# Renaming nested fields
**URL:** https://discuss.elastic.co/t/renaming-nested-fields/134462
**Category:** Logstash
**Created:** [June 4, 2018, 4:51pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462 "2018-06-04T16:51:06Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 4, 2018, 4:51pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/1 "2018-06-04T16:51:07Z")
Hello,
I'm trying to rename the fields coming from a jdbc\_streaming and has a target like [field1][nestedField],
in my document I get a list with the result of the query, since the jdbc\_streaming filter plugin don't have the option "lowercase\_column\_names" i can't set up the names I want in the query and all comes back with lowercase.
So now I have this:
```auto
{
"_source": {
"field1": {
"nestedField": [{
"lowercase1": "value1",
"lowercase2": "value2"
},
{
"lowercase1": "value3",
"lowercase2": "value4"
}
]
}
}
}
```
for my end result I want this:
```auto
{
"_source": {
"field1": {
"nestedField": [{
"camelCase1": "value1",
"camelCase2": "value2"
},
{
"camelCase1": "value3",
"camelCase2": "value4"
}
]
}
}
}
```
i tried to use the mutate rename plugin with no success.
I used it like this:
```auto
mutate {
rename => {
"[field1][nestedField][lowercase1]" => "[field1][nestedField][camelCase1]"
"[field1][nestedField][lowercase2]" => "[field1][nestedField][camelCase2]"
}
}
```
What am I doing wrong?
Thanks in advance for any help!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 4, 2018, 5:09pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/2 "2018-06-04T17:09:58Z")
Your examples aren't valid JSON so it's hard to understand what your events actually look like.
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 4, 2018, 5:21pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/3 "2018-06-04T17:21:10Z")
Sorry @magnusbaeck, I messed up the curly braces.
I have this:
```auto
{
"_source": {
"field1": {
"nestedField": [{
"lowercase1": "value1",
"lowercase2": "value2"
},
{
"lowercase1": "value3",
"lowercase2": "value4"
}
]
}
}
}
```
And I want this:
```auto
{
"_source": {
"field1": {
"nestedField": [{
"camelCase1": "value1",
"camelCase2": "value2"
},
{
"camelCase1": "value3",
"camelCase2": "value4"
}
]
}
}
}
```
I tried to do it like this:
```auto
mutate {
rename => {
"[field1][nestedField][lowercase1]" => "[field1][nestedField][camelCase1]"
"[field1][nestedField][lowercase2]" => "[field1][nestedField][camelCase2]"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 4, 2018, 5:49pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/4 "2018-06-04T17:49:39Z")
nestedField is an array, so you need to index into it.
```
"[field1][nestedField][0][lowercase1]" => "[field1][nestedField][0][camelCase1]"
```
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 5, 2018, 11:01am UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/5 "2018-06-05T11:01:58Z")
Hey @Badger, thanks for the anwer but that does not work for me, changes nothing, I still get the lowercase names
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2018, 11:34am UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/6 "2018-06-05T11:34:24Z")
With this configuration
```auto
filter { json { source => "message" } }
input { generator { message => '{
"field1": {
"nestedField": [{
"lowercase1": "value1",
"lowercase2": "value2"
},
{
"lowercase1": "value3",
"lowercase2": "value4"
}
]
}
}' count => 1 } }
output { stdout { codec => rubydebug } }
filter {
mutate {
rename => {
"[field1][nestedField][0][lowercase1]" => "[field1][nestedField][0][camelCase1]"
"[field1][nestedField][0][lowercase2]" => "[field1][nestedField][0][camelCase2]"
}
}
}
```
I get
```auto
"field1" => {
"nestedField" => [
[0] {
"camelCase1" => "value1",
"camelCase2" => "value2"
},
[1] {
"lowercase2" => "value4",
"lowercase1" => "value3"
}
]
},
```
What does stdout { codec =\> rubydebug } produce for your messages?
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 5, 2018, 11:37am UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/7 "2018-06-05T11:37:42Z")
Hey @Badger,
the thing is i don't want to change only the first element, I want to change the name of all elements inside the array.
your solution only changes the first element.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2018, 11:43am UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/8 "2018-06-05T11:43:53Z")
The mutate+rename example you gave in the first post only renamed the first array entry. I showed you how to fix that example.
If that's not the problem you want to solve please explain what you do want to solve.
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 5, 2018, 11:49am UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/9 "2018-06-05T11:49:20Z")
The mutate-rename example in my first post changes nothing, but I think I was clear with the examples I provided, what I have vs want I want.
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 5, 2018, 5:37pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/10 "2018-06-05T17:37:45Z")
I feel I'm getting closer,
I've found on another post a way to do it but somehow it's not working for me.
I used the filter ruby plugin like this
```auto
filter {
if([field1][nestedField]){
ruby {
code => "
event.get('[field1][nestedField]').each { |k|
k['camelCase1'] = k['lowercase1']
k['camelCase2'] = k['lowercase2']
k.delete('lowercase1')
k.delete('lowercase2')
logger.info('for each k', 'value' => k)
}
logger.info('full array' , 'value' => event.get('[field1][nestedField]'))
"
}
}
}
```
The thing is when I print "k" in the logger it's exactly has I want it to be but when I print the whole array nothing has changed.
Am I missing some kind of set?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 5, 2018, 6:45pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/11 "2018-06-05T18:45:54Z")
Try this
```auto
code => "
b = []
event.get('[field1][nestedField]').each { |k|
k['camelCase1'] = k['lowercase1']
k['camelCase2'] = k['lowercase2']
k.delete('lowercase1')
k.delete('lowercase2')
logger.info('for each k', 'value' => k)
b << k
}
event.set('[field1][nestedField]', b)
"
```
---
### Author:  [@Tiago\_Pinto](https://discuss.elastic.co/u/Tiago_Pinto)
#### Post date: [June 5, 2018, 7:15pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/12 "2018-06-05T19:15:22Z")
Yes @Badger that did the trick!
Thank you for your help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2018, 7:15pm UTC](https://discuss.elastic.co/t/renaming-nested-fields/134462/13 "2018-07-03T19:15:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.