# Logstash: mutate convert doesn't work on dynamic field name

**URL:** https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128
**Category:** Elasticsearch
**Created:** [February 12, 2015, 9:31am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128 "2015-02-12T09:31:12Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Cyril\_SANTUNE](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Cyril\_SANTUNE](https://discuss.elastic.co/u/Cyril_SANTUNE)
#### Post date: [February 12, 2015, 9:31am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128/1 "2015-02-12T09:31:12Z")

</div>

Hi,

I have a csv file as follow :  
,10,CPU load,....  
,3958,Memory used,....  
,...,..,....

So, I parse the csv. I create a new field, I use content of the 3rd column  
as name, and the 2nd column as value.

Extract of my configuration:

if [type] == "csv\_perfmon" {  
csv {  
columns =\> [  
"syslog\_timestamp",  
"value",  
"name" ]  
add\_field =\> {  
"syslog\_severity" =\> "notice"  
"syslog\_severity\_code" =\> "5"  
"syslog\_hostname" =\> "10.68.63.110"  
"syslog\_program" =\> "serverAgent"  
"%{name}" =\> "%{value}"  
}  
}  
date {  
match =\> ["syslog\_timestamp", "UNIX\_MS"]  
target =\> "syslog\_timestamp"  
}

```
mutate {
  rename => ["message", "syslog_message"]
  convert => ["%{name}", "float"]
  remove_field => [
    "value",

```

"name",  
"column4",  
"column5"  
......... ]  
}  
}

Everything is fine in kibana/elasticsearch, I can see the new field and its  
value.  
However I can not change the type of the field.  
The mutate part doesn't work :

mutate {  
convert =\> ["%{name}", "float"]

The field type is still a string. So I can't graph it in kibana

Note: If I don't use a variable, it works  
mutate {  
convert =\> ["CPU load", "float"]

Is it a bug or I miss something ?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/61a0c0d6-8748-4266-a810-5f51ce1829d6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/61a0c0d6-8748-4266-a810-5f51ce1829d6%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![GogLlundain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gogllundain/32/15620_2.png) [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)
#### Post date: [March 23, 2017, 11:21am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128/2 "2017-03-23T11:21:11Z")

</div>

I'm seeing similar today with Logstash 5.2.  
@Cyril_SANTUNE did you get an anwer to this?

---

<div class="post-metadata">

### Author: ![GogLlundain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gogllundain/32/15620_2.png) [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)
#### Post date: [March 23, 2017, 11:34am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128/3 "2017-03-23T11:34:22Z")

</div>

Answering my own question here.  
I found [this thread](https://discuss.elastic.co/t/solved-the-filter-plugin-mutate-convert-doesnt-work-in-5-0/65496/15) with the same issue. This is a known limitation and the answer is to use a bit of ruby to convert fields that have dynamic field names.

I'm going to try and find an example bit of ruby and post it back here.  
And possibly [here too](https://github.com/logstash-plugins/logstash-filter-mutate/issues/57).

---

<div class="post-metadata">

### Author: ![Cyril\_SANTUNE](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Cyril\_SANTUNE](https://discuss.elastic.co/u/Cyril_SANTUNE)
#### Post date: [March 23, 2017, 12:39pm UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128/4 "2017-03-23T12:39:42Z")

</div>

No, I don't have any answer. And I am not comfortable with Ruby so...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:01pm UTC](https://discuss.elastic.co/t/logstash-mutate-convert-doesnt-work-on-dynamic-field-name/22128/5 "2017-07-05T22:01:59Z")

</div>


