# Add\_field order of execution

**URL:** <https://discuss.elastic.co/t/add-field-order-of-execution/141036>\
**Category:** Logstash\
**Created:** [July 22, 2018, 3:15pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036 "2018-07-22T15:15:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dan\_Markhasin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_markhasin/32/14187_2.png) [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\
**Post date:** [July 22, 2018, 3:15pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036/1 "2018-07-22T15:15:44Z")

</div>

I've noticed that the add\_field operation is executed last - this is not explicitly documented and causes unexpected behavior when doing something like:

> mutate  
> {  
> add\_field =\> {"target" =\> "foo"}  
> add\_field =\> {"[@metadata][source]" =\> "bar"}  
> copy =\> {"[@metadata][source]" =\> "target"}  
> }

The result is "target" =\> "foo" rather than the expected "bar".

Is there any way to change this behavior?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 22, 2018, 3:25pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036/2 "2018-07-22T15:25:20Z")

</div>

> I've noticed that the add\_field operation is executed last - this is not explicitly documented

No, I guess not. The `add_field` docs say "If this filter is successful, add any arbitrary fields to this event" which implies that it executes last.

> Is there any way to change this behavior?

No. Do not rely on the execution order of the options listed in a mutate filter. If there are dependencies between them you need to use multiple mutate filters.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 22, 2018, 3:37pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036/3 "2018-07-22T15:37:55Z")

</div>

> [@Dan\_Markhasin](#):
>
> I've noticed that the add\_field operation is executed last

In addition to decoration being executed last, the order of the mutate specific functions is also fixed, as you will see if you check the source...

> <https://github.com/logstash-plugins/logstash-filter-mutate/blob/9ef63d37a2d67c57aa818c4fb4ef4f21aaa0da3f/lib/logstash/filters/mutate.rb#L248-L253>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2018, 3:51pm UTC](https://discuss.elastic.co/t/add-field-order-of-execution/141036/4 "2018-08-19T15:51:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.