# Logstash: Beats input and filters

**URL:** <https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212>\
**Category:** Logstash\
**Created:** [February 20, 2020, 2:58pm UTC](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212 "2020-02-20T14:58:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rysiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rysiu/32/61919_2.png) [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Post date:** [February 20, 2020, 2:58pm UTC](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212/1 "2020-02-20T14:58:58Z")

</div>

I have a problem.

I have a pipeline in Logstash. I use beats at the entrance.  
Beats. Logs are sent by Winlogbeat.

Everything works okay.  
But there is a problem.

I want to copy the value of a new field to another field in the filter section.

I tested ruby / mutate and "add\_field".

For example:

```
filter {
    mutate {
        add_field => { "ProcessId" => "%{process.pid}" }
    }
}

```

There's a field "process.pid" in the documents.  
I want to add a field with the same value as "process.pid" but with a name "ProcessId".

Unfortunately, it's not working properly.  
Is there any additional consideration for Winlogbeat here?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 20, 2020, 3:01pm UTC](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212/2 "2020-02-20T15:01:36Z")

</div>

> [@Rysiu](#):
>
> "ProcessId" =\> "%{process.pid}"

If the field name has a period in it then that should work. If the process field is an object that contains a pid field then that should be %{[process][pid]}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2020, 3:01pm UTC](https://discuss.elastic.co/t/logstash-beats-input-and-filters/220212/3 "2020-03-19T15:01:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.