# Logstash mutate can't convert 2 fields at once

**URL:** https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947
**Category:** Logstash
**Created:** [February 19, 2019, 6:58am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947 "2019-02-19T06:58:45Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ksemaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksemaev/32/41079_2.png) [@ksemaev](https://discuss.elastic.co/u/ksemaev)
#### Post date: [February 19, 2019, 6:58am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947/1 "2019-02-19T06:58:45Z")

</div>

When I have both a.b and c.d in one log entry, and try to mutate-convert them, only first conversion occures, and the second is not, so it causes logstash to throw `failed to parse field` warning.

Current config is:  
filter {  
mutate {  
convert =\> {  
"[query][from]" =\> "string"  
"[query][to]" =\> "string"  
}  
}  
}

Can anybody advice on how to convert both fileds at once?

---

<div class="post-metadata">

### Author: ![ksemaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksemaev/32/41079_2.png) [@ksemaev](https://discuss.elastic.co/u/ksemaev)
#### Post date: [February 19, 2019, 7:47am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947/2 "2019-02-19T07:47:16Z")

</div>

When I use the construction above I get parsing error about `query.to` field. If In filter I put converts in that order:  
convert =\> {  
"[query][to]" =\> "string"  
"[query][from]" =\> "string"  
}  
I get error regarding `query.from` field, which makes me think that somehow only one convert action applies, if both fields are present in log entry

---

<div class="post-metadata">

### Author: ![ksemaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksemaev/32/41079_2.png) [@ksemaev](https://discuss.elastic.co/u/ksemaev)
#### Post date: [February 19, 2019, 8:09am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947/3 "2019-02-19T08:09:09Z")

</div>

tried the same with not nested fields - same behaviour

---

<div class="post-metadata">

### Author: ![ksemaev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksemaev/32/41079_2.png) [@ksemaev](https://discuss.elastic.co/u/ksemaev)
#### Post date: [February 20, 2019, 8:52am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947/4 "2019-02-20T08:52:20Z")

</div>

All is good, it was elastic index, who refused to reindex properly  
Not logstash problem. please close the issue

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2019, 8:52am UTC](https://discuss.elastic.co/t/logstash-mutate-cant-convert-2-fields-at-once/168947/5 "2019-03-20T08:52:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
