This function renames one or more fields.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
as | string | optional[a] | The new name of the field; it is used when a single field name is given in field . | |
field [b] | string or array, array of arrays of strings | required | The field to rename, if a new field name is given in as . From v1.106.0, multiple fields can be given using an array of old/new field name pairs: [[oldName1,newName1], [oldName2,newName2]] . | |
[a] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscalerename("value")
and:
logscalerename(field="value")
These examples show basic structure only.
Old fields are are removed from the event stream which can add overhead during processing. Copying to a new field using:
logscale
newfield := oldfield
Is more efficient, but retains the old field in the event set.