Scenario 3: Deleting and Renaming Fields Using the e_drop_fields and e_rename Functions

Generally, you are advised to use the e_compose function to combine multiple functions.

Example:

• Raw log

  {"content":"123",
  "age":23,
  "name":"twiss",
  "IdNumber":1
  }

• Processing rule: checks whether the value of the content field is 123. If the condition is met, the age and name fields will be deleted and the IdNumber field will be renamed to Id.

  e_if(e_search("content==123"),e_compose(e_drop_fields("age|name"), e_rename("IdNumber", "Id")))

• Processing result

  {
  	"Id": 1,
  	"content": 123
  }