# Use mutate rename filter **URL:** \ **Category:** Logstash\ **Created:** [September 14, 2018, 1:16pm UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626 "2018-09-14T13:16:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![PitoneMaledetto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pitonemaledetto/32/33366_2.png) [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Post date:** [September 14, 2018, 1:16pm UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626/1 "2018-09-14T13:16:56Z")
Hi all, I am having some trouble in renaming one of the output field. Please consider (edited for easy reading): ``` [2018-09-14T13:04:43,936][DEBUG][logstash.pipeline] filter received {"event"=>{"@timestamp"=>2018-09-14T12:04:40.194Z, "system"=>{"load"=>{"norm"=>{"5"=>0.1363, "15"=>0.1175, "1"=>0.1763}, "5"=>1.09, "15"=>0.94, "1"=>1.41, "cores"=>8}}, "metricset"=>{"module"=>"system", "name"=>"load", "rtt"=>476}, "beat"=>{"name"=>"my-host-name ", "hostname"=>"my-host-name ", "version"=>"6.3.0"}, "@version"=>"1", "host"=>{"name"=>"my-host-name "}, "tags"=>["metricbeat", "beats_input_raw_event"]}} ``` now I would like to rename (see attached) "norm" with "load\_spread" and "1", "2" and "3" with "1\_min\_avg" and so on. ![graylog-output](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3ab12ba317089db2b67ea99d76d04f1e5f1938ef.png) I have tried to get to the right field but nothing has changed, for example: ``` #--------------REPLACING NORM IN LOAD--------------- if "load" in [message] { mutate { rename => { "norm" => "load_avg" } #rename => { "norm_5" => "5_mins avg" } #rename => { "norm_15" => "15_mins_avg"} } } ``` Do I need to re-index? I don't get any errors in re-loading Logstash configuration so the lines are fine but I don't get any changes. Any help appreciated. Thanks! ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [September 14, 2018, 5:26pm UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626/2 "2018-09-14T17:26:03Z")
It looks like the address of the source `norm` field is nested inside a `load` field, which in turn is nested in a `system` field so you'll need to provide the entire address to the `rename` directive using the [Field Reference Syntax](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references): ```auto if [system][load] { mutate { rename => { "[system][load][norm][1]" => "[system][load_spread][1_min_avg]" "[system][load][norm][5]" => "[system][load_spread][5_mins avg]" "[system][load][norm][15]" => "[system][load_spread][15_mins_avg]" "[system][load][1]" => "[system][load][1_min_avg]" "[system][load][5]" => "[system][load][5_mins avg]" "[system][load][15]" => "[system][load][15_mins_avg]" } mutate { remove_field => "[system][load][norm]" } } } ``` * * * You will need to re-process your data, which may include reindexing. Many inputs hold onto metadata to prevent them from accidentally re-processing the same data, so you'll likely need to refer to your specific input plugin(s)' documentation to figure out how to force them to start from the beginning. ---
**Author:** ![PitoneMaledetto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pitonemaledetto/32/33366_2.png) [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Post date:** [September 18, 2018, 9:35am UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626/3 "2018-09-18T09:35:09Z")
Thank you yaauie, That worked in part. It only process the data if I exclude: ```auto mutate { remove_field => "[system][load][norm]" } ``` otherwise: ```auto ####### STARTING FILTERS ################################### #--------------REPLACING NORM IN LOAD---------------\nif [system][load] {\n mutate {\n rename => {\n \"[system][load][norm][1]\" => \"[system][load_spread][1_min_avg]\"\n \"[system][load][norm][5]\" => \"[system][load_spread][5_mins avg]\"\n \"[system][load][norm][15]\" => \"[system][load_spread][15_mins_avg]\"\n \"[system][load][1]\" => \"[system][load][1_min_avg]\"\n \"[system][load][5]\" => \"[system][load][5_mins avg]\"\n \"[system][load][15]\" => \"[system][load][15_mins_avg]\"\n } mutate ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:38:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]} ``` Thank you for your help. ---
**Author:** ![PitoneMaledetto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pitonemaledetto/32/33366_2.png) [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Post date:** [September 18, 2018, 9:59am UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626/4 "2018-09-18T09:59:55Z")
Hi yaauie, just to say that your solution is good enough for me and I only posted the above for completeness. Thank you again for your help. Best regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 16, 2018, 9:59am UTC](https://discuss.elastic.co/t/use-mutate-rename-filter/148626/5 "2018-10-16T09:59:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.