# Logstash mutate filter can change single field into multi\_fields?

**URL:** https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526
**Category:** Logstash
**Created:** [December 20, 2016, 5:51am UTC](https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526 "2016-12-20T05:51:49Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tanimoto](https://avatars.discourse-cdn.com/v4/letter/t/dec6dc/32.png) [@tanimoto](https://discuss.elastic.co/u/tanimoto)
#### Post date: [December 20, 2016, 5:51am UTC](https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526/1 "2016-12-20T05:51:49Z")

</div>

My logstash conf is like this.

```auto
input {
  jdbc {
    jdbc_driver_library => "/usr/local/pgsql/share/java/postgresql-9.4.1212.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://abcdata.co.jp:5432/abc"
    jdbc_user => "user"
    jdbc_password => "pass"
    statement => "SELECT id , item_info, update_date from items"
  }
}
output {
  elasticsearch {
    hosts => ["192.168.33.10"]
    index => "test_multi_field_index"
    document_type => "items"
    document_id => "%{id}"
  }
}

```

Can I put `item_info` column into multi\_field by using mutate filter like this?

```auto
filter{
mutate {
rename => { "item_info" => "item_info" : {"full_match" , "partial_match"} }

```

ES ver 2.4.2  
logstash ver 2.4

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 20, 2016, 6:52am UTC](https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526/2 "2016-12-20T06:52:21Z")

</div>

No, I think you need to use a ruby filter for this.

---

<div class="post-metadata">

### Author: ![tanimoto](https://avatars.discourse-cdn.com/v4/letter/t/dec6dc/32.png) [@tanimoto](https://discuss.elastic.co/u/tanimoto)
#### Post date: [December 20, 2016, 7:18am UTC](https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526/3 "2016-12-20T07:18:31Z")

</div>

Ok. Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2017, 7:18am UTC](https://discuss.elastic.co/t/logstash-mutate-filter-can-change-single-field-into-multi-fields/69526/4 "2017-01-17T07:18:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.