Want to Change a Field Name (Not a Field Value)

Elastic Stack Logstash
1

The useragent filter can be used to parse an Apache Access Log File and create a field named "browser". After running the user agent filter, how do I rename the field name from "browser" to "browser-name"? I am thinking that I use the mutate filter, but after reading the documentation I see that you can add a field and remove a field, how do I change a field name (not a field value)?

Can someone please give me a quick example of how I would use the mutate filter to rename a field from "browser" to "browser-name"?

2

Nevermind. Figured it out using the following mutate filter.

mutate {

rename field from 'name' to 'browser_name'

rename => { "name" => "browser_name" }
}

5 Likes