# Renaming fields wild card logstash

**URL:** <https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396>\
**Category:** Logstash\
**Created:** [July 8, 2019, 5:40pm UTC](https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396 "2019-07-08T17:40:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paulo64](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo64/32/48977_2.png) [@Paulo64](https://discuss.elastic.co/u/Paulo64)\
**Post date:** [July 8, 2019, 5:40pm UTC](https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396/1 "2019-07-08T17:40:09Z")

</div>

Hello,

From what I have read, there is not yet wild card associated with fields to use with "mutate".  
In my logstash config, I am doing something like this :

```
filter {
    mutate {
        rename => ["Site.Equipment.Metric", "Metric"]
    }
}

```

Since all my fields are generated dynamically (Site(x),Equipement(x),Metric(x)), I would like to be able to rename all incoming fields like this :

```
filter {
    mutate {
        rename => ["*.Whatever", "Whatever"]
    }
}

```

I tried unsuccessfully using a ruby filter, splitting with and "." and keeping the last value of the array and removing the key and reassigning.

Is there a workaround to do this ?  
Have you any clean solution to this issue ?

Thank you for your help,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 8, 2019, 6:11pm UTC](https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396/2 "2019-07-08T18:11:09Z")

</div>

Do you field names really have dots in them or are they fields nested within objects? If they contain dots then you can do it using

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                event.remove(k)
                newK = k.sub(/.*\.([^\.]+)$/, "\\1")
                event.set(newK, v)
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![Paulo64](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulo64/32/48977_2.png) [@Paulo64](https://discuss.elastic.co/u/Paulo64)\
**Post date:** [July 9, 2019, 9:00am UTC](https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396/3 "2019-07-09T09:00:08Z")

</div>

Thank you very much, works like a charm

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2019, 9:00am UTC](https://discuss.elastic.co/t/renaming-fields-wild-card-logstash/189396/4 "2019-08-06T09:00:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.