# Logstash 1.4 filter not working

**URL:** <https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825>\
**Category:** Logstash\
**Created:** [January 21, 2016, 10:42pm UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825 "2016-01-21T22:42:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [January 21, 2016, 10:42pm UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825/1 "2016-01-21T22:42:51Z")

</div>

I am running logstash 1.4.0 and I try to rename site\_name with domaine\_name using the filter but it is not changing the file  
I am not sure what I am doing wrong. Please help

input {  
file {  
path =\> "/var/data/logstash/url-topic.log"  
start\_position =\> beginning  
sincedb\_path =\> "/var/data/logstash"

```
}

```

}

filter {  
if [path] == "/var/data/logstash/url-topic.log" {  
mutate {  
rename =\> { "site\_name" =\> "domaine\_name" }  
}  
}  
}

output {  
file {  
path =\> "/var/data/logstash/url-output-%{+YYYY-MM-dd}.txt"  
}  
}

File looks like this:  
{"message":"{"url":"[www.somesite.com/something/workout/","site\_name":"www.somesite.com","@timestamp":"2016-01-16T04:14:11.003+0000](http://www.somesite.com/something/workout/%22,%22site_name%22:%22www.somesite.com%22,%22@timestamp%22:%222016-01-16T04:14:11.003+0000)....etc....

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 22, 2016, 7:02am UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825/2 "2016-01-22T07:02:21Z")

</div>

You need to set the codec for the file plugins to "json" (or "json\_lines"?) so that the JSON text in the input is deserialized properly (so that you can access the fields) and so that it's serialized back to JSON upon output.

---

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [January 22, 2016, 12:54pm UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825/3 "2016-01-22T12:54:34Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825/4 "2017-07-06T05:14:43Z")

</div>

Closed on July 6, 2017, 5:14am UTC