I’m really struggling to find a way to rename multiple field names. I’v scoured the support site but to no avail. I was wondering if anyone can point me in the right direction. I have a large list which I’ve reduced below, that I need to remove what essentially is a prefix from the field. I’m shipping this over via Beats from a Linux box using the Sidecar. It starts out as json so I’m using the “json.keys_under_root: true” and “json.add_error_key: true” to parse it prior to arriving in Graylog. When it arrives in Graylog, each line/field is populated with something like this:
I’ve used the pipeline code below but it only works on one line, not all.
rule rule “remove_this_prefix_ from fields”
What I’d like to be able to do is have a then statement that covers all of it but I’m not sure what code needs to go in “when” (see below). I’ve messed around with regex and other assorted ways to rename the field but I know I’m missing something.
rule “remove_this_prefix_ from fields”
What goes here???