# Logstash mutate and copy entire \_source object into an inner field

**URL:** <https://discuss.elastic.co/t/logstash-mutate-and-copy-entire-source-object-into-an-inner-field/114131>\
**Category:** Logstash\
**Created:** [January 4, 2018, 4:53pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-copy-entire-source-object-into-an-inner-field/114131 "2018-01-04T16:53:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deflector](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@deflector](https://discuss.elastic.co/u/deflector)\
**Post date:** [January 4, 2018, 4:53pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-copy-entire-source-object-into-an-inner-field/114131/1 "2018-01-04T16:53:14Z")

</div>

Hello,

I'm trying to add a layer to my template definition to wrap the existing document as an inner field, lets call it 'summary'. I have to do this for several types, each with many fields. One of the bigger issues will be transforming all of the existing data to the new format. I am trying to use Logstash but am looking for a way to grab the whole \_source instead of having to write each field by name.  
Can someone suggest how to do this properly?

For example:

```auto
{
"firstName":"John",
"lastName":"Smith",
"middleName":"Adam"
}

```

```auto
filter {
  mutate {
    copy => {"firstName" => "summary.firstName"}
    copy => {"lastName" => "summary.lastName"}
    copy => {"middleName" => "summary.middleName"}
  }
}

```

```auto
{
    "summary": {
        "firstName":"John",
        "lastName":"Smith",
        "middleName":"Adam"
    }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 7, 2018, 4:31pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-copy-entire-source-object-into-an-inner-field/114131/2 "2018-01-07T16:31:23Z")

</div>

Use a ruby filter. Perhaps something like

```nohighlight
event.set('summary', event.to_hash)

```

would work. If you don't want every single field to be copied into `summary` you can copy them one by one and use a conditional to select which ones to copy. For example,

```nohighlight
summary = {}
event.to_hash.each { |k, v|
  if k.include? 'Name'
    summary[k] = v
  end
}
event.set('summary', summary)

```

only copies field whose name contains "Name".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2018, 4:31pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-copy-entire-source-object-into-an-inner-field/114131/3 "2018-02-04T16:31:43Z")

</div>

Closed on February 4, 2018, 4:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.