Rename processor

The rename processor is used to rename an existing field, which can also be used to move a field from one object to another object or to the root level.

Syntax

The following is the syntax for the rename processor:

  1. {
  2.     "rename": {
  3.         "field": "field_name",
  4.         "target_field" : "target_field_name"
  5.     }
  6. }

copy

Configuration parameters

The following table lists the required and optional parameters for the rename processor.

ParameterRequired/OptionalDescription
fieldRequiredThe field name containing the data to be removed. Supports template snippets.
target_fieldRequiredThe new name of the field. Supports template snippets.
ignore_missingOptionalSpecifies whether the processor should ignore documents that do not contain the specified field. If set to true, the processor does not modify the document if the field does not exist. Default is false.
override_targetOptionalDetermines what happens when target_field exists in the document. If set to true, the processor overwrites the existing target_field value with the new value. If set to false, the existing value remains and the processor does not overwrite it. Default is false.
descriptionOptionalA brief description of the processor.
ifOptionalA condition for running the processor.
ignore_failureOptionalSpecifies whether the processor continues execution even if it encounters an error. If set to true, failures are ignored. Default is false.
on_failureOptionalA list of processors to run if the processor fails.
tagOptionalAn identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline named rename_field that moves a field in an object to the root level:

  1. PUT /_ingest/pipeline/rename_field
  2. {
  3.   "description": "Pipeline that moves a field to the root level.",
  4.   "processors": [
  5.     {
  6.       "rename": {
  7.         "field": "message.content",
  8.         "target_field": "content"
  9.       }
  10.     }
  11.   ]
  12. }

copy

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before ingesting documents.

To test the pipeline, run the following query:

  1. POST _ingest/pipeline/rename_field/_simulate
  2. {
  3.   "docs": [
  4.     {
  5.       "_index": "testindex1",
  6.       "_id": "1",
  7.       "_source":{
  8.          "message": {
  9.            "type": "nginx",
  10.            "content": "192.168.1.10 - - [03/Nov/2023:15:20:45 +0000] \"POST /login HTTP/1.1\" 200 3456"
  11.          }
  12.       }
  13.     }
  14.   ]
  15. }

copy

Response

The following example response confirms that the pipeline is working as expected:

  1. {
  2.   "docs": [
  3.     {
  4.       "doc": {
  5.         "_index": "testindex1",
  6.         "_id": "1",
  7.         "_source": {
  8.           "message": {
  9.             "type": "nginx",
  10.           },
  11.           "content": """192.168.1.10 - - [03/Nov/2023:15:20:45 +0000] "POST /login HTTP/1.1" 200 3456"""
  12.         },
  13.         "_ingest": {
  14.           "timestamp": "2024-04-15T07:54:16.010447Z"
  15.         }
  16.       }
  17.     }
  18.   ]
  19. }

Step 3: Ingest a document

The following query ingests a document into an index named testindex1:

  1. PUT testindex1/_doc/1?pipeline=rename_field
  2. {
  3.   "message": {
  4.     "type": "nginx",
  5.     "content": "192.168.1.10 - - [03/Nov/2023:15:20:45 +0000] \"POST /login HTTP/1.1\" 200 3456"
  6.   }
  7. }

copy

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

  1. GET testindex1/_doc/1

copy