Type to search.

Rename processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack GA 9.2+ …

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.2

    This functionality is generally available and ready for production usage.

  • Preview in 9.1

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Use the Rename processor to change the name of a field, moving its value to a new field name and removing the original.

To use a rename processor:

  1. Select Create → Create processor.
  2. Select Rename from the Processor menu.
  3. Set Source Field to the field you want to rename.
  4. Set Target field to the new name you want to use for the Source Field.

This functionality uses the Elasticsearch Rename processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

In YAML mode, configure the rename processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Source field to rename.
to string Yes New field name.
ignore_missing boolean No When true, skip this processor if the source field is missing.
override boolean No When true, allow overwriting an existing target field.
YAML 
- action: rename
  from: attributes.old_name
  to: attributes.new_name