# Filter not working when something has a period in it's name

**URL:** <https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523>\
**Category:** Logstash\
**Created:** [February 9, 2017, 3:45pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523 "2017-02-09T15:45:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 9, 2017, 3:45pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523/1 "2017-02-09T15:45:54Z")

</div>

So I need to write a filter that changes all the periods in field names to underscores. I amusing mutate, and I can do some things and not other things. For reference here is my current output in Kibana.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/112b588f0b815f25954f8cf8e41b20e81ad6b07e.PNG)

See those fields that say "packet.event-id" and so forth? I need to rename all of those. Here is my filter that I wrote and I do not know why it doesn't work

 ![](https://us1.discourse-cdn.com/elastic/original/2X/c/c51acf78cc0b53724e3f5fcae59bb4346e29b094.PNG)

The problem is that I CAN add a field, and the renaming of "offset" WORKS. But when I try and do the packet one nothing changes. I feel like this should be simple and I am very confused as to why only the one with a period in it doesn't work.

I have refreshed the index in Kibana, and still nothing changes. Anyone have a solution?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2017, 3:49pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523/2 "2017-02-09T15:49:43Z")

</div>

Why not just use the de\_dot filter?

---

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 9, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523/3 "2017-02-09T15:54:41Z")

</div>

The documentation says that it is expensive, and has to copy each field's data to a whole new reference.

> "It should only be used if no other options are available."

---

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 9, 2017, 4:14pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523/4 "2017-02-09T16:14:28Z")

</div>

Logstash also seems to be ignoring that these fields that start with "packet" are even there. The reason I say that is because I did this:

```
mutate {
 add_field => {
"my_packet_event_id" => "%{packet.event-id}"
} 

```

and it did not work either. The field was added but the value was literally a strring that said

```
    %{packet.event-id}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2017, 4:14pm UTC](https://discuss.elastic.co/t/filter-not-working-when-something-has-a-period-in-its-name/74523/5 "2017-03-09T16:14:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.