# SOLVED - Logstash Filter Help - Hash

**URL:** <https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400>\
**Category:** Logstash\
**Created:** [February 25, 2018, 5:47pm UTC](https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400 "2018-02-25T17:47:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wayne\_Taylor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wayne_taylor/32/45984_2.png) [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\
**Post date:** [February 25, 2018, 5:47pm UTC](https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400/1 "2018-02-25T17:47:44Z")

</div>

Team,

I have an SQS message which has an embedded message that I want to parse and take out each element. I have SQS input working - but when it gets to ES it looks for the message part. Example

"REALTIMEEVENT": {  
"type": "UPDATE",  
"attributes": {  
"id": "123456"  
"technology": "NC",  
"state": "TOUCHDOWN",  
"owner": "SLI"  
}  
}

I want to use type for document type, ID for document ID and have the owner etc as actual elements.

In Kibana UI the fields look like REALTIMEEVENT.attributes.id etc.

Any ideas.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 25, 2018, 8:36pm UTC](https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400/2 "2018-02-25T20:36:41Z")

</div>

You can use a mutate filter to rename fields from e.g. `[REALTIMEEVENT][technology]` to plain `technology`. To set the document type and id in your elasticsearch output, reference the fields whose values you want to pick up using the `%{fieldname}` notation described at [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).

---

<div class="post-metadata">

**Author:** ![Wayne\_Taylor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wayne_taylor/32/45984_2.png) [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\
**Post date:** [February 25, 2018, 10:14pm UTC](https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400/3 "2018-02-25T22:14:34Z")

</div>

Thank you @magnusbaeck - the rename worked fine. As for the referencing fields I had that covered - but thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2018, 10:15pm UTC](https://discuss.elastic.co/t/solved-logstash-filter-help-hash/121400/4 "2018-03-25T22:15:02Z")

</div>

Closed on March 25, 2018, 10:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.