# Conditional mutate of values after kv{} function

**URL:** <https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343>\
**Category:** Logstash\
**Created:** [August 8, 2019, 2:02am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343 "2019-08-08T02:02:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhijitkottur](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@abhijitkottur](https://discuss.elastic.co/u/abhijitkottur)\
**Post date:** [August 8, 2019, 2:02am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343/1 "2019-08-08T02:02:48Z")

</div>

`2019-08-08 08:41:47.919 INFO [-,94a0b008e1c6714e,94a0b008e1c6714e,true] 6 --- [io-8164-exec-10] a.c.f.w.r.c.controllers.VFSController : [eventType:DELETE_FILES] [storageName:playout-dr] [deleteResult:FILE_NOT_EXISTS] [numeric_deleteCount:0]`

```
kv {
    source => "keyValuePairs"
    field_split => " "
    trim_key => "\["
    trim_value => "\]"
    value_split => ":"
    remove_field => ["keyValuePairs"]
  }

```

The key-value pairs are getting extracted correctly. However, all values are being pushed as `text`. I want to apply a conditional mutate on the values something like this

```
if key starts with 'numeric_' then
mutate {
  convert => {
    "value" => "integer"
  }
}

```

This is because I want to apply aggregation functions on the field on Kibana which supports only numeric data.

Please advise if this is possible and if it is share the code snippet for the conditional mutation.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 8, 2019, 8:13am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343/2 "2019-08-08T08:13:23Z")

</div>

You could do that with Ruby:

```
ruby {
  code => "event.to_hash.each { |k, v | event.set(k, v.to_i) if k =~ /^numeric_/ }"
}
```

---

<div class="post-metadata">

**Author:** ![abhijitkottur](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@abhijitkottur](https://discuss.elastic.co/u/abhijitkottur)\
**Post date:** [August 9, 2019, 3:48am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343/3 "2019-08-09T03:48:15Z")

</div>

Thank you for the response.. But where do I put the mutate code block? Like this?

```
ruby {
  code => "event.to_hash.each { |k, v | event.set(k, v.to_i) if k =~ /^numeric_/ }" 
  mutate {
    convert => {
      "value" => "integer"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 9, 2019, 5:50am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343/4 "2019-08-09T05:50:46Z")

</div>

The line of Ruby code already says “Loop through every field of the event and overwrite the original value with the integer value of the current field (v.to\_i) if the key (k) starts with 'numeric\_'”  
v.to\_i is the conversion. There is nothing more to add 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2019, 5:51am UTC](https://discuss.elastic.co/t/conditional-mutate-of-values-after-kv-function/194343/5 "2019-09-06T05:51:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.