# Can't modify field after KV filter v6.3

**URL:** <https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354>\
**Category:** Logstash\
**Created:** [August 28, 2018, 1:33pm UTC](https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354 "2018-08-28T13:33:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ryannelle](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@ryannelle](https://discuss.elastic.co/u/ryannelle)\
**Post date:** [August 28, 2018, 1:33pm UTC](https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354/1 "2018-08-28T13:33:09Z")

</div>

Here is my sample data  
_msg=key,value key2,value1 **key3,value2,value3** key4,value4_

My kv filter works and I end up with the result below

```auto
"toplvl.midlvl" = { 
"key" => "value",
"key2" => "value1",
"key3" => "value2,value3",
"key4" => "value4"
}

```

So now I want to modify the value in key3 and remove value2 and the comma because I don't care about them. I just want value3 in that field.

I think I need to use gsub here

> Blockquote **gsub Match a regular expression against a field value and replace all matches with a replacement string.**

```auto
mutate { gsub => ["[toplvl][midlvl][key3]", "*,", "" ] }

```

It's not doing anything to the field  
I even tried a rename of the field and that didn't work either.  
I feel like I am not calling the field correctly but not sure why.

Please let me know if there is another way or if I am doing this incorrectly.  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 28, 2018, 6:44pm UTC](https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354/2 "2018-08-28T18:44:44Z")

</div>

I'd try to use `[toplvl.midlvl][key3]` to reference that field. Also, your regexp is wrong. Use e.g. `.*,` instead.

---

<div class="post-metadata">

**Author:** ![ryannelle](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@ryannelle](https://discuss.elastic.co/u/ryannelle)\
**Post date:** [August 28, 2018, 7:15pm UTC](https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354/3 "2018-08-28T19:15:59Z")

</div>

Thank you !!!.

That did the trick.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2018, 7:16pm UTC](https://discuss.elastic.co/t/cant-modify-field-after-kv-filter-v6-3/146354/4 "2018-09-25T19:16:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.