Rename source field names


(Eddie Adams) #1

I have documents with variable field names, but there are fields with the same meaning: Example:

{"ipAddress":"123.123.123.123"}
{"client":"111.111.111.112"}
I would like to know if it is possible to rename field name "client" to "ipAddress" I know that i can name the index:

"properties": {
    "client": {
        "index_name": "ipAddress",
        "index": "not_analyzed",
        "type": "string"
    },
}

But that works just for search, not for the source: http://example.com:9200/estest/logs/_search?pretty&q=ipAddress:111.111.111.112 result:

{
"took" : 179,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [ {
"_index" : "costest",
"_type" : "logs",
"_id" : "P5_ZSIjtRmWcD80A1sJ7ow",
"_score" : 1.0,
"_source":{"client":"111.111.111.112"}
} ]
}
}

Is it possible?

Thanx


(Mark Walkom) #2

You need to do that during index time.


(system) #3