# Add Field In Alter Plugin Not Showing values inside field instead showing field name

**URL:** <https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492>\
**Category:** Logstash\
**Created:** [November 26, 2019, 11:35am UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492 "2019-11-26T11:35:15Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 11:35am UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/1 "2019-11-26T11:35:15Z")

</div>

Hi have created the following code using Alter plugin because the mutate plugin won't work in my logstash server.

```
filter {
 date{match => ["REQUEST_TIMESTAMP","yyyy-MM-dd HH:mm:ss"]}
  alter {
      add_field => { "[location1][lat]" => "%%{[A_LATITUDE]}" }
      add_field => { "[location1][lon]" => "%%{[A_LONGITUDE]}" }
        }
        }

```

Using the above code, instead of getting the the Lat and Lon values in the field location1, I am getting the following in the logstash output,

```
"location1" => {
    "lat" => "%%{[A_LATITUDE]}",
    "lon" => "%%{[A_LONGITUDE]}"
}

```

**What am I doing wrong in the filter plugin?**

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 1:29pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/2 "2019-11-26T13:29:22Z")

</div>

> [@Ramya\_Tanikanti](#):
>
> add\_field =\> { "[location1][lat]" =\> "%%{[A\_LATITUDE]}" }

A sprintf reference should use a single %. So that should be "%{[A\_LATITUDE]}"

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 1:31pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/3 "2019-11-26T13:31:19Z")

</div>

Yes @Badger, I tried that too, still the same.

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 1:34pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/4 "2019-11-26T13:34:17Z")

</div>

Also getting this error,

```
"error"=>{"type"=>"mapper_parsing_exception", 
"reason"=>"failed to parse field [location1] of type 
[geo_point]", "caused_by"=>{"type"=>"parse_exception", 
"reason"=>"[lat] and [lon] must be valid double values", 
"caused_by"=>{"type"=>"number_format_exception", 
"reason"=>"For input string: \"%{[A LONGITUDE]}\""}}}}}}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 1:35pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/5 "2019-11-26T13:35:53Z")

</div>

That would suggest the source field does not exist.

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 1:38pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/6 "2019-11-26T13:38:16Z")

</div>

> [@Badger](#):
>
> That would suggest the source field does not exist.

@Badger what does that mean?

A view of Logstash:  
 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45b8fe241341b7d41c6c8937a0193fe00e0790b9.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 1:46pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/7 "2019-11-26T13:46:39Z")

</div>

You are trying to reference the value of a field called A\_LONGITUDE, but that field does not exist.

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 2:02pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/8 "2019-11-26T14:02:36Z")

</div>

@Badger, But it is present 😟

![issue](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7ce1ad8ae25efe0a5504856a122dc9dcdf8bf0d8.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 2:29pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/9 "2019-11-26T14:29:56Z")

</div>

Is it possible you are referencing it before it is created?

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 2:38pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/10 "2019-11-26T14:38:55Z")

</div>

@Badger I am creating a PUT mapping in Kibana dev tools as follows,

```
PUT test-connectivity-ebond
{
"mappings": {
"properties": {
  "location1":{
    "type": "geo_point"
  },
  "location2":{
    "type": "geo_point"
  }
}
}
}

```

Then coming to Logstash,

```
filter {

   alter {
      add_field => { "[location1][lat]" => "%{[A_LATITUDE]}" }
      add_field => { "[location1][lon]" => "%{[A_LONGITUDE]}" }
  }

  alter{
     add_field => { "[location2][lat]" => "%{[B_LATITUDE]}" }
     add_field => { "[location2][lon]" => "%{[B_LONGITUDE]}" }
 }

   date {
   match => ["REQUEST_TIMESTAMP", "yyyy-MM-dd HH:mm:ss"]
  }

}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 2:42pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/11 "2019-11-26T14:42:58Z")

</div>

How does the [A\_LONGITUDE] field get created?

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 2:50pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/12 "2019-11-26T14:50:44Z")

</div>

@Badger, it is a column from the database.

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 26, 2019, 2:52pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/13 "2019-11-26T14:52:43Z")

</div>

@Badger, so I have Lat and Lon values in two separate columns called A\_LATITUDE and A\_LONGITUDE similarly two other columns called B\_LATITUDE and B\_LONGITUDE.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2019, 4:16pm UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/14 "2019-11-26T16:16:51Z")

</div>

I cannot explain that.

---

<div class="post-metadata">

**Author:** ![Ramya\_Tanikanti](https://avatars.discourse-cdn.com/v4/letter/r/9de053/32.png) [@Ramya\_Tanikanti](https://discuss.elastic.co/u/Ramya_Tanikanti)\
**Post date:** [November 27, 2019, 4:20am UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/15 "2019-11-27T04:20:33Z")

</div>

@Badger, got it solved using the Mutate Filter Plugin! Thank you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 25, 2019, 4:20am UTC](https://discuss.elastic.co/t/add-field-in-alter-plugin-not-showing-values-inside-field-instead-showing-field-name/209492/16 "2019-12-25T04:20:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.