# Logstash 2.2.2 mutuate

**URL:** <https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060>\
**Category:** Logstash\
**Created:** [March 10, 2016, 5:01pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060 "2016-03-10T17:01:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [March 10, 2016, 5:01pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/1 "2016-03-10T17:01:48Z")

</div>

I am running logstash 2.2.2 and I am trying to rename these 2 fields from my data and it does not take effect on the index. Please help

Rename "Fashion&Beauty" to Fashion\_and\_Beauty  
"Business/Finance" to Business\_and\_Finance

input {  
file {  
path =\> "/var/data/logstash/myfile.log"  
start\_position =\> beginning  
#sincedb\_path =\> "/var/data/logstash"

```
}

```

}

filter {  
mutate {  
remove\_field =\> ["@version"]  
rename =\> ["Fashion&Beauty", "Fashion\_and\_Beauty"]  
rename =\> ["Business/Finance", "Business\_and\_Finance"]  
}  
}

output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
manage\_template =\> false  
index =\> "myindex"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2016, 6:03pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/2 "2016-03-10T18:03:13Z")

</div>

Works fine for me.

```auto
$ cat test.config
input { stdin { codec => json } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    remove_field => ["@version"]
    rename => ["Fashion&Beauty", "Fashion_and_Beauty"]
    rename => ["Business/Finance", "Business_and_Finance"]
  }
}
$ echo '{"Fashion&Beauty": "foo", "Business/Finance": "bar"}' | /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 2
Logstash startup completed
{
              "@timestamp" => "2016-03-10T18:01:42.493Z",
                    "host" => "hallonet",
      "Fashion_and_Beauty" => "foo",
    "Business_and_Finance" => "bar"
}
Logstash shutdown completed

```

---

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [March 10, 2016, 9:06pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/3 "2016-03-10T21:06:29Z")

</div>

Thank you

---

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [March 10, 2016, 9:37pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/4 "2016-03-10T21:37:06Z")

</div>

I forgot to mention that the data is a nested json file, that's why it is working for you and not for us.  
Here is a sample of the data:  
{  
"verticals": {

```
"Business/Finance": xxxxx,
"Fashion&Beauty": xxxxxx,
"Automotive":xxxxxxx

```

},  
"@timestamp": "2016-03-10T18:21:46.335+0000",  
"url": "wssomeurl/html"  
}  
Here is the configuration in prod logstash  
input {  
kafka {  
zk\_connect =\> "zookeeper.prod.01.2181,zookeeper.prod.02.2181,zookeeper.prod.03.2181"  
decorate\_events =\> true  
group\_id =\> "ver-page-prod"  
topic\_id =\> "page-prod"  
consumer\_threads =\> 2  
codec =\> "json"  
}  
}

filter {  
if [kafka][consumer\_group] == "ver-page-prod" {  
mutate {  
remove\_field =\> ["Keywords", "[kafka][msg\_size]", "[kafka][topic]", "[kafka][key]", "[kafka][partition]" ]  
rename =\> ["Business/Finance", "Business\_and\_Finance"]  
rename =\> ["Fashion&Beauty", "Fashion\_and\_Beauty"]  
}  
}  
}

output {  
if [kafka][consumer\_group] == "ver-page-prod" {  
elasticsearch {  
hosts =\> "cluster01"  
index =\> "myindex"  
}  
elasticsearch {  
hosts =\> "cluster02"  
index =\> "myindex"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\
**Post date:** [March 10, 2016, 11:02pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/5 "2016-03-10T23:02:49Z")

</div>

> [@magnusbaeck](#):
>
> input { stdin { codec =\> json } }  
> output { stdout { codec =\> rubydebug } }

We got it to work...thanks again....

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060/6 "2017-07-06T05:07:28Z")

</div>