# I want to replace the value of a field if its value is a certain number

**URL:** https://discuss.elastic.co/t/i-want-to-replace-the-value-of-a-field-if-its-value-is-a-certain-number/212835
**Category:** Logstash
**Created:** [December 23, 2019, 11:02am UTC](https://discuss.elastic.co/t/i-want-to-replace-the-value-of-a-field-if-its-value-is-a-certain-number/212835 "2019-12-23T11:02:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Jamcast](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamcast/32/59385_2.png) [@Jamcast](https://discuss.elastic.co/u/Jamcast)
#### Post date: [December 23, 2019, 11:02am UTC](https://discuss.elastic.co/t/i-want-to-replace-the-value-of-a-field-if-its-value-is-a-certain-number/212835/1 "2019-12-23T11:02:49Z")

</div>

I want to replace the value of a field if its value is a certain number and I'm not sure what I'm doing wrong.

Here is the input:

```
            "price" => 811950,
"last_price_update" => "2019-12-22T11:30:23Z",
             "name" => "Mastela Fruit",
             **"type" => 8,**
       "@timestamp" => 2019-12-23T10:41:16.525Z,
         "@version" => "1"

```

}  
{  
"price" =\> 159252,  
"last\_price\_update" =\> "2019-12-22T11:35:24Z",  
"name" =\> "Seed of Mastela",  
**"type" =\> 11,**  
"@timestamp" =\> 2019-12-23T10:41:16.525Z,  
"@version" =\> "1"  
}

I have tried:

filter {  
json {  
source =\> "message"  
}  
mutate {  
add\_field =\> { "price" =\> "%{[sea][latest]}" }  
add\_field =\> { "last\_price\_update" =\> "%{[sea][latest\_time]}" }  
remove\_field =\> ["global", "image", "global\_sea\_diff", "sea"]  
}  
mutate {  
convert =\> { "price" =\> "integer" }  
convert =\> { "type" =\> "integer" }  
}  
if [type] == "8" {  
mutate { replace =\> { "type" =\> "materials" } } }  
else {  
mutate { replace =\> { "type" =\> "others" } } }  
}

I also tried:

filter {  
json {  
source =\> "message"  
}  
mutate {  
add\_field =\> { "price" =\> "%{[sea][latest]}" }  
add\_field =\> { "last\_price\_update" =\> "%{[sea][latest\_time]}" }  
remove\_field =\> ["global", "image", "global\_sea\_diff", "sea"]  
}  
mutate {  
convert =\> { "price" =\> "integer" }  
convert =\> { "type" =\> "integer" }  
}  
if "8" in [type] {  
mutate { replace =\> { "type" =\> "materials" } } }  
else {  
mutate { replace =\> { "type" =\> "others" } } }  
}

Both don't work. Here is the result:  
{  
"@version" =\> "1",  
"name" =\> "Mastela Fruit",  
"price" =\> 811950,  
"type" =\> "others",  
"@timestamp" =\> 2019-12-23T10:52:29.300Z,  
"last\_price\_update" =\> "2019-12-22T11:30:23Z"  
}  
{  
"@version" =\> "1",  
"name" =\> "Seed of Mastela",  
"price" =\> 159252,  
"type" =\> "others",  
"@timestamp" =\> 2019-12-23T10:52:29.301Z,  
"last\_price\_update" =\> "2019-12-22T11:35:24Z"  
}

the price doesn't appear to be turning to integer as well

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 20, 2020, 11:02am UTC](https://discuss.elastic.co/t/i-want-to-replace-the-value-of-a-field-if-its-value-is-a-certain-number/212835/2 "2020-01-20T11:02:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.