Renaming fields dinamically

Hi, I got multiple fields with composed names likes the ones below

I want to get rid of the part, and left only the last word.

is there a way to do this dinamically, without using mutate-rename?

You can do this with Ruby. You loop through and get the Field and Value and then write it back to the root level. Then delete records.


input { generator { lines => ['{ "records": { "properties": { "multiVmGroupId": 123, "rpoInSeconds": 456 }}}'] count => 1 codec => "json" } }
filter {
 ruby {
  code => '
   event.get("[records][properties]").each { |k, v|
output { stdout { codec =>  "json" } }


    "multiVmGroupId": 123,
    "rpoInSeconds": 456
1 Like

Hi @aaron-nimocks
Thanks for you answer, I got a _rubyexception, I think because is just a string with dots, not a nested field, how can i do this if is just an string with dots?

You would replace the contents of the .each loop with something like this.

1 Like

Tanks Badger, it work, with a litle change....have to pass the regular expression as argument otherwise gives me an ruby exception

        event.to_hash.each { |k,v|
            keymatch =""
            if k =~ /#{keymatch}/
                newK = k.sub(/^, "")
                event.set(newK, v)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.