This function renames one or more fields.
Parameter | Type | Required | Default | Description |
---|---|---|---|---|
as | string | optional[a] | The new name of the field; it is used when a single field name is given in field . | |
field [b] | string or array | required | The field name to rename, if a new field name is given in as . From v1.106.0, multiple fields can be quoted using an array of old/new field name pairs: [oldName,newName] . | |
[a] Optional parameters use their default value unless explicitly set |
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscalerename("value")
and:
logscalerename(field="value")
Old fields are are removed from the event stream which can add overhead during processing. Copying to a new field using:
logscale
newfield := oldfield
Is more efficient, but retains the old field in the event set.