<p>I'm trying to figure out how can a rename a field (or create a new field with the same value ) with Fluentd</p>

<p>Like:</p>

<pre><code>agent: Chrome ....
</code></pre>

<p>To:</p>

<pre><code>agent: Chrome
user-agent: Chrome
</code></pre>

<p>but for a specific type of logs, like <code>**nginx**</code>.</p>

<p>I'm trying to user <code>record_reformer</code> but it doesn't apply for a second filter:</p>

<pre><code>&lt;filter kubernetes.**.nginx-ingress-controller-**.log&gt;
  @type parser
  format /^(?&lt;host&gt;[^ ]*) (?&lt;domain&gt;[^ ]*) \[(?&lt;x_forwarded_for&gt;[^\]]*)\] (?&lt;server_port&gt;[^ ]*) (?&lt;user&gt;[^ ]*) \[(?&lt;time&gt;[^\]]*)\] "(?&lt;method&gt;\S+[^\"])(?: +(?&lt;path&gt;[^\"]*?)(?: +\S*)?)?" (?&lt;code&gt;[^ ]*) (?&lt;size&gt;[^ ]*)(?: "(?&lt;referer&gt;[^\"]*)" "(?&lt;agent&gt;[^\"]*)")? (?&lt;request_length&gt;[^ ]*) (?&lt;request_time&gt;[^ ]*) (?:\[(?&lt;proxy_upstream_name&gt;[^\]]*)\] )?(?&lt;addr&gt;[^ ]*) (?&lt;response_length&gt;[^ ]*) (?&lt;response_time&gt;[^ ]*) (?&lt;status&gt;[^ ]*)$/
  time_format %d/%b/%Y:%H:%M:%S %z
  key_name log
  types server_port:integer,code:integer,size:integer,request_length:integer,request_time:float,upstream_response_length:integer,upstream_response_time:float,upstream_status:integer
  reserve_data true
&lt;/filter&gt;

&lt;filter kubernetes.**&gt;
    @type kubernetes_metadata
&lt;/filter&gt;

&lt;filter kubernetes.**&gt;
 @type grep
 &lt;regexp&gt;
     key $.kubernetes.labels.fluentd
     pattern true
 &lt;/regexp&gt;
&lt;/filter&gt;

&lt;filter kubernetes.**.deployment-name**&gt;
  @type record_transformer
  &lt;record&gt;
    level ${record["Level"]}
  &lt;/record&gt;
&lt;/filter&gt;

&lt;match kubernetes.**&gt;
  @type elasticsearch
  include_tag_key true
  host "#{ENV['OUTPUT_HOST']}"
  port "#{ENV['OUTPUT_PORT']}"
  scheme "#{ENV['OUTPUT_SCHEME']}"
  reload_connections true
  logstash_format true
&lt;/match&gt;

&lt;match kubernetes.**&gt;
  @type record_reformer
  remove_keys log,kubernetes
  tag mytag.generic
  &lt;record&gt;
    name ${record['kubernetes']['labels']['app']}
    namespace ${record['kubernetes']['namespace_name']}
  &lt;/record&gt;
&lt;/match&gt;

&lt;match kubernetes.**api**&gt;
  @type record_reformer
  remove_keys log,kubernetes
  tag mytag.api
  &lt;record&gt;
    user_agent ${record['req']['headers']['user-agent']}
  &lt;/record&gt;
&lt;/match&gt;
</code></pre>

<p>In such a case it doesn't send the logs for the <code>mytag.generic</code></p>

Idir Ouhab Meskine
<p>I have a very similar use case, and like @embik said, using record_transformer seems like a more fit choice. In my case I'm trying to downcase a key in a json record fluentd is going through, here's the conf - </p>

<pre><code>&lt;filter kubernetes.**.deployment-name**&gt;
  @type record_transformer
  &lt;record&gt;
    level ${record["Level"]}
  &lt;/record&gt;
&lt;/filter&gt;
</code></pre>

<p>Hope that helps.</p>
