# Reserved fieldnames?

**URL:** <https://discuss.elastic.co/t/reserved-fieldnames/141200>\
**Category:** Logstash\
**Created:** [July 23, 2018, 2:54pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200 "2018-07-23T14:54:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rebort](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@rebort](https://discuss.elastic.co/u/rebort)\
**Post date:** [July 23, 2018, 2:54pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200/1 "2018-07-23T14:54:35Z")

</div>

i have trouble in a mutation filter. At 1st i put data trough a kv filter in a target field "kv". That works fine. After that i want to rename the fields e.g.

`mutate { rename => { "[kv][product]" => "[product]" }}`

this works with round about 20 fields, exept with `[kv][scheme]` and `[kv][methods]`.  
Are there reserved fieldnames? How can i get access to the values or how can i rename the fields.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 23, 2018, 3:02pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200/2 "2018-07-23T15:02:35Z")

</div>

What happens with [kv][scheme] and [kv][methods]?

---

<div class="post-metadata">

**Author:** ![rebort](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@rebort](https://discuss.elastic.co/u/rebort)\
**Post date:** [July 23, 2018, 3:16pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200/3 "2018-07-23T15:16:10Z")

</div>

the filter don't handle [kv][scheme] and [kv][methods]

this is a output, in the message field the original input:  
{  
"@timestamp": "2018-07-23T15:07:05.000Z",  
"@version": "1",  
"action": "Decrypt",  
"community": "RemoteAccess",  
"dst": "1.1.1.1",  
"fw\_subproduct": "VPN-1",  
"host": "192.168.146.240",  
"ifdir": "inbound",  
"ifname": "eth7",  
"inzone": "External",  
"kv": {  
"methods:": "ESP: 3DES + SHA1",  
"scheme:": "IKE"  
},  
"loguid": "{0x5b55ef19,0x1d,0xfb92a8c0,0xc0000005}",  
"message": "time="1532358425" action="Decrypt" flags="417028" ifdir="inbound" ifname="eth7" logid="0" loguid="{0x5b55ef19,0x1d,0xfb92a8c0,0xc0000005}" origin="2.2.2.2" originsicname="CN=srv-1,O=mgmt..yybz" sequencenum="88" time="1532358425" version="5" \_\_policy\_id\_tag="product=VPN-1 & FireWall-1[db\_tag={3860A-DB24-B449-9955-958B7D24};mgmt=mgmt;date=1532071301;policy\_name=Policy-1]" community="RemoteAccess" dst="1.1.1.1" fw\_subproduct="VPN-1" inzone="External" lastupdatetime="1532358425" layer\_name="Policy Network" layer\_uuid="abcf83-bb37-4bd3-9418-39fdaeee9" match\_id="0" parent\_rule="0" rule\_action="Accept" rule\_name="Implied Rule " rule\_uid="0E6801-8AB0-4b1e-A317-8BE3B43" methods:="ESP: 3DES + SHA1" nat\_addtnl\_rulenum="0" nat\_rulenum="0" outzone="Local" peer\_gateway="192.168.101.234" product="VPN-1 & FireWall-1" proto="17" s\_port="18203" scheme:="IKE" service="18234" service\_id="tunnel\_test" session\_uid="{5B55-0000-0000-0AA6-FE020000}" src="192.168.101.234" vpn\_feature\_name="VPN" xlatedport="0" xlatedst="10.10.10.1" xlatesport="0" xlatesrc="0.0.0.0" ",  
"nat": {  
"rulenum": "0",  
"s\_port": "0",  
"src": "0.0.0.0",  
"nat\_addtnl\_rulenum": "0",  
"d\_port": "0",  
"dst": "10.10.10.1"  
},  
"origin": {  
"ip": "2.2.2.2",  
"policy\_name": "Cluster\_Policy",  
"name": "srv-1"  
},  
"outzone": "Local",  
"peer\_gateway": "192.168.101.234",  
"port": 58308,  
"product": "VPN-1 & FireWall-1",  
"protocol": "17",  
"rule": {  
"action": "Accept",  
"uid": "0E-8AB0-4b1e-A317-8BE3305B43",  
"name": "Implied Rule "  
},  
"sequencenum": "88",  
"service": "18234",  
"servicename": "tunnel\_test",  
"session\_uid": "{5B55-0000-0000-0AA6-FE020000}",  
"src": "192.168.101.234",  
"srcport": "18203",  
"tags": [  
"fw\_log"  
],  
"type": "checkpointlog",  
"vpn\_feature\_name": "VPN"  
}

---

<div class="post-metadata">

**Author:** ![rebort](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@rebort](https://discuss.elastic.co/u/rebort)\
**Post date:** [July 23, 2018, 3:17pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200/4 "2018-07-23T15:17:45Z")

</div>

oh no... now i see it.

scheme:  
methods:

sorry

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 3:17pm UTC](https://discuss.elastic.co/t/reserved-fieldnames/141200/5 "2018-08-20T15:17:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.