Question on renaming a field in a json event
anybody know how I would go about renaming a field "fields.metric_name" in a json event to the value of a different field that I've already concatenated what I need to be in the new field name? old name fields.metric_name=`metric_name:${object}.${collection}` but I need the new field to be fields.metric_name:System.Threads with a value of _value
Answers
-
You want the "Publish Metrics" function: https://docs.cribl.io/stream/publish-metrics-function/
0 -
you mean use that function to rename a json field like the one above to the value of another field and assign it a value of a different field?
0 -
Like this:
0 -
this works for single perfmon metrics. I just tested with MultiKV metrics and it doesn't.
0 -
Would you be willing to provide a sample input and the desired output? DM if you want
0 -
I think you're in a private channel if you want to invite me there for a discussion
0 -
sure. thanks. I'll upload sample data as well in the morning to the private channel.
0
