Rename strings field to nested field

[frank_rib]

Hello every body,
I want to parse the logs bellow

Apr 20 01:10:04 hostname sshproxy[150]: [SSH Session] session_id="56454646eaeazjajflen" client_ip="X.X.X.X" target_ip="X.X.X.X" user="X.X.X.X" device="X.X.X.X" service="SSH" account="XXX" type="KBD_INPUT" data="sudo -i"

The config file:

filter{
grok{
match => {"message" => "%{SYSLOGBASE2} %{GREEDYDATA:syslog_message}}
}
kv{
source => "syslog_message"
value_split => "=""
field_split => ""\s"
}}

As output i had fields : (host, user,account, ...)
How can i convert the host field to [host][name], the user to [user][name] and account to [user][name]

Best regards,

[Badger]

Use mutate+rename...

mutate {
    rename => {
        "[user]" => "[user][name]"
        "[host]" => "[host][name]"
        ...
    }
}

[frank_rib]

Hello badger,
Thank-you for your prompt response, after renaming the [host] with [host][name] I get the error bellow :

And for the second one [user] with the [user][name] I had the result

The mutate filter

Can you please help me to resolve those issues
Best regard

[Badger]

If you have indexed events where [host] is the hostname then you will need to switch to a new index if you want [host] to be an object with a [name] field inside it. A field on a document can be text or an object, but it cannot be one on some documents and the other on others.

[frank_rib]

Hello Badger,

Thanks for the reply, Is it possible to convert the [host] field from text to objet? if yes how i can do it?

Best regards,

[Badger]

In elasticsearch if a field has already been mapped as text it cannot be changed to an object without re-indexing the data into a different index.

[frank_rib]

Thanks Badger i will try to re-index the data to a different index