select_renameΒΆ
select_rename() command renames specified fields in stream. Keeps field order and other fields.
| select_rename(newName:field, name2:field2, ...)
Example.
1 2 | dual(3)
| select(t, ip, s, f)
|
| t | ip | s | f |
|---|---|---|---|
| 2020-09-23 15:16:42.540 +0300 | 0.0.0.0 | 0ho0 | 0.0 |
| 2020-09-23 15:16:42.541 +0300 | 0.0.0.1 | 1ho1 | 1.0 |
| 2020-09-23 15:16:42.542 +0300 | 0.0.0.2 | 2ho2 | 2.0 |
1 2 3 | dual(3)
| select(t, ip, s, f)
| select_rename(src_addr:ip, value:f)
|
| t | src_addr | s | value |
|---|---|---|---|
| 2020-09-23 15:14:42.947 +0300 | 0.0.0.0 | 0ho0 | 0.0 |
| 2020-09-23 15:14:42.948 +0300 | 0.0.0.1 | 1ho1 | 1.0 |
| 2020-09-23 15:14:42.949 +0300 | 0.0.0.2 | 2ho2 | 2.0 |