Update/rename nested field

Yes, if you want to move [host][name] to [host] you will have to use a temporary field to store the value.

Note that you have the option of moving it the other way

if ! [host][name] { mutate { rename => { "[host]" => "[host][name]" } } }
1 Like