Skip to main content

The Rename Function

Description​

The Rename Function is designed to change fields' names or reformat their names (e.g., by normalizing names to camelcase). You can use Rename to change specified fields (much like the Eval Function), or for bulk renaming based on a JavaScript expression (much like the Parser Function).

Compared to these alternatives, the Rename Function offers a streamlined way to alter only field names, without other effects. Let's use Rename to remove any unnecessary prefixes from the field names, to further shrink our events. In the Rename expression field, we'll build a JavaScript expression to match the field names' prefixes (up to the last underscore).

Steps – Adding a Rename Function​

important
  1. Select the Add Function button at the top right.
  2. In the search bar, type rename, and select the Rename Function. It will be added at the bottom of the Pipeline.
  3. Add the expression shown below to the new Function's Rename expression field, and select Save.
name.replace(/_raw_\w+_/,'')

Your Rename Function should now look something like this: Rename1

The Rename Expression above looks for all field names with a prefix of _raw_ and matches to the last _ character replacing the suffix with nothing, the empty quotes at the end of the expression. You could have used some_new_prefix if you wanted a different prefix.

Results​

The top-level fields have been renamed, and are now much shorter and easier to read.

Rename2

Let's take all these fields and put them back into the _raw as Key=Value fields, using the Serialize Function.