As we have seen in the previous section, the output of the jdbc_streaming filter plugin has some undesired aspects. Our JSON payload needs the following modifications:

• Move the looked-up fields that are under lookupResult directly into the JSON file.
• Combine the latitude and longitude fields under lookupResult as a location field.
• Remove the unnecessary fields.

mutate {
    rename => {"[lookupResult][0][sensorType]" => "sensorType"}
    rename => {"[lookupResult][0][customer]" => "customer"}
    rename => {"[lookupResult][0][department]" => "department"}
    rename => {"[lookupResult][0][buildingName]" => "buildingName"}
    rename => {"[lookupResult][0][room]" => "room"}
    rename => {"[lookupResult][0][floor]" => "floor"}
    rename => {"[lookupResult][0][locationOnFloor]" => "locationOnFloor"}
    add_field => {
      "location" => "%{lookupResult[0]latitude},%{lookupResult[0]longitude}"
    }
    remove_field => ["lookupResult", "headers", "host"]
  }

Let's see how the mutate filter plugin achieves these objectives.