# Ingest pipeline context modification inconsistent

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516>\
**Category:** Elasticsearch\
**Created:** [July 25, 2017, 4:31pm UTC](https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516 "2017-07-25T16:31:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrask](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrask/32/20318_2.png) [@andrask](https://discuss.elastic.co/u/andrask)\
**Post date:** [July 25, 2017, 4:31pm UTC](https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516/1 "2017-07-25T16:31:45Z")

</div>

I'm trying to setup an ingest pipeline that enhances the metricbeat dataset.

Here are two example processors that expose the peculiarity (this is a test setup):

```
  "script": {
    "inline": "if (ctx.system.process.username ==~ /tomcat/) { ctx.process_name = 'tomcat'}"
  },
  "set": {
    "field": "system.process.name",
    "value": "{{process_name}}"
  },
  "rename": {
    "field": "process_name",
    "target_field": "system.process.name"
  }

```

I would expect system.process.username to become `m` but it actually becomes the empty string.

I see two issues here:

1. the template expression seems to consider only the incoming field values. No modifications are relfected in the set value.
2. The `rename` does not 'see' the set value either. The pipeline fails with `field [process_name] doesn't exist`.

Am I doing it wrong or there is a bug here?

---

<div class="post-metadata">

**Author:** ![andrask](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrask/32/20318_2.png) [@andrask](https://discuss.elastic.co/u/andrask)\
**Post date:** [July 26, 2017, 10:58am UTC](https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516/2 "2017-07-26T10:58:38Z")

</div>

Can it be that the script processor can appear only once in the pipeline? It seems like only the last inline script is actually ran. With these processors

```
  "script": {
    "inline": "ctx.tutu1 = 'sdfsdf'"
  },
  "script": {
    "inline": "ctx.tutu3 = 'sdfsdf'; ctx.tutu2 = 'sdfsdf'"
  }

```

the doc will contain tutu3 and tutu2, and even if I put an error in the first script, the pipeline will succeed.

Can it be that only the last script is cached and compiled?

---

<div class="post-metadata">

**Author:** ![andrask](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrask/32/20318_2.png) [@andrask](https://discuss.elastic.co/u/andrask)\
**Post date:** [July 27, 2017, 7:53am UTC](https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516/3 "2017-07-27T07:53:43Z")

</div>

Ok, I made the mistake. [https://github.com/elastic/elasticsearch/issues/25906#issuecomment-318050169](https://github.com/elastic/elasticsearch/issues/25906#issuecomment-318050169)

The script started working as soon as I modified it to be a series of processors:

```
{
  "script": {
    "inline": "ctx.tutu1 = 'sdfsdf'"
  }
},
{
  "script": {
    "inline": "ctx.tutu3 = 'sdfsdf'; ctx.tutu2 = 'sdfsdf'"
  }
}

```

The JSON format does not make it easy to see the difference.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2017, 7:53am UTC](https://discuss.elastic.co/t/ingest-pipeline-context-modification-inconsistent/94516/4 "2017-08-24T07:53:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.