Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] Fix description of rename processor #14408

Merged
merged 1 commit into from
Nov 18, 2019
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 15 additions & 13 deletions libbeat/processors/actions/docs/rename.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,21 @@
=== Rename fields from events

The `rename` processor specifies a list of fields to rename. Under the `fields`
key each entry contains a `from: old-key` and a `to: new-key` pair. `from` is
the origin and `to` the target name of the field.

Renaming fields can be useful in cases where field names cause conflicts. For
example if an event has two fields, `c` and `c.b`, that are both assigned scalar
values (e.g. `{"c": 1, "c.b": 2}`) this will result in an Elasticsearch error at
ingest time. This is because the value of a cannot simultaneously be a scalar
and an object. To prevent this rename_fields can be used to rename `c` to
`c.value`.

Rename fields cannot be used to overwrite fields. To overwrite fields either
first rename the target field or use the `drop_fields` processor to drop the
field and then rename the field.
key, each entry contains a `from: old-key` and a `to: new-key` pair, where:

* `from` is the original field name
* `to` is the target field name

The `rename` processor cannot be used to overwrite fields. To overwrite fields
either first rename the target field, or use the `drop_fields` processor to drop
the field and then rename the field.

TIP: You can rename fields to resolve field name conflicts. For example, if an
event has two fields, `c` and `c.b` (where `b` is a subfield of `c`), assigning
scalar values results in an {es} error at ingest time. The assignment `{"c": 1,
"c.b": 2}` would result in an error because `c` is an object and cannot be
assigned a scalar value. To prevent this conflict, rename `c` to `c.value`
before assigning values.

[source,yaml]
-------
Expand Down