# Help with filter/mutate, replace netflow snmp field

**URL:** <https://discuss.elastic.co/t/help-with-filter-mutate-replace-netflow-snmp-field/174053>\
**Category:** Logstash\
**Created:** [March 27, 2019, 6:56am UTC](https://discuss.elastic.co/t/help-with-filter-mutate-replace-netflow-snmp-field/174053 "2019-03-27T06:56:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![otoce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otoce/32/68068_2.png) [@otoce](https://discuss.elastic.co/u/otoce)\
**Post date:** [March 27, 2019, 6:56am UTC](https://discuss.elastic.co/t/help-with-filter-mutate-replace-netflow-snmp-field/174053/1 "2019-03-27T06:56:20Z")

</div>

Hi,

i'm doing something wrong so please help. Input from 2 sources:

```
`input {
snmp {
    walk => ["1.3.6.1.2.1.2.2.1.2"]
    hosts => [{host => "udp:xxx" community => "public" version => "3" retries => 5 timeout => 1000 }]
    security_name => "xxx"
    auth_pass => "xxx"
    auth_protocol => "sha"
    interval =>300
    oid_root_skip => 9
    add_field => {hostname => "%{[@metadata][host_protocol]}:%{[@metadata][host_address]}/%{[@metadata][host_port]},%{[@metadata][host_community]}"}}
udp {
host => "0.0.0.0"
port => 2050
codec => netflow {
#netflow_definitions => "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-netflow-3.14.1/lib/logstash/codecs/netflow/netflow.yaml"}}``

```

i want to replace value in netflow field [netflow][input\_snmp] with value in snmp field if there is matching. I can't even replace with static value "vodenica".

snmp:

> "\_source": {  
> "ifDescr.30": "Vlan1",

and

> [netflow][input\_snmp]" == 30

then put Vlan1 in field [netflow][input\_snmp]

```
filter {

if "[netflow][input_snmp]" == 30 {
mutate {
#replace => ["[netflow][input_snmp]" , "%{[ifDescr.30]}" ]
replace => ["[netflow][input_snmp]" , "vodenica" ]
#update => ["[netflow][input_snmp]","vodenica"]
#update => ["[netflow][output_snmp]","%{[ifDescr.30]}"] }}

mutate {
replace => ["[netflow][output_snmp]" , "vodenicaaaaaaaaaaaaaaa" ]
add_field => ["[netflow][output_snmptest]" , "vodenicaaaaaaaaaaaaaaa" ]}

mutate {
remove_field => ["[netflow][dst_locality]", "[netflow][dst_as]", "[netflow][version]", "[netflow][dst_mask_len]", "[netflow][first_switched]", "[netflow][flow_locality]", "[netflow][flow_seq_num]", "[netflow][flow_seq_num]", "[netflow][flowset_id]", "[netflow][last_switched]", "[netflow][flow_seq_num]", "[netflow][flowset_id]", "[netflow][protocol]", "[netflow][src_as]", "[netflow][tcp_flags]", "@version", "[netflow][first_switched]", "[netflow][last_switched]" ]
add_field => { "SonPen" => "xxx" }
add_field => { "ifDescr.27" => "%{[ifDescr.27]}" }}

output {
file {
path => "/etc/logstash0/py1.out.%{+yyyy.MM.dd.HH}"
#codec => line { format => "custom format: %{message}"}
}

elasticsearch {
hosts => ['xxx:9200','xxx:9200','xxx:9200','xxx:9200']
index => "%{type}-%{+YYYY.MM.dd.HH}"}}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2019, 6:56am UTC](https://discuss.elastic.co/t/help-with-filter-mutate-replace-netflow-snmp-field/174053/2 "2019-04-24T06:56:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.