file.d
file.d copied to clipboard
Feature: add conditions to rename action
Is your feature request related to a problem? Please describe.
We have 2 apps running in kubernetes, the first one produces logs like { "message": "hello" } and the second one like { "message": { "field": "hello", "otherField": "world"}}.
As result after writing these logs to the same index in elasticsearch there is a conflict on type of field and kibana does not show them.
Describe the solution you'd like
I would like to rename message field if it's json object to for example message_json but rename and neither other actions don't support any conditions/filters.
Describe alternatives you've considered For now, we separated logs from different apps to different indexes.