Can you have multiple actions in one single mutate block?

Elastic Stack Logstash
1

Can you have multiple actions in one single mutate block or do you need a mutate block for each:

mutate {
  copy => { "server_name" => "syslog_hostname" }
  replace => { "syslog_program" => "_geoip_lookup_failure" }
}

or

mutate {
  copy => { "server_name" => "syslog_hostname" }
}
mutate {
  replace => { "syslog_program" => "_geoip_lookup_failure" }
}

Thanks

2

Yes, you can. However, mutate performs operations in a fixed order, so sometimes you will need multiple mutate filters to control the order.

3

@Badger I saw the order thing in the docs, but I don't see an explicit mention of multiple actions per block, thank you very much for the clarification!