This function renames one or more fields.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]  The new name of the field; it is used when a single field name is given in field.
field[b]string or array, array of arrays of stringsrequired  The field to rename, if a new field name is given in as. From v1.106.0, multiple fields can be given using an array of old/new field name pairs: [[oldName1,newName1], [oldName2,newName2]].

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Note

When a field is renamed to a field that already exists, the existing field and its content is overwritten by the new field. The same happens when the field is renamed through field aliasing.

Old fields are removed from the event stream which can add overhead during processing. Copying to a new field using:

logscale
newfield := oldfield

is more efficient, but retains the old field in the event set.

rename() Examples

To rename just one field use the as parameter; for example, rename field BadName to GoodName:

logscale
rename(field=BadName, as=GoodName)

Or you can rename BadName to GoodName using assignment syntax:

logscale
GoodName := rename(BadName)