# Field duplicate and truncate

**URL:** https://discuss.elastic.co/t/field-duplicate-and-truncate/97745
**Category:** Logstash
**Created:** [August 21, 2017, 10:17am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745 "2017-08-21T10:17:33Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [August 21, 2017, 10:17am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745/1 "2017-08-21T10:17:33Z")

</div>

I need to duplicate my event field and manipulate the string field length to 5 characters .  
This is my sample log:  
`{"LogLevel":"INFO","LogMsg":"Checked existing Slots ... 180 more lines","Time":"2017-08-21_12:01:48.882"}`

1- i need "LogMsg" field to be duplicated with another new field name and truncate that new string field length to 5 character.

---

<div class="post-metadata">

### Author: ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [August 21, 2017, 10:18am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745/2 "2017-08-21T10:18:55Z")

</div>

is it possible??

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 22, 2017, 12:51pm UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745/3 "2017-08-22T12:51:30Z")

</div>

Copy the field with a mutate filter and use a truncate filter to truncate the new field.

---

<div class="post-metadata">

### Author: ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [August 23, 2017, 4:16am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745/4 "2017-08-23T04:16:00Z")

</div>

Thanks for the reply..it worked for me  
this is my filter:  
mutate {  
add\_field =\> { "ErrorMsg" =\> "%{errorMessage}" }  
}  
truncate {  
fields =\> "ErrorMsg"  
length\_bytes =\> 1000  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2017, 4:16am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745/5 "2017-09-20T04:16:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.