# Adding field after mutate rename statement
**URL:** https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860
**Category:** Logstash
**Created:** [May 30, 2018, 10:50am UTC](https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860 "2018-05-30T10:50:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ssi](https://discuss.elastic.co/u/ssi)
#### Post date: [May 30, 2018, 10:50am UTC](https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860/1 "2018-05-30T10:50:09Z")
Hi is it possible to add "post processing" to an mutate operation within the same filter?
i have a filter that works but i want to add a field if specific conditions are full filled, to mark the logged event as a possible indicator of compromise.
the log file is sysmon output with event id 1
```auto
if [event_id] == 1 {
mutate {
add_field => { "action" => "processcreate" }
rename => {
"[event_data][CommandLine]" => "process_command_line"
"[event_data][CurrentDirectory]" => "process_current_directory"
"[event_data][ParentImage]" => "process_parent_path"
"[event_data][ParentCommandLine]" => "process_parent_command_line"
"[event_data][IntegrityLevel]" => "process_integrity_level"
"[event_data][LogonGuid]" => "user_logon_guid"
"[event_data][ParentProcessGuid]" => "process_parent_guid"
"[event_data][ParentProcessId]" => "process_parent_id"
"[event_data][TerminalSessionId]" => "user_terminal_session_id"
"[event_data][FileVersion]" => "file_version"
"[event_data][Description]" => "file_description"
"[event_data][Product]" => "file_product"
"[event_data][Company]" => "file_company"
}
gsub => ["process_parent_guid","[{}]",""]
gsub => ["user_logon_guid","[{}]",""]
}
```
now the IOC data i want to add is the following
IOC
```auto
if [event_id] == 1 {
and ( ([event_data][process_parent_path] =~ /(?i)(OUTLOOK.EXE)/ ) or (##if i put it after the renaming do i have to use [process_parent_path] or can i just use [parentImage] still?###)
([event_data][ParentImage] =~ /(?i)(OUTLOOK.EXE)/
and ([event_data][Image] =~ /(?i)(iexplore.exe|chrome.exe|firefox.exe|edge.exe)/ ) )
{
mutate {
add_field => { "IOC" => "Browser Launched From Outlook Sysmon 1" } }}
}
```
How do i add this mutate statement into the existing event\_id:1 filter ? this must be possible to do in an elegant way?
i cant get it to parse the IOC section if i but the mutate either after the first mutate, meaning within the IF statement nor if i place it within the mutate section. individually the configs work fine?
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [May 30, 2018, 11:02am UTC](https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860/2 "2018-05-30T11:02:20Z")
I think you can use a nested if condition
```auto
if [event_id] == 1 {
mutate {
add_field => { "action" => "processcreate" }
rename => {
"[event_data][CommandLine]" => "process_command_line"
"[event_data][CurrentDirectory]" => "process_current_directory"
"[event_data][ParentImage]" => "process_parent_path"
"[event_data][ParentCommandLine]" => "process_parent_command_line"
"[event_data][IntegrityLevel]" => "process_integrity_level"
"[event_data][LogonGuid]" => "user_logon_guid"
"[event_data][ParentProcessGuid]" => "process_parent_guid"
"[event_data][ParentProcessId]" => "process_parent_id"
"[event_data][TerminalSessionId]" => "user_terminal_session_id"
"[event_data][FileVersion]" => "file_version"
"[event_data][Description]" => "file_description"
"[event_data][Product]" => "file_product"
"[event_data][Company]" => "file_company"
}
gsub => ["process_parent_guid","[{}]",""]
gsub => ["user_logon_guid","[{}]",""]
}
if [event_data][process_parent_path] =~ /(?i)(OUTLOOK.EXE)/ and [event_data][Image] =~ /(?i)(iexplore.exe|chrome.exe|firefox.exe|edge.exe)/ {
mutate {
add_field => { "IOC" => "Browser Launched From Outlook Sysmon 1" }
}
}
}
```
---
### Author:  [@ssi](https://discuss.elastic.co/u/ssi)
#### Post date: [May 30, 2018, 1:03pm UTC](https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860/3 "2018-05-30T13:03:55Z")
super i works!
this is the working config
if [process\_parent\_name] =~ /(?i)(OUTLOOK.EXE)/ and [process\_name] =~ /(?i)(iexplore.exe|chrome.exe|firefox.exe|edge.exe)/ {
mutate {
add\_field =\> { "IOC" =\> "Browser Launched From Outlook Sysmon 1" }
}
}
got rid of the [event\_data] tag and it works thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2018, 1:04pm UTC](https://discuss.elastic.co/t/adding-field-after-mutate-rename-statement/133860/4 "2018-06-27T13:04:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.