Renaming Nested Objects

[dawiro]

Hi,
If I have a field that is a dict-like object such as `[field_1][field_2][field_3]' how can I rename 'field_1' while leaving the sub-fields unchanged?

I have tried:

filter {
    mutate {
      rename => { "[field_1]" => "[renamed_field]" }
    }
}

But the field isn't renamed. What am I doing wrong?

Regards,
D

[dawiro]

Hi,
Is there any way I can do this?

Regards,
D

[Badger]

@dawiro

mutate { rename => { "[field_1]" => "[renamed_field]" } }

What you are doing should work. If I run

input { generator { count => 1 message => '' } }

filter {
    mutate { add_field => { "[field_1][field_2][field_3]" => "foo" } }
    mutate { rename => { "[field_1]" => "[renamed_field]" } }
}

then I get

"renamed_field" => {
    "field_2" => {
        "field_3" => "foo"
    }
},

[dawiro]

@Badger Thanks. I'm trying to rename the host data object added by the add_host_metadata processor in filebeat 6.7.1 as the name clashes with other fields. However, the host object is being indexed unaltered which has me perplexed.