Can you have multiple actions in one single mutate block?

Can you have multiple actions in one single mutate block or do you need a mutate block for each:

mutate {
  copy => { "server_name" => "syslog_hostname" }
  replace => { "syslog_program" => "_geoip_lookup_failure" }
}

or

mutate {
  copy => { "server_name" => "syslog_hostname" }
}
mutate {
  replace => { "syslog_program" => "_geoip_lookup_failure" }
}

Thanks

Yes, you can. However, mutate performs operations in a fixed order, so sometimes you will need multiple mutate filters to control the order.

1 Like

@Badger I saw the order thing in the docs, but I don't see an explicit mention of multiple actions per block, thank you very much for the clarification!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.