# Fields value doesn't update when I change parsing rule in logstash

**URL:** <https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484>\
**Category:** Logstash\
**Created:** [July 14, 2016, 7:10am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484 "2016-07-14T07:10:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [July 14, 2016, 7:10am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/1 "2016-07-14T07:10:23Z")

</div>

Hi fellas , I am newbie here . When i change field value in logstash config file and restart logstash some time I can see the changed value but some time it doesn't work. Just for an example i simply added a static field in logstash config like this

add\_field =\> ['vendorname','kibana']  
and next time when I update this to add\_field =\> ['vendorname','abc'] and restart logstash then It is not necessary I will see an updated value. And want to know how can i clear session of kibana

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2016, 7:17am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/2 "2016-07-14T07:17:27Z")

</div>

Such a configuration change only applies to new events. When you experience that the old value is still used, are you sure you're looking at events processed after Logstash was reconfigured?

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [July 14, 2016, 7:29am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/3 "2016-07-14T07:29:45Z")

</div>

what events are ? I just have conditional statement in config file

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2016, 7:45am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/4 "2016-07-14T07:45:27Z")

</div>

I'm talking about the events that Logstash processes and that you're viewing in Kibana. I don't find it likely that Logstash keeps adding the old field value after you've restarted it with a new configuration.

---

<div class="post-metadata">

**Author:** ![vandana\_sethi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vandana_sethi/32/10894_2.png) [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Post date:** [July 14, 2016, 7:49am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/5 "2016-07-14T07:49:50Z")

</div>

I am facing this problem and thought It may be cause of cache .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2016, 9:17am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/6 "2016-07-14T09:17:53Z")

</div>

No, that's not likely.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484/7 "2017-07-06T04:48:04Z")

</div>

Closed on July 6, 2017, 4:48am UTC


