# Renaming multiple fields that are nested
**URL:** https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376
**Category:** Logstash
**Created:** [March 10, 2022, 10:57pm UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376 "2022-03-10T22:57:08Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@itschobot](https://discuss.elastic.co/u/itschobot)
#### Post date: [March 10, 2022, 10:57pm UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376/1 "2022-03-10T22:57:08Z")
I need help renaming multiple fields that are nested, here is my problem, I can only rename "did" within example.devices but when I attempt to rename others I would assume it's the same pattern but the results are what is below
Example of results of the filter:
```auto
"example.devices" => [
[0] {
"subnet" => "1234",
"mac" => 1234,
"identifier" => "1234",
"ip" => "1234",
"hostname" => "1234",
"example.devices.did" => 1234,
"sid" => 1234
}
```
here is my filter:
```auto
filter{
json {
source => "[_source][message]"
target => "parsed_message"
}
mutate{
rename => {
parsed_message" => "[example.parsed_message]"
"somethingDevices" => "example.devices"
"[example.devices][0][did]" => "[example.devices][0].[example.devices.did]"
"[example.devices][0][ip]" => "[example.devices][0][ip_TESTING]"
}
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 10, 2022, 11:08pm UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376/2 "2022-03-10T23:08:35Z")
You are making assumptions about the order of execution. You are trying to create [example.devices] in the same mutate in which you modify it. Some of the modifies may happen before it is created, in which case they will be no-ops. Split it into two mutate filters.
---
### Author:  [@itschobot](https://discuss.elastic.co/u/itschobot)
#### Post date: [March 10, 2022, 11:27pm UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376/3 "2022-03-10T23:27:02Z")
> [@Badger](#):
>
> Split it into two mutate filters.
thanks badger for the help! I didn't know any better how rename works as I was stuffing it all in one rather than modulating it, I thought it hit the limit or something but it was what you mentioned.
it worked splitting it up, I did see your other post previously regarding renaming using ruby for every k value. Would this approach also be another way to solve what I wanted?
here is the post: [Renaming nested fields](https://discuss.elastic.co/t/renaming-nested-fields/134462)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 11, 2022, 12:05am UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376/4 "2022-03-11T00:05:25Z")
I would not use ruby unless you have to. If [example.devices] has a variable number of entries in the array then ruby would be required.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 8, 2022, 12:06am UTC](https://discuss.elastic.co/t/renaming-multiple-fields-that-are-nested/299376/5 "2022-04-08T00:06:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.