# Add\_field never replace my field

**URL:** <https://discuss.elastic.co/t/add-field-never-replace-my-field/136074>\
**Category:** Logstash\
**Created:** [June 15, 2018, 9:55am UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074 "2018-06-15T09:55:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [June 15, 2018, 9:55am UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074/1 "2018-06-15T09:55:59Z")

</div>

Hello

I would to like to know why my "add\_field" option doesn"t replace my "NEWFIELD" field ? :

```
  if ([ID2] == "000003")
  {
    grok
    {
      match => { "DESCRIPTION" => ["%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:RESTE}"] }
    }
    mutate 
    {
      copy => { "DATE_BATCH" => "ESSAI" }
      #DATE_BATCH is correctly copied because ESSAI = DATE_BATCH
    }
  }
  else
  {
    mutate 
    {
      add_field => { "NEWFIELD" => "%{[ESSAI]}" }
    }
  }

```

When I go to see my "NEWFIELD" field in Kibana :

![image](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5fff63139d4939a83e31812162e3bbe47f8472b3.png)  
... NEWFIELD = %{[ESSAI]}

Why it isn't replaced ??  
Thx 😃

---

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [June 15, 2018, 12:26pm UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074/2 "2018-06-15T12:26:22Z")

</div>

Why do you have %{[ESSAI]} with the square brackets? That may be messing it up. Try removing the square brackets so it looks like %{ESSAI}. It should look like this:

```
mutate 
{
  add_field => "NEWFIELD" => "%{ESSAI}" 
}
```

---

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [June 15, 2018, 12:31pm UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074/3 "2018-06-15T12:31:28Z")

</div>

I tried and .. same result :

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1ef0c34a79660e2465b7d746f2e73d55fc85909d.png)

rubydebug of one event :

`"NEWFIELD" => "%{ESSAI}"`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 15, 2018, 1:39pm UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074/4 "2018-06-15T13:39:20Z")

</div>

If you get `%{ESSAI}` it means the ESSAI field wasn't set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2018, 1:39pm UTC](https://discuss.elastic.co/t/add-field-never-replace-my-field/136074/5 "2018-07-13T13:39:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.