# Logstash mutate replace field
**URL:** https://discuss.elastic.co/t/logstash-mutate-replace-field/82530
**Category:** Logstash
**Created:** [April 17, 2017, 7:01am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530 "2017-04-17T07:01:35Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 17, 2017, 7:01am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/1 "2017-04-17T07:01:36Z")
I'm trying to replace the field "message" with value .
My example input message is:
[{
"logID": 1,
"organizationID": 1,
"userID": 1001,
"appID": 123,
"moduleID": 1,
"screenID": 213,
"timeStamp": "2017-03-15 10:06:26",
"action": "Login",
"purpose": "log",
"role": "Doctor",
"location": "Hospital",
"ipaddress": "192.168.1.3",
"networkType": "desktop",
"method": "getAll",
"category": "normal",
"description": "successfully logged in"
},
{
"logID": 2,
"organizationID": 1,
"userID": 201,
"appID": 201,
"moduleID": 2,
"screenID": 224,
"timeStamp": "2017-03-15 10:36:06",
"action": "Login",
"purpose": "log",
"role": "Nurse",
"location": "Clinic",
"ipaddress": "192.168.2.6",
"networkType": "tablet",
"method": "addVitals",
"category": "minor error",
"description": "error logged"
}]
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 17, 2017, 7:03am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/2 "2017-04-17T07:03:59Z")
my logstash config:
02-beats-input.conf
input {
stdin {
codec =\> multiline{
pattern =\> "^%{TIMESTAMP\_ISO8601} "
negate =\> "true"
what =\> "next"
}
}
beats{
codec =\> "json"
port =\> 5044
ssl =\> false
}
}
12-json-filter.conf
filter {
json{
source =\> "message"
}
if [host] == "Ellora-PC1"{
mutate {
replace =\> ["host" , "JONES-PC"]
}
}
if [message] == ""appID": 123"{
mutate{
replace =\> ["message" , ""appID": "Android""]
}
}
}
30-elasticsearch-output.conf
output {
stdout { codec =\> rubydebug }
elasticsearch {
hosts =\> ["localhost:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 17, 2017, 7:05am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/3 "2017-04-17T07:05:11Z")
I want to change the appID:123 to appID: Android..
Someone guide me with it,
Thank you.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 17, 2017, 8:05am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/4 "2017-04-17T08:05:15Z")
I don't think that syntax is correct, at least not according to [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace)
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 17, 2017, 8:28am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/5 "2017-04-17T08:28:59Z")
{
"\_index": "filebeat-2017.04.17",
"\_type": "log",
"\_id": "AVt6pHH9rUTxMONdNdfb",
"\_score": null,
"\_source": {
"message": "\t"appID": 123,",
"tags": [
"\_jsonparsefailure",
"beats\_input\_codec\_json\_applied"
],
"@version": "1",
"@timestamp": "2017-04-17T06:40:44.023Z",
"fields": {
"tags": [
"json"
]
},
"beat": {
"name": "Ellora-PC1",
"hostname": "Ellora-PC1",
"version": "5.2.2"
},
"source": "C:\Users\Ellora\Downloads\log\_events\1log.txt",
"offset": 75,
"type": "log",
"input\_type": "log",
"host": "JONES-PC",
"MSG": "This is my first MEssage: 1223"
},
"fields": {
"@timestamp": [
1492411244023
]
},
"sort": [
1492411244023
]
}
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 17, 2017, 8:30am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/6 "2017-04-17T08:30:56Z")
> [@Jonesthomas](#):
>
> "message": "\t"appID": 123,",
"message": "\t"appID": 123,",.. can anyone say me what is the message format here?
and i want to change appID: 123 to appID: Android in the message field
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 18, 2017, 9:45am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/7 "2017-04-18T09:45:54Z")
Anyone?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 16, 2017, 9:59am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530/8 "2017-05-16T09:59:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.