# Logstash add field metadata not working
**URL:** https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911
**Category:** Logstash
**Created:** [August 13, 2020, 4:00pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911 "2020-08-13T16:00:39Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@frankfoti](https://discuss.elastic.co/u/frankfoti)
#### Post date: [August 13, 2020, 4:00pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/1 "2020-08-13T16:00:39Z")
I have tried a number of different solutions and cannot get this to work. What am I missing?
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)
```auto
filter {
mutate { id => "add-pipeline"
add_field => { "metadata-pipeline" => "%{[@metadata][pipeline]}" }}
}
filter {
mutate { id => "add-pipeline"
add_field => { "metadata-pipeline" => "" }}
mutate {
replace => { "metadata-pipeline" => "%{[@metadata][pipeline]}" }
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 13, 2020, 4:09pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/2 "2020-08-13T16:09:40Z")
Does the file [@metadata][pipeline] exist? If it does then either the add\_field or the replace should work.
---
### Author:  [@frankfoti](https://discuss.elastic.co/u/frankfoti)
#### Post date: [August 14, 2020, 11:56am UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/3 "2020-08-14T11:56:58Z")
It does exist and is used for conditional elasticsearch outputs so I know there is a value to it. Here is what I get in the document as a string literal "%{[@metadata][pipeline]}"
```auto
if [@metadata][pipeline] {
elasticsearch {
id => "beats-pipeline"
hosts => ["https://siem-elasticsearch-01:9200"]
ilm_enabled => true
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
pipeline => "%{[@metadata][pipeline]}"
user => beats_ingest
password => *******
cacert => "/etc/logstash/ca.crt"
ssl => true
}
} else {
```
---
### Author:  [@frankfoti](https://discuss.elastic.co/u/frankfoti)
#### Post date: [August 14, 2020, 12:33pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/4 "2020-08-14T12:33:28Z")
Correction, This is working when there is a pipeline such as "filebeat-7.8.1-elasticsearch-gc-pipeline". When the pipeline is not available it defaults to the string literal so I added some conditional procpessing to mutate for my needs:
```auto
filter {
if [@metadata][pipeline] {
mutate {
id => "add-pipeline"
add_field => { "metadata-pipeline" => "%{[@metadata][pipeline]}" }
}
}
else {
mutate {
id => "no-pipeline"
add_field => { "metadata-pipeline" => "None" }
}
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 14, 2020, 12:40pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/5 "2020-08-14T12:40:42Z")
It does not help you now, but note that the output was modified yesterday so that if the sprintf evaluates down to "" then it is ignored. As of now, that is going to pass "None" through to elasticsearch, which may complain.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2020, 12:40pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911/6 "2020-09-11T12:40:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.