# Can I use replace to add a field?

**URL:** <https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625>\
**Category:** Logstash\
**Created:** [January 9, 2019, 9:38pm UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625 "2019-01-09T21:38:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_S](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@Peter\_S](https://discuss.elastic.co/u/Peter_S)\
**Post date:** [January 9, 2019, 9:38pm UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625/1 "2019-01-09T21:38:28Z")

</div>

Hello,

I'm trying to write a mutation to describe a service name based on the port given. Suricata is feeding the data to logstash, and it currently doesn't have a very good way of describing services unless it's in the predefined list. I'd like to still have that information available instead of getting nothing or getting a "failed" entry.

```auto
<snip>
    # Is app_proto set or failed?
    if ![app_proto] or [app_proto] == "failed" {
        if [src_port] and [dest_port] {
            # Set variable
            if [src_port] < [dest_port] {
                mutate { add_field => { "[@metadata][port]" => "%{src_port}" } }
            }
            else if [dest_port] < [src_port] {
                mutate { add_field => { "[@metadata][port]" => "%{dest_port}" } }
            }
            # FTP
            if [@metadata][port] == "20" or [@metadata][port] == "21" {
                mutate { replace => { "app_proto" => "ftp(%{[@metadata][port]})" } }
            }
            # SSH
            else if [@metadata][port] == "22" {
                mutate { replace => { "app_proto" => "ssh(%{[@metadata][port]})" } }
            }
            # Telnet
            else if [@metadata][port] == "23" {
                mutate { replace => { "app_proto" => "telnet(%{[@metadata][port]})" } }
            }
<snip>

```

Do I have to do a separate check for whether `[app_proto]` is set? I'm using `replace` currently, but I'm not sure if it will create the `[app_proto]` field if it doesn't already exist. Otherwise, I think I'll have to `remove_field` first, then `add_field`.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 9, 2019, 10:03pm UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625/2 "2019-01-09T22:03:29Z")

</div>

> [@Peter\_S](#):
>
> I'm not sure if it will create the `[app_proto]` field if it doesn't already exist

It will.

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [January 12, 2019, 5:28am UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625/3 "2019-01-12T05:28:57Z")

</div>

@Peter_S, as you are collecting Suricata data, might I suggest that you consider this...

> **[robcowart/synesis\_lite\_suricata](https://github.com/robcowart/synesis_lite_suricata)**
>
> Suricata IDS/IPS log analytics using the Elastic Stack. - robcowart/synesis\_lite\_suricata

It uses filebeat to tail Suricata's EVE log and send the data to Logstash, which then performs a lot of processing and enrichment of the data (including the service name mapping you are looking to achieve). The reason for using Filebeat and Logstash together, is to allow multiple Suricata instances to report into a single central collection point.

It also looks like you are trying to figure out the client and server end of the connections by looking for the lowest port number. The integration above also does the same, but with a bit more sophisticated method.

---

<div class="post-metadata">

**Author:** ![Peter\_S](https://avatars.discourse-cdn.com/v4/letter/p/8edcca/32.png) [@Peter\_S](https://discuss.elastic.co/u/Peter_S)\
**Post date:** [January 14, 2019, 4:53pm UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625/4 "2019-01-14T16:53:33Z")

</div>

@rcowart

I've looked at this, and it does look great, but you only seem to be compatible with Elastic Stack 6.2. We're on 6.5, and we rather like the extra features we get with it over 6.2. If you update to supporting newer Elastic Stack versions, let me know.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2019, 4:53pm UTC](https://discuss.elastic.co/t/can-i-use-replace-to-add-a-field/163625/5 "2019-02-11T16:53:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.