# Replace dots in field names for ES 2.0

**URL:** <https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206>\
**Category:** Logstash\
**Created:** [October 14, 2015, 6:55pm UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206 "2015-10-14T18:55:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![juerkan](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@juerkan](https://discuss.elastic.co/u/juerkan)\
**Post date:** [October 14, 2015, 6:55pm UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206/1 "2015-10-14T18:55:58Z")

</div>

Dear logstash pro's  
We produce logs and we use logstash to bring it into elasticsearch.  
There hundrets of dynamic produced field names with a dot inside. (not nestet fields)  
And we have field names with no dots.  
for example:  
originator.id1 = 27  
caseid = 1235  
originator.res1 =346  
originator.case142 = 341  
is there a way in logstash to replace a dot in a field name dynamicly.  
something like:  
If in the field name is a dot, replace it with a under score.  
output should be:  
originator\_id1 = 27  
caseid = 1235  
originator\_res1 =346  
originator\_case142 = 341

i played with the gsub filter plugin, but without success  
help me out, please

---

<div class="post-metadata">

**Author:** ![juerkan](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@juerkan](https://discuss.elastic.co/u/juerkan)\
**Post date:** [October 14, 2015, 7:20pm UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206/2 "2015-10-14T19:20:04Z")

</div>

i forget:  
a field name can consist more than one dot.  
for example:  
mass.originator.2.type

thx

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 14, 2015, 7:23pm UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206/3 "2015-10-14T19:23:12Z")

</div>

The mutate filter's gsub option works on field _values_, not field _names_. You need to use the ruby filter for this and write some custom Ruby code.

---

<div class="post-metadata">

**Author:** ![juerkan](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@juerkan](https://discuss.elastic.co/u/juerkan)\
**Post date:** [October 28, 2015, 1:36pm UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206/4 "2015-10-28T13:36:11Z")

</div>

Hi, many thanks for your advice,  
I tried...... but, i'm not a ruby ninja

Is there someone out there, who can help me with this ruby code

i think other people will have the same problem (dots in field names) with ES2.0

thank you and greetings from austria

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/replace-dots-in-field-names-for-es-2-0/32206/5 "2017-07-06T05:25:04Z")

</div>