logstash filter for metricbeat

Question

I'm trying to rename a process metric data (metricbeat input) using logstash-filter-alter condrewrite option

filter {
  if [metricset][name] == "process" {
    alter {
      condrewrite => ["system.process.name", "php", "queue"]
    }
  }
}

But it doesn't work. I'm not sure if the problem is with the if statement or the condrewrite statement. I'm using ELK stack 5.5.2

Answer 1

This should work:

filter {
  alter {
      condrewrite => ["[system][process][name]", "php", "queue"]
  }
}