# Add\_field and then gsub in one pass is not supported?

**URL:** <https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206>\
**Category:** Logstash\
**Created:** [October 4, 2016, 6:32pm UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206 "2016-10-04T18:32:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevinpauli](https://avatars.discourse-cdn.com/v4/letter/k/c37758/32.png) [@kevinpauli](https://discuss.elastic.co/u/kevinpauli)\
**Post date:** [October 4, 2016, 6:32pm UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206/1 "2016-10-04T18:32:59Z")

</div>

Logstash version 2.2.4 on ubuntu 14.04

I have an existing `@timestamp` field in some documents, with values like `"2016-09-29T05:25:52.000Z"`. I would like to extract just the "day" portion of the timestamp and store it in a new field called `day`, e.g. `"2016-09-29"`. I would like to do this in one pass.

If I try this:

```
filter {
   mutate {
      add_field => { "day" => "%{@timestamp}"}
      convert => { "day" => "string" }
      gsub => ["day", "T.*", ""]
   }
}

```

Then the output is `"day" => "2016-09-29T05:25:52.000Z"`. The add\_field and convert worked, but the gsub did not work.

However if I do this in two passes, i.e. run this:

```
filter {
   mutate {
      add_field => { "day" => "%{@timestamp}"}
      convert => { "day" => "string" }
   }
}

```

And then when all documents updated, run this:

```
filter {
   mutate {
      gsub => ["day", "T.*", ""]
   }
}

```

Then it works: `"day" => "2016-09-29"`

Is there some kind of optimization going on that tries to execute things in parallel? Perhaps it is trying to do the gsub _before_ the add\_field and convert is finished? I'm no logstash expert but I would think it would behave more or less like an imperative, sequentially executed script.

---

<div class="post-metadata">

**Author:** ![kevinpauli](https://avatars.discourse-cdn.com/v4/letter/k/c37758/32.png) [@kevinpauli](https://discuss.elastic.co/u/kevinpauli)\
**Post date:** [October 4, 2016, 6:38pm UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206/2 "2016-10-04T18:38:35Z")

</div>

nevermind, this works:

```
filter {
        mutate {
          add_field => { "day" => "%{@timestamp}"}
        }
        mutate{
          convert => { "day" => "string" }
        }
        mutate {
          gsub => ["day", "T.*", ""]
        }
}

```

I guess it does do operations inside mutate in parallel, but mutate blocks in sequence

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2016, 6:09am UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206/3 "2016-10-05T06:09:17Z")

</div>

> I guess it does do operations inside mutate in parallel

Well, not in parallel but also not in the order listed in the configuration file. If you care about the order you need to use separate filters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206/4 "2017-07-06T04:35:46Z")

</div>

Closed on July 6, 2017, 4:35am UTC