# Is it possible to mutate field in elastic using logstash?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051>\
**Category:** Logstash\
**Created:** [July 6, 2017, 8:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051 "2017-07-06T08:31:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [July 6, 2017, 8:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051/1 "2017-07-06T08:31:49Z")

</div>

Hi,

Is it is possible to mutate a field (add/update) on an event already in elastic using logstash?  
I thought it would be possible to do that using the logstash-filter-elasticsearch but after reading the documentaion I see that's not possible.  
Are there other alternatives or would it be advised not to do this?

Regard Benny

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 6, 2017, 10:42pm UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051/2 "2017-07-06T22:42:40Z")

</div>

Yes, you need to get that document, edit it, then reindex into ES. There's not really any concept of edit-in-place.

What sort of data is it?

---

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [July 7, 2017, 7:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051/3 "2017-07-07T07:16:03Z")

</div>

Hi Mark,

I have events in have certain statusses for example registered and in\_transit.  
The registered always comes in first. But when the in\_transit event for some reason does not arrive I need to signal it in kibana. I understood it is not possible to create such visualisations so I wanted to update the registered event with a boolean flag to state that the in\_transit event has arrived. This way I know which registered events are missing in\_transit events.  
I thought it would be possible to do that with the logstash elasticsearch filter but thats does not seem to be the case reading the documentation.  
I also read that doing the edit in the output of logstash is tricky business and must be used with caution. This solution seems also not really the way to go. Or is this misunderstanding on my part?  
It was also suggested by a kibana team member to create a custom visualisation.

What other possibilities are there?

Regards benny

---

<div class="post-metadata">

**Author:** ![bterhorst](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@bterhorst](https://discuss.elastic.co/u/bterhorst)\
**Post date:** [July 12, 2017, 10:13am UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051/4 "2017-07-12T10:13:24Z")

</div>

Hi,

Any thoughts/suggestions on the above?

Regards benny

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2017, 10:13am UTC](https://discuss.elastic.co/t/is-it-possible-to-mutate-field-in-elastic-using-logstash/92051/5 "2017-08-09T10:13:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.