How to change key name in a JSON at logstash level?

Question

I am using logstash to ship json data to elasticsearch. But I need to change the key name of a particular key at logstash level before shipping to ElasticSearch.

Is it possible to do so? If yes, do I need to include some plugins for logstash?

Original data: {"keyA": "dataA", "keyB": "dataB"}

ElasticSearch data: {"keyC": "dataA", "keyB": "dataB"}

Answer 1

Yes it is possible. Use the rename configuration option on the mutate filter to rename one or more fields. By default, it should already come included with Logstash.

Example:

 filter {
  mutate {
    # Renames the 'keyA' field to 'KeyC'
    rename => { "keyA" => "keyC" }
  }
}