# Change field value within to another value

**URL:** <https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039>\
**Category:** Logstash\
**Created:** [June 22, 2018, 2:28pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039 "2018-06-22T14:28:32Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\
**Post date:** [June 22, 2018, 2:28pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/1 "2018-06-22T14:28:32Z")

</div>

Good day

Could someone please let me know what filter plugin or process I would need to do to change a field value.

By this I mean I have a column that I want to input via csv, I am good and using the filter csv plugin and then the mutate command to change the data\_type.

However my challenge is I have three field values in the data that are basically "field1" , "field2", "field3" but in essence they are the same value that I want to aggregate.

What can I do to change them to the same value at the filter stage, like an if then statement or something?

Appreciate the help 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 22, 2018, 2:34pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/2 "2018-06-22T14:34:21Z")

</div>

This would be a lot easier to answer if you would show us what the event currently looks like

```
output { stdout { codec => rubydebug } }

```

and explain more explicitly what you want to change.

---

<div class="post-metadata">

**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\
**Post date:** [June 22, 2018, 2:50pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/3 "2018-06-22T14:50:53Z")

</div>

Thank you for your response. Essentially this is a not an event its company commission data in csv format. The problem I'm facing is that three field values of the companies are different but they are in essence the same company.

I cannot change the source as we receive it, but I would like to make sense of it before I output to elasticsearch.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 22, 2018, 3:14pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/4 "2018-06-22T15:14:18Z")

</div>

I am still not clear on what your data looks like or what you want to change, but perhaps a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter could help you normalize the naming.

---

<div class="post-metadata">

**Author:** ![SuperK\_1860](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@SuperK\_1860](https://discuss.elastic.co/u/SuperK_1860)\
**Post date:** [June 22, 2018, 5:27pm UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/5 "2018-06-22T17:27:40Z")

</div>

Thank you I believe this might do it. Apologies I could not be clear enough, I will rely the example.

I have one company called ABC, I receive 100s millions of rows of commission statements. Some providers call company ABC, another name like XYZ or DEF. I need to take those values and call it company ABC.

Thank you again.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2018, 7:17am UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/6 "2018-06-26T07:17:10Z")

</div>

Look into the translate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2018, 7:17am UTC](https://discuss.elastic.co/t/change-field-value-within-to-another-value/137039/7 "2018-07-24T07:17:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.