#logstash

bolbgt: can you perhaps give more context?

do you want to rename /all/ fields, some subset, if subset, how are they related, etc?

torrancew: I have a logs of commands that are run, commands can be [command-name] [arg1] [arg2] [arg3] ...[argn] so fields are a0,a1,a2,a3...an. The logs are actually multiline, one of the logs will have those same fields exept it will have some weird values (maybe it's a memory address) so i just renamed those as a2_raw so that a2 wont become an array.

torrancew: e.g. if i have a log generated by the command`echo "fox" "monkey" "tango"` it get parsed into something like {a0: ["AB4143", "echo"] a1" ["523ED52", "fox"], ...}

bolbgt: hmmm, ruby filter may be the most elegant way to do that generically