# Logstash Filter Theory
**URL:** https://discuss.elastic.co/t/logstash-filter-theory/124883
**Category:** Logstash
**Created:** [March 21, 2018, 12:59am UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883 "2018-03-21T00:59:30Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@wendt](https://discuss.elastic.co/u/wendt)
#### Post date: [March 21, 2018, 12:59am UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/1 "2018-03-21T00:59:30Z")
Do mutate functions build on each other? For example, if I were to rename a field and then wanted to send the text of that field to lower case, would I use the name of the original field, or the renamed version?
```
Ex. stacking functions
filter {
mutate {
rename => { "fruit" => "apple" }
lowercase => ["apple"]
}
}
Ex. non-stacking functions
filter {
mutate {
rename => { "fruit" => "apple" }
lowercase => ["fruit"]
}
}
```
Sorry for the formatting, still figuring out how to post here
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 21, 2018, 6:57pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/2 "2018-03-21T18:57:24Z")
The pipeline is read line by line, if you rename a field, everything else that you want to do with this field will need to use the new name.
This work without any problem.
```auto
filter {
mutate {
rename => { "fruit" => "apple" }
lowercase => ["apple"]
}
}
```
This does not work, since the field fruit does not exist anymore.
```auto
filter {
mutate {
rename => { "fruit" => "apple" }
lowercase => ["fruit"]
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 21, 2018, 8:17pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/3 "2018-03-21T20:17:36Z")
> The pipeline is read line by line
FIlters are processed in the order listed, yes, but within a filter the order shouldn't be relied upon. This is especially true for the mutate filter where the different operations run in a fixed order:
>
If you have operations that need to run in a particular order (like in the examples above) you must use separate mutate filters.
---
### Author:  [@wendt](https://discuss.elastic.co/u/wendt)
#### Post date: [March 21, 2018, 8:25pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/4 "2018-03-21T20:25:01Z")
Thank you for the explanation, that's extremely helpful!
Clarifying so I don't misrepresent this information in the future - the fixed order for mutate operations is as listed above (at least until the code is updated/changed), where coerce operations are run first, then rename operations, then update operations, and so on?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 21, 2018, 8:26pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/5 "2018-03-21T20:26:05Z")
> Clarifying so I don't misrepresent this information in the future - the fixed order for mutate operations is as listed above (at least until the code is updated/changed), where coerce operations are run first, then rename operations, then update operations, and so on?
That's correct.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2018, 8:26pm UTC](https://discuss.elastic.co/t/logstash-filter-theory/124883/6 "2018-04-18T20:26:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.