# Logstash mutate not working

**URL:** <https://discuss.elastic.co/t/logstash-mutate-not-working/47250>\
**Category:** Logstash\
**Created:** [April 13, 2016, 12:55pm UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250 "2016-04-13T12:55:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [April 13, 2016, 12:55pm UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/1 "2016-04-13T12:55:58Z")

</div>

Below are my 2 config file but when i add mutet it stops working

----------config 1

input {  
tcp {  
'port' =\> '9563'  
}  
}

filter {  
json {  
source =\> 'message'  
}  
mutate {  
add\_field =\> {  
"componentId" =\> "%{component}"  
}  
}  
if [component] == 1 {  
mutate {  
replace =\> ["component", "datawarehouse"]  
}  
}else if [component] == 2 {  
mutate {  
replace =\> ["component", "Push Notification"]  
}  
} else {  
mutate {  
replace =\> ["component", "others"]  
}  
}

}

* * *

config 2 for output

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
s3 {  
access\_key\_id =\> ""  
secret\_access\_key =\> ""  
bucket =\> "elk-logs"  
endpoint\_region =\> "us-east-1"  
size\_file =\> "204800"  
time\_file =\> "5"  
canned\_acl =\> "private"  
prefix =\> "pushnotification-logs/" }

```
    }
```

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [April 13, 2016, 2:10pm UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/2 "2016-04-13T14:10:49Z")

</div>

My logstash version is 2.1.1, can it cause problem.?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 13, 2016, 10:42pm UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/3 "2016-04-13T22:42:36Z")

</div>

Which mutate cause the issue? What does the data look like?

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [April 14, 2016, 5:03am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/4 "2016-04-14T05:03:21Z")

</div>

Mutate replace is not working.. data sample message is as below

{  
"\_index": "logstash-2016.04.14",  
"\_type": "logs",  
"\_id": "AVQTJjuTjVrAZiFXntGJ",  
"\_score": null,  
"\_source": {  
"message": "{"timestamp":"2016-04-14 00:02:31","message":"Android push zonea a","messageLevel":"INFO","component":2,"transactionId":0,"APP":"push\_notification","ML":"hSH46306616","SENDER":"hSH80674580","S":"pass","TYPE":"chat\_message","EndPt":"arn:aws:sns:us-east-1:238537778401:endpoint\/GCM\/com.shaadi\_android\/83977239-962e-33cd-a954-e68eada8f9d0","MSG\_TXT":"{\"data\":{\"message\":\"maam\",\"type\":\"CHAT\",\"pid\":\"hSH80674580\",\"display\_name\":\"Shivendu G\",\"message\_id\""} \r\n",  
"@version": "1",  
"@timestamp": "2016-04-14T05:02:32.912Z",  
"host": "10.0.0.20",  
"logTimestampString": "{"timestamp":"2016-04-14 00:02:31","message":"Android push zonea a","messageLevel":"INFO","component":2,"transactionId":0,"APP":"push\_notification","ML":"hSH46306616","SENDER":"hSH80674580","S":"pass","TYPE":"chat\_message","EndPt":"arn:aws:sns:us-east-1:238537778401:endpoint\/GCM\/com.shaadi\_android\/83977239-962e-33cd-a954-e68eada8f9d0","MSG\_TXT":"{\"data\":{\"message\":\"maam\",\"type\":\"CHAT\",\"pid\":\"hSH80674580\",\"display\_name\":\"Shivendu G\",\"message\_id\""} \r\n",  
"tags": [  
"\_dateparsefailure"  
]  
},  
"fields": {  
"@timestamp": [  
1460610152912  
]  
},  
"sort": [  
1460610152912  
]  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 14, 2016, 6:07am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/5 "2016-04-14T06:07:30Z")

</div>

Why isn't the JSON string in `message` being parsed? Temporarily disable the elasticsearch and s3 outputs and add a `stdout { codec => rubydebug }` output so we can see what happens. Please post

- the configuration that you consider working along with its output and
- the configuration that doesn't work along with its output.

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [April 15, 2016, 9:11am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/6 "2016-04-15T09:11:24Z")

</div>

Hey, Mutate is working now I have upgraded logstash version not its working. Thanks for help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250/7 "2017-07-06T05:02:04Z")

</div>