SNC Cribl MCP

{ "id": "rename", "schema": { "type": "object", "title": "", "properties": { "baseFields": { "title": "Parent fields", "description": "Fields whose children will inherit the Rename fields and Rename expression operations. Supports wildcards. If empty, only top-level fields will be renamed.", "type": "array", "items": { "type": "string" } }, "rename": { "title": "Rename fields", "description": "Set of key-value pairs to rename fields, where key is the current name and value is the new name. Does not support internal fields.", "type": "array", "items": { "type": "object", "required": ["currentName", "newName"], "properties": { "currentName": { "type": "string", "title": "Current Name", "description": "Name of the field to rename. Literal identifiers must be quoted.", "pattern": "^(?!__).+", "errorMessage": { "pattern": "Must not be an internal field." } }, "newName": { "type": "string", "title": "New Name", "description": "The name the field will be renamed to. Literal identifiers must be quoted.", "pattern": "^(?!__).+", "errorMessage": { "pattern": "Must not be an internal field." } } } } }, "renameExpr": { "title": "Rename expression", "description": "Optional JavaScript expression whose returned value will be used to rename fields. Use the 'name' and 'value' global variables to access field names/values. Example: `name.startsWith('data') ? name.toUpperCase() : name`. You can access other field values via __e.<fieldName>.", "type": "string", "jsExpression": true, "renameExpr": true }, "wildcardDepth": { "type": "integer", "title": "Parent field wildcard depth", "description": "For wildcards specified in Parent fields, sets the maximum depth within events to match and rename fields. Enter `0` to match only top-level fields. Defaults to `5` levels down.", "default": 5, "minimum": 0 } } } }