rename

Renames fields and types.

Synopsis

rename <name=extractor>...

Description

The rename operator assigns new names to fields or types. Renaming only modifies metadata and is therefore computationally inexpensive. The operator handles nested field extractors as well, but cannot perform field reordering, e.g., by hoisting nested fields into the top level.

Renaming only takes place if the provided extractor on the right-hand side of the assignment resolves to a field or type. Otherwise the assignment does nothing. If no extractors match, rename degenerates to pass.

<name=extractor>...

An assignment of the form name=extractor renames the field or type identified by extractor to name.

Examples

Rename events of type suricata.flow to connection:

rename connection=:suricata.flow

Assign new names to the fields src_ip and dest_ip:

rename src=src_ip, dst=dest_ip

Give the nested field orig_h nested under the record id the name src_ip:

rename src=id.orig_h

Same as above, but consider fields at any nesting hierarchy:

rename src=orig_h