# Can't update or replace with a string value
**URL:** https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408
**Category:** Logstash
**Created:** [May 16, 2019, 1:34pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408 "2019-05-16T13:34:59Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Arnolin](https://discuss.elastic.co/u/Arnolin)
#### Post date: [May 16, 2019, 1:34pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/1 "2019-05-16T13:34:59Z")
Hello,
I have a problem, as said in the title i can't mutate a value from int to string.
I have the following line of log :
```
name,24/02/19,12345,123456
```
12345 is a number of hour and i want to convert it in Day(s), Month(s) etc...
i have the following code (i tryed with both update and replace):
```
mutate {
convert => { "rétention" => "string" }
}
mutate {
replace => { "rétention" => "1 jour" }
}
```
In kibana only the 1 appear, i tried with one and then there is nothing
I don't understand what i'm missing or what i'm doing wrong
In advance thanks for your help
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 2:48pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/2 "2019-05-16T14:48:55Z")
> [@Arnolin](#):
>
> 12345 is a number of hour and i want to convert it in Day(s), Month(s) etc...
You can convert hours to days using
```
ruby { code => 'event.set("someField", event.get("someField").to_f/24)' }
```
I am not sure what it means to convert it to months.
---
### Author:  [@Arnolin](https://discuss.elastic.co/u/Arnolin)
#### Post date: [May 16, 2019, 2:56pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/3 "2019-05-16T14:56:29Z")
for exemple 24 is a day, 168 is a week, 8760 is a year etc...
I have only 8 fixed value
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 3:17pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/4 "2019-05-16T15:17:19Z")
Right, but a month is a variable length of time. If you only want to days you can use the code I wrote. If you do not care about DST you can do much the same for weeks and years.
---
### Author:  [@Arnolin](https://discuss.elastic.co/u/Arnolin)
#### Post date: [May 17, 2019, 8:00am UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/5 "2019-05-17T08:00:17Z")
I don't care about DST, and i think you misunderstood me, this value is used in the legend of my graph and i want to display "1 day" or "1 year". I just want to know how to update (or replace) a field with a string value.
Anyways thanks for your help
( in my case amonth is always 30 day so it's not a problem)
To give more details i want to do something like this
```
if [rétention] == "24" {
mutate {
replace => { 'rétention' => "1 day" }
}
}
if [rétention] == "168" {
mutate {
replace => { 'rétention' => "1 week" }
}
}
.....
if [rétention] == "87600" {
mutate {
replace => { 'rétention' => "10 years" }
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 17, 2019, 11:55am UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/6 "2019-05-17T11:55:22Z")
If you have a fixed set of values you want to replace then a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter would be more compact.
---
### Author:  [@Arnolin](https://discuss.elastic.co/u/Arnolin)
#### Post date: [May 17, 2019, 1:21pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/7 "2019-05-17T13:21:04Z")
I tried with translate but it does not work. I have the following code:
```
mutate {
add_field => { "rétentionC" => "rétention" }
}
mutate {
convert => { "rétentionC" => "string" }
}
translate {
field => "rétention"
destination => "rétentionC"
dictionary => {
"24" => "1 jour"
"168" => "1 semaine"
"720" => "1 mois"
"960" => "40 jours"
"2160" => "3 mois"
"8760" => "1 année"
"26280" => "3 années"
"87600" => "40 jours"
}
fallback => "rétention invalide"
}
```
but my field still have the value "rétention"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 17, 2019, 2:35pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/8 "2019-05-17T14:35:57Z")
The first mutate copies the literal string "rétention" into a field called "rétentionC". Did you mean to copy the value of the [rétention] field?...
mutate { add\_field =\> { "rétentionC" =\> "%{[rétention]}" }
I do not understand the point of the second mutate either. You are modifying a field that will always get overwritten.
The following works
```
input { generator { count => 1 lines => [''] } }
filter {
mutate { add_field => { "rétention" => "8760" } }
translate {
field => "rétention"
destination => "rétentionC"
dictionary => {
"24" => "1 jour"
"168" => "1 semaine"
"720" => "1 mois"
"960" => "40 jours"
"2160" => "3 mois"
"8760" => "1 année"
"26280" => "3 années"
"87600" => "40 jours"
}
fallback => "rétention invalide"
}
}
```
---
### Author:  [@Arnolin](https://discuss.elastic.co/u/Arnolin)
#### Post date: [May 17, 2019, 2:50pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/9 "2019-05-17T14:50:04Z")
> The first mutate copies the literal string "rétention" into a field called "rétentionC". Did you mean to copy the value of the [rétention] field?...
In this case it's only a filler word
> I do not understand the point of the second mutate either. You are modifying a field that will always get overwritten.
i tried to force cast with string, because i tought it was a type problem
Thanks for your solution, i'll try it monday morning.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2019, 2:50pm UTC](https://discuss.elastic.co/t/cant-update-or-replace-with-a-string-value/181408/10 "2019-06-14T14:50:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.