# How to swap field values

**URL:** <https://discuss.elastic.co/t/how-to-swap-field-values/360619>\
**Category:** Logstash\
**Created:** [May 31, 2024, 12:31pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619 "2024-05-31T12:31:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zlobny\_Raven](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zlobny_raven/32/134960_2.png) [@Zlobny\_Raven](https://discuss.elastic.co/u/Zlobny_Raven)\
**Post date:** [May 31, 2024, 12:31pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619/1 "2024-05-31T12:31:25Z")

</div>

Hi, I need to swap values between two fields.  
I have:  
"field1" : "value1"  
"field2" : "value2"  
I need:  
"field1" : "value2"  
"field2" : "value1"  
Can I do it with help of some filter-plugin?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 31, 2024, 1:20pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619/2 "2024-05-31T13:20:40Z")

</div>

You can use mutate-copy with combination @metadata

Something like this

```auto
 mutate {
         copy => { "field2" => "[@metadata][tmp]" }
      }
 mutate {
         copy => { "field1" => "field2" }
         copy => { "[@metadata][tmp]" => "%{field1}" }
      }

```

If you need more fields, array or similar, you should use ruby and loop.

---

<div class="post-metadata">

**Author:** ![Zlobny\_Raven](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zlobny_raven/32/134960_2.png) [@Zlobny\_Raven](https://discuss.elastic.co/u/Zlobny_Raven)\
**Post date:** [May 31, 2024, 2:43pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619/3 "2024-05-31T14:43:47Z")

</div>

In fact I need to swap 3 fields, so my config looks like:

```auto
mutate {
  copy => {
    "fld_1" => "[@metadata][t_1]"
    "fld_2" => "[@metadata][t_2]"
    "fld_3" => "[@metadata][t_3]"
  }
}
mutate {
  copy => {
    "fld_10" => "fld_1"
    "fld_20" => "fld_2"
    "fld_30" => "fld_3"
    "[@metadata][t_1]" => "%{fld_10}"
    "[@metadata][t_2]" => "%{fld_20}"
    "[@metadata][t_3]" => "%{fld_30}"
  }
}

```

As a result I has:  
(before)

```auto
"fld_1" : "val_1"
"fld_2" : "val_2"
"fld_3" : "val_3"
"fld_10" : "val_10"
"fld_20" : "val_20"
"fld_30" : "val_30"

```

(after)

```auto
"fld_1" : "val_10"
"fld_2" : "val_20"
"fld_3" : "val_30"
"fld_10" : "val_10"
"fld_20" : "val_20"
"fld_30" : "val_30"

```

what's wrong?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 31, 2024, 4:00pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619/4 "2024-05-31T16:00:52Z")

</div>

> [@Zlobny\_Raven](#):
>
> what's wrong?

Nothing in your filters modifies fld\_10/20/30.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 31, 2024, 9:48pm UTC](https://discuss.elastic.co/t/how-to-swap-field-values/360619/5 "2024-05-31T21:48:42Z")

</div>

My mistakes, sorry:

1. It's not "%{field1}", it should be: "field1" in 2nd "copy"
2. Cannot replace value field1 in the one mutate sequence. The mutate operation is like a SQL transaction.

> Each mutation must be in its own code block if the sequence of operations needs to be preserved.

```auto
input {
  generator {
       message => "Test message"
	   count => 1
  }
}
filter {

   mutate { 
    add_field => { 
    "[fld_1]" => "val_1" 
    "[fld_2]" => "val_2" 
    "[fld_3]" => "val_3" 
    } 
   }

   mutate { 
    add_field => { 
    "[fld_10]" => "val_10" 
    "[fld_20]" => "val_20" 
    "[fld_30]" => "val_30" 
    } 
   }
  
	mutate {
	  copy => {
		"fld_1" => "[@metadata][t_1]"
		"fld_2" => "[@metadata][t_2]"
		"fld_3" => "[@metadata][t_3]"
	  }
	}
	mutate {
	  copy => {
		"fld_10" => "fld_1"
		"fld_20" => "fld_2"
		"fld_30" => "fld_3"
	  }
	}
	mutate {
	  copy => {
		"[@metadata][t_1]" => "fld_10"
		"[@metadata][t_2]" => "fld_20"
		"[@metadata][t_3]" => "fld_30"
	  }
	}
   mutate { remove_field => ["@version", "event", "host", "@timestamp", "message"] }

}

output {
    stdout { codec => rubydebug{ metadata => true} }
}

```

Result:

```auto
{
       "fld_20" => "val_2",
       "fld_30" => "val_3",
    "@metadata" => {
        "t_2" => "val_2",
        "t_3" => "val_3",
        "t_1" => "val_1"
    },
        "fld_3" => "val_30",
        "fld_2" => "val_20",
       "fld_10" => "val_1",
        "fld_1" => "val_10"
}

```