Renaming fields dinamically

[ElasticLiver (Dense Man)]

Hi, I got multiple fields with composed names likes the ones below

records.properties.multiVmGroupId
records.properties.rpoInSeconds

I want to get rid of the records.properties part, and left only the last word.

is there a way to do this dinamically, without using mutate-rename?

[aaron-nimocks]

You can do this with Ruby. You loop through records.properties and get the Field and Value and then write it back to the root level. Then delete records.

Conf

input { generator { lines => ['{ "records": { "properties": { "multiVmGroupId": 123, "rpoInSeconds": 456 }}}'] count => 1 codec => "json" } }
filter {
 ruby {
  code => '
   event.get("[records][properties]").each { |k, v|
    event.set(k,v)
   }
   event.remove("[records]")
  '
 }
}    
output { stdout { codec =>  "json" } }

Output

{
    "multiVmGroupId": 123,
    "rpoInSeconds": 456
}

[ElasticLiver (Dense Man)]

Hi @aaron-nimocks
Thanks for you answer, I got a _rubyexception, I think because is just a string with dots, not a nested field, how can i do this if is just an string with dots?

[Badger]

You would replace the contents of the .each loop with something like this.

[ElasticLiver (Dense Man)]

Tanks Badger, it work, with a litle change....have to pass the regular expression as argument otherwise gives me an ruby exception

        event.to_hash.each { |k,v|
            keymatch ="records.properties"
            if k =~ /#{keymatch}/
                newK = k.sub(/^records.properties./, "")
                event.remove(k)
                event.set(newK, v)
            end
        }