Skip to content

Feature request: support template in rename processor's target_field #29657

@jovandeginste

Description

@jovandeginste

I'm trying to solve this use case with journalbeat and elastic:

A process outputs json. I use the json processor in journalbeat (or in elastic ingest pipeline, same difference) to decode that output from field message to field json_message. I would like the output to be in field {{ name_of_process }} instead (eg. {{ journald.systemd_unit }}), to prevent type clashes (same process should not mix types, but different processes could).

I can not use templates in the json processor's target_field nor the rename processor's target_field.

Is there a specific reason for this, am I Doing Something Wrong(tm)?

Metadata

Metadata

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions