This function renames one or more fields.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]  The new name of the field; it is used when a single field name is given in field.
field[b]string or arrayrequired  The field to rename, if a new field name is given in as. From v1.106.0, multiple fields can be given using an array of old/new field name pairs: [oldName,newName].

[a] Optional parameters use their default value unless explicitly set.

[b] The argument name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Old fields are are removed from the event stream which can add overhead during processing. Copying to a new field using:

logscale
newfield := oldfield

Is more efficient, but retains the old field in the event set.

rename() Examples

To rename just one field use the as parameter; for example, rename field BadName to GoodName:

logscale
rename(field=BadName, as=GoodName)

Or you can rename BadName to GoodName using assignment syntax:

logscale
GoodName := rename(BadName)