# Logstash Mutate replace field with value

**URL:** <https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086>\
**Category:** Logstash\
**Created:** [March 22, 2016, 10:02am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086 "2016-03-22T10:02:29Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [March 22, 2016, 10:02am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/1 "2016-03-22T10:02:29Z")

</div>

Hi I am trying to replace field "component " but not showing in output what exactly i am doing wrong . I am new to ELK. below is my logstash config.

input {  
tcp {  
'port' =\> '9563'  
}  
}

filter {  
json {  
source =\> 'message'  
}  
if [component] == "0" {  
mutate {  
replace =\> ["component", "others"]  
}  
}  
if [component] == "1" {  
mutate {  
replace =\> ["component", "datawarehouse"]  
}  
}  
}

output {  
stdout { codec =\> rubydebug }  
elasticsearch{ hosts =\> "XX.xx.xx.xx:9200" }  
file {  
'path' =\> '/tmp/output.log'  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2016, 10:16am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/2 "2016-03-22T10:16:09Z")

</div>

Please show an example input message.

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [March 22, 2016, 12:12pm UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/3 "2016-03-22T12:12:21Z")

</div>

{"timestamp":"2016-03-22 17:42:06","message":"[Start]","messageLevel":"INFO","component":1,"transactionId":0,"Project":"Datawarehouse","Database":"slave","LogClass":"DCS"}{"timestamp":"2016-03-22 17:42:06","message":"1 table(s) found","messageLevel":"INFO","component":1,"transactionId":0,"Project":"Datawarehouse","Database":"slave","LogClass":"DCS"}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2016, 12:45pm UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/4 "2016-03-22T12:45:54Z")

</div>

The `component` field is apparently an integer field and not a string so your conditional needs to look like this:

```
if [component] == 1 {
```

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [March 23, 2016, 5:25am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/5 "2016-03-23T05:25:41Z")

</div>

Thank you. It worked can see in elasticsearch but can not see the component in kibana. Showing blank in as componen.

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [March 23, 2016, 5:48am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/6 "2016-03-23T05:48:03Z")

</div>

sorry my mistake i generated new index and problem solved but i want to know can i use other compression operators like (\>=,\<=, \<,\>) in filter.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 23, 2016, 6:30am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/7 "2016-03-23T06:30:26Z")

</div>

Please consult the documentation: [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)

---

<div class="post-metadata">

**Author:** ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Post date:** [March 23, 2016, 11:48am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/8 "2016-03-23T11:48:37Z")

</div>

Thank you for helping.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field-with-value/45086/9 "2017-07-06T05:05:42Z")

</div>