# Copy/Rename multiple field in the same field + adding multiples field to one field
**URL:** https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264
**Category:** Logstash
**Created:** [June 8, 2021, 8:51am UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264 "2021-06-08T08:51:45Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [June 8, 2021, 8:51am UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/1 "2021-06-08T08:51:46Z")
Hello every body,
I have two question about the mutate filter:
The first one is about adding a0,a1 and a2 fiels that contain the process args to a same field [process][args] (process.args=a0,a1,a2) how i can do it ?
The second one is about renaming multiples field example (gid, sid, uid) with the same name [user][id].
THANKS in advance for the help
Best regard,
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 8, 2021, 6:06pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/2 "2021-06-08T18:06:12Z")
It is really not clear what you are asking. Can you show, using JSON, for example, the before and after of what you want in the two cases?
---
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [June 8, 2021, 9:55pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/3 "2021-06-08T21:55:50Z")
Hello Badger,
Thanks for you reply, I apologize because the question was not clear to you.
For the first question my goal was to have a field (process.args) that concatinate the value of a three fields a0, a2 and a3
The issue was resolved by adding the filter bellow
I puted:
> filter {
> mutate {
> add\_field =\> "{" [process] [args] "=\>"% {a0}% {a1}% {a2} "}"
> }
> }
> For the second one it was about having two fields sid, uid that i wanted to point to the same field user.id (\> mutate{
> copy =\> {"sid" =\> "[user][id]"}
> copy =\> {"suid" =\> "[user][id]"}
> })
> The error was bypassed by converting the sid and suid field to the exported field of auditbeat [auditd][data][gid] and [auditd][data][suid] but i am not sure if those two field are conforms of the ECS
> filer{
> mutate {
>
> > copy =\> {"sid" =\> "[auditd][data][gid]"}
> > copy =\> {"suid" =\> "[auditd][data][suid]"}
> > }
> > }
Best regards
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 8, 2021, 10:03pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/4 "2021-06-08T22:03:09Z")
The ECS fields for auditd are documented [here](https://www.elastic.co/guide/en/beats/auditbeat/master/exported-fields-auditd.html). That document uses field.subfield notation, not logstash-style [field][subfield]
---
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [June 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/5 "2021-06-08T22:07:43Z")
Thanks Badger that was helpful
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2021, 10:07pm UTC](https://discuss.elastic.co/t/copy-rename-multiple-field-in-the-same-field-adding-multiples-field-to-one-field/275264/6 "2021-07-06T22:07:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.