title: Change field name with regex in ElasticSearch metricbeat
body: <p>I'm using the metricbeat system with the graphite module.
  This is the module configuration:</p>
  <pre><code>- module: graphite
    metricsets:
     - server
    protocol: &quot;udp&quot;
    port: 2003
    templates:
     - filter: &quot;*&quot; 
       namespace: &quot;spark_metrics&quot;
       template: &quot;env.job_id.metric*&quot;
       delimiter: &quot;_&quot;
  </code></pre>
  <p>Sometimes I get a metric with a number. The template looks like that:</p>
  <pre><code>env.job_id.number.metric*
  </code></pre>
  <p>I have no idea how to extract that. I also think I can't use the 'rename' processor because it seems there is no regex support. As I said the number is just sometimes there. If it is a specific executor metric then the executor number is being added. I want to extract the executor number to a new tag and I don't want it as part of the metric name.</p>
  <p><a href="https://i.stack.imgur.com/z8snQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/z8snQ.png" alt="enter image description here" /></a></p>
  <p>As you can see the number of the executor is part of the field name. I want to extract it to look like this: <code>graphite.spark_metrics.tag.executor_number = 6</code>.</p>
  <p>And the metric field look like: <code>graphite.spark_metrics.executor_filesystem_file_read_bytes = 0</code></p>
  <p>Does dose someone have any suggestions?</p>