Hello, I am having a field data.aws.httpRequest.headers , and it has a list of hashes as seen below. { "name": "host", "value": "testwebsite.com" }, { "name": "authorization", "value": "token hidden" }, { "name": "sec-ch-ua", "value": "\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"96\", …

In a ruby filter, event.remove deletes a field and also returns its value. So instead of renaming the field you could do data = event.remove("[data][aws][httpRequest][headers]")

Discuss the Elastic Stack

Unpack a list of hashes into new fields

Elastic Stack Logstash

Badger November 24, 2021, 11:25pm 2

This post should give you some ideas.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.