|ifInOctects|ifOperStatus|ifOutDiscards|ifOutErrors|ifOutErrors|ifOutOctects)/ newk = k.gsub(/.[0-9]+$/, "") event.set(newk, v) event.remove(k) end } ' }
That worked more or less. I had to do a little debugging and fix my mappings.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 21, 2019, 1:44am UTC](https://discuss.elastic.co/t/rename-snmp-dynamic-fields/208236/6 "2019-12-21T01:44:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.