# Which ways to copy subfields of kubernetes.container.\_module.labels.\* to kubernetes.lables.\*? **URL:** \ **Category:** Logstash\ **Created:** [August 16, 2019, 6:32pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546 "2019-08-16T18:32:32Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\ **Post date:** [August 16, 2019, 6:32pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/1 "2019-08-16T18:32:32Z")
Hi, to simplify filtering I want to copy all substructure of `kubernetes.container._module.labels.*` to `kubernetes.lables.*`. Just moving a copy levels up. The structure below .labels is dynamic, so I cannot hardcode the labels. What are the ways to go? Number 1: writing a ruby script (I a not a big fan of ruby) Number 2: Is there a way to copy structure just with mutate or so? Number 3: your call 😉 Thank you for your ideas. Regards, Andreas ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2019, 6:45pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/2 "2019-08-16T18:45:12Z")
You can rename it with mutate ``` mutate { rename => { "[kubernetes][container][_module][labels]" => "[kubernetes][lables]" } } ``` You may then want to remove some fields. ---
**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\ **Post date:** [August 16, 2019, 6:47pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/3 "2019-08-16T18:47:49Z")
thanks, I will try. I assume copy will work the same? I don't want to rename / move, because I don't want to break any shipped functionality like the infrastructure module. ---
**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\ **Post date:** [August 16, 2019, 7:36pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/4 "2019-08-16T19:36:25Z")
I tried it out. first try: copy [kubernetes][container][\_module] to [kubernetes] was overwriting everything else what already was in structure kubernetes. My successful approach now looks like this: ``` # depending on the sub module of kubernetes, there are parameters like labels which are not always stored in kubernetes root object. # so logically identical data is stored in different objects - depending on the kubernetes resource. # Following filters will clone these objects to kubernetes root, so that kibana is able to filter all kubernetes resources by label. if [kubernetes][container][_module] { # labels are optional if [kubernetes][container][_module][labels] { mutate { copy => { "[kubernetes][container][_module][labels]" => "[kubernetes][labels]" } } } # following fields are not optional mutate { copy => { "[kubernetes][container][_module][namespace]" => "[kubernetes][namespace]" } copy => { "[kubernetes][container][_module][node]" => "[kubernetes][node]" } copy => { "[kubernetes][container][_module][pod]" => "[kubernetes][pod]" } } } else if [kubernetes][pod][_module] { # labels are optional if [kubernetes][pod][_module][labels] { mutate { copy => { "[kubernetes][pod][_module][labels]" => "[kubernetes][labels]" } } } # following fields are not optional mutate { copy => { "[kubernetes][pod][_module][namespace]" => "[kubernetes][namespace]" } copy => { "[kubernetes][pod][_module][node]" => "[kubernetes][node]" } } } else if [kubernetes][node][_module] { # labels are optional if [kubernetes][node][_module][labels] { mutate { copy => { "[kubernetes][node][_module][labels]" => "[kubernetes][labels]"} } } } else if [kubernetes][volume][_module] { # labels are optional if [kubernetes][volume][_module][labels] { mutate { copy => { "[kubernetes][volume][_module][labels]" => "[kubernetes][labels]"} } } # following fields are not optional mutate { copy => { "[kubernetes][volume][_module][namespace]" => "[kubernetes][namespace]" } copy => { "[kubernetes][volume][_module][node]" => "[kubernetes][node]" } copy => { "[kubernetes][volume][_module][pod]" => "[kubernetes][pod]" } } } else if [kubernetes][system][_module] { # labels are optional if [kubernetes][system][_module][labels] { mutate { copy => { "[kubernetes][system][_module][labels]" => "[kubernetes][labels]"} } } # following fields are not optional mutate { copy => { "[kubernetes][system][_module][node]" => "[kubernetes][node]" } } } ``` Thanks for your help @Badger ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2019, 7:46pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/5 "2019-08-16T19:46:22Z")
mutate+copy is a no-op if a field does not exist, so you can compress this down to ``` mutate { copy => { "[kubernetes][container][_module][labels]" => "[kubernetes][labels]" "[kubernetes][container][_module][namespace]" => "[kubernetes][namespace]" "[kubernetes][container][_module][node]" => "[kubernetes][node]" "[kubernetes][container][_module][pod]" => "[kubernetes][pod]" "[kubernetes][pod][_module][labels]" => "[kubernetes][labels]" "[kubernetes][pod][_module][namespace]" => "[kubernetes][namespace]" "[kubernetes][pod][_module][node]" => "[kubernetes][node]" "[kubernetes][node][_module][labels]" => "[kubernetes][labels]" "[kubernetes][volume][_module][labels]" => "[kubernetes][labels]" "[kubernetes][volume][_module][namespace]" => "[kubernetes][namespace]" "[kubernetes][volume][_module][node]" => "[kubernetes][node]" "[kubernetes][volume][_module][pod]" => "[kubernetes][pod]" "[kubernetes][system][_module][labels]" => "[kubernetes][labels]" "[kubernetes][system][_module][node]" => "[kubernetes][node]" } } ``` assuming that only one of the sets of node/labels/pod will be present. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 13, 2019, 7:46pm UTC](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/6 "2019-09-13T19:46:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.