# Bug or my usage of Mutate filter?

**URL:** https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202
**Category:** Logstash
**Created:** [February 8, 2016, 4:22pm UTC](https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202 "2016-02-08T16:22:24Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![LeeSyd](https://avatars.discourse-cdn.com/v4/letter/l/8dc957/32.png) [@LeeSyd](https://discuss.elastic.co/u/LeeSyd)
#### Post date: [February 8, 2016, 4:22pm UTC](https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202/1 "2016-02-08T16:22:24Z")

</div>

Not sure if this is a bug or I'm not getting the syntax right with the Mutate filter but I'm trying to configure Topbeat and mutate the field name to match others I already have in elasticsearch.

I've got:

```
                    rename => {
                            "host" => "server"
                    }

```

which works successfully but changing it to:

```
                    rename => {
                            "beat.hostname" => "server"
                    }

```

does not - nothing with a "." in the field name. The same issue if I try to add a new field and assign value from an existing field with a "." in the name:

```
                    add_field => {
                            "server" => "%{beat.hostname}"
                    }

```

I've tried escaping with a \ but that has not worked. Am I missing something?

Thanks,

Lee

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 9, 2016, 7:31pm UTC](https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202/2 "2016-02-09T19:31:17Z")

</div>

See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references) for which syntax to use for subfields.

---

<div class="post-metadata">

### Author: ![LeeSyd](https://avatars.discourse-cdn.com/v4/letter/l/8dc957/32.png) [@LeeSyd](https://discuss.elastic.co/u/LeeSyd)
#### Post date: [February 10, 2016, 12:02pm UTC](https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202/3 "2016-02-10T12:02:24Z")

</div>

Great - that's sorted it, thank you.

Code is now:

```
                rename => {
                        "[beat][hostname]" => "server"
                }

```

or

```
                add_field => [
                        "server" => "%{[beat][hostname]}"
                }

```

Thanks for the guidance,

Lee

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/bug-or-my-usage-of-mutate-filter/41202/4 "2017-07-06T05:12:17Z")

</div>