# Identifying fields using sprintf

**URL:** https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941
**Category:** Logstash
**Created:** [April 20, 2016, 5:45pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941 "2016-04-20T17:45:51Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [April 20, 2016, 5:45pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/1 "2016-04-20T17:45:52Z")

</div>

I have some JSON data coming to me over HTTP. Each record has a field that needs to be converted to an integer but its name will vary, e.g. "fieldA\_count" in one record and "fieldfB\_count" in another. Each record contains another identifying field named "field\_name" with a value "fieldA" or "fieldB". I want to use the identifying field to name the field I need to convert to an integer, i.e.

```
mutate{
    convert => { "%{field_name}_count => "integer" }
}

```

I'd like this evaluated to:

```
mutate{
    convert => { "fieldA_count => "integer" }
}

```

...or:

```
mutate{
    convert => { "fieldB_count => "integer" }
}

```

But when I tried this the fields remained Strings. What am I doing wrong?

Craig

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 5:52pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/2 "2016-04-20T17:52:37Z")

</div>

Yeah, the name of the field to convert isn't subject to sprintf expansion. This is already reported in [issue #57](https://github.com/logstash-plugins/logstash-filter-mutate/issues/57). Until that's fixed you can use a ruby filter.

---

<div class="post-metadata">

### Author: ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [April 20, 2016, 6:19pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/3 "2016-04-20T18:19:56Z")

</div>

Thanks Magnus, do you think this would work? (I'm pretty new at Ruby)

```
field_prefix = event['prefix']
field_name = field_prefix + '_count'
event[field_name] = event[field_name].to_i
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 7:56pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/4 "2016-04-20T19:56:23Z")

</div>

Why not just try it out? But yeah, it looks good

---

<div class="post-metadata">

### Author: ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [April 21, 2016, 2:28pm UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/5 "2016-04-21T14:28:49Z")

</div>

Just lazy I guess 😉 I did try it and it worked, thanks for the help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/identifying-fields-using-sprintf/47941/6 "2017-07-06T05:01:15Z")

</div>


