Skip to main content

Rename

Transform Elastic Compatible

Synopsis​

Renames one or more fields in the document. Supports both single field renaming and bulk field renaming operations.

Schema​

rename:
  - field: <ident>
  - fields:
      - from: <ident>
        to: <ident>
  - target_field: <ident>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Configuration​

FieldRequiredDefaultDescription
fieldN-Single field to rename (mutually exclusive with fields)
target_fieldN-New name for the field (required if field is used)
fieldsN-Array of field rename operations (mutually exclusive with field)
descriptionN-Explanatory note
ifN-Condition to run
ignore_failureNfalseSee Handling Failures
ignore_missingNfalseIf true, continue silently if field doesn't exist
on_failureN-See Handling Failures
on_successN-See Handling Success
tagN-Identifier

Details​

The processor can handle nested fields using dot notation and supports template variables in field names. If a target field already exists or the source field is missing, an exception is raised unless appropriate error handling is configured.

note

Multiple field rename is sequential. Each field is removed after being renamed unless the source and target names are identical.

warning

Be careful when renaming fields that are part of a nested structure. The processor creates intermediate objects as needed, but this might affect existing field paths.

Examples​

Single Field​

Replace a field's name...

{
  "old_name": "John Smith",
  "age": 30
}
rename:
  - field: old_name
    target_field: full_name

with a new name:

{
  "full_name": "John Smith",
  "age": 30
}

Multiple Fields​

Rename multiple fields at once...

{
  "src_ip": "192.168.1.1",
  "dst_ip": "10.0.0.1",
  "src_port": 8080
}
rename:
  - fields:
      - from: src_ip
        to: source.ip
      - from: dst_ip
        to: destination.ip
      - from: src_port
        to: source.port

creating a nested structure:

{
  "source": {
    "ip": "192.168.1.1",
    "port": 8080
  },
  "destination": {
    "ip": "10.0.0.1"
  }
}

Templates​

Rename using template variables...

{
  "type": "user",
  "user_id": "12345",
  "user_name": "john"
}
rename:
  - field: "{{{type}}}_name"
    target_field: name

evaluating the variables:

{
  "type": "user",
  "user_id": "12345",
  "name": "john"
}

Error Handling​

Handling missing fields gracefully...

{
  "existing_field": "value"
}
rename:
  - fields:
      - from: existing_field
        to: new_field
      - from: missing_field
        to: other_field
  - ignore_missing: true
  - on_failure:
      - append:
          field: tags
          value: rename_incomplete

continues execution:

{
  "new_field": "value",
  "tags": ["rename_incomplete"]
}