# Logstash mutate replace filter fails **URL:** \ **Category:** Logstash\ **Created:** [October 30, 2019, 11:08am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827 "2019-10-30T11:08:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![LeonZC](https://avatars.discourse-cdn.com/v4/letter/l/919ad9/32.png) [@LeonZC](https://discuss.elastic.co/u/LeonZC)\ **Post date:** [October 30, 2019, 11:08am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/1 "2019-10-30T11:08:08Z")
I have field called "zone" and i am trying to replace the field value by using mutate to "BlockA" when the field value of "zone" is "Z0". Here is the code that I am using: ``` filter { if [source] =~ "file.log" { grok { match => { "message" => "%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} \[%{GREEDYDATA:zone}\]\[%{GREEDYDATA:module}\]\[%{GREEDYDATA:severity}\]: %{GREEDYDATA:message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } filter { if "[zone]" == Z0 { mutate { replace => ["[zone]", "BlockA"] } } } } } ``` But everytime i am trying to start the logstash service i am getting this error and i don't know where the problem lies. Here is the error that i am getting: `[2019-10-30T11:55:21,672][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 11, column 4 (byte 874) after filter {\nif [source] =~ \"file.log\" {\n grok {\n match => { \"message\" => \"%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} \\[%{GREEDYDATA:zone}\\]\\[%{GREEDYDATA:module}\\]\\[%{GREEDYDATA:severity}\\]: %{GREEDYDATA:message}\" }\n add_field => [\"received_at\", \"%{@timestamp}\"]\n add_field => [\"received_from\", \"%{host}\"]\n }\nfilter {\nif ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile\_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:26:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}` ---
**Author:** ![st3inbeiss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/st3inbeiss/32/55332_2.png) [@st3inbeiss](https://discuss.elastic.co/u/st3inbeiss)\ **Post date:** [October 30, 2019, 12:53pm UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/2 "2019-10-30T12:53:50Z")
Ok that's just syntax... Your conditional ` if "[zone]" == Z0 {` Should be like ` if [zone] == "Z0" {` And your replace `replace => ["[zone]", "BlockA"]` should be `replace => {"zone" => "BlockA"}` See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) and [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace) ---
**Author:** ![LeonZC](https://avatars.discourse-cdn.com/v4/letter/l/919ad9/32.png) [@LeonZC](https://discuss.elastic.co/u/LeonZC)\ **Post date:** [October 30, 2019, 2:03pm UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/3 "2019-10-30T14:03:05Z")
I arranged the syntax, but i am still getting the same error. Code: ``` filter { if [source] =~ "file.log" { grok { match => { "message" => "%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} \[%{GREEDYDATA:zone}\]\[%{GREEDYDATA:module}\]\[%{GREEDYDATA:severity}\]: %{GREEDYDATA:message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } filter { if [zone] == "Z0" { mutate { replace => {"zone" => "BlockA"} } } } } } ``` Error: `[2019-10-30T14:55:56,900][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 11, column 4 (byte 878) after filter {\nif [source] =~ \"file.log\" {\n grok {\n match => { \"message\" => \"%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} \\[%{GREEDYDATA:zone}\\]\\[%{GREEDYDATA:module}\\]\\[%{GREEDYDATA:severity}\\]: %{GREEDYDATA:message}\" }\n add_field => [\"received_at\", \"%{@timestamp}\"]\n add_field => [\"received_from\", \"%{host}\"]\n }\nfilter {\n if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile\_sources'", "org/jruby/RubyArray.java:2584:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:26:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 30, 2019, 2:22pm UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/4 "2019-10-30T14:22:05Z")
You cannot nest a filter {} section inside a filter {} section. Remove the second filter { ---
**Author:** ![LeonZC](https://avatars.discourse-cdn.com/v4/letter/l/919ad9/32.png) [@LeonZC](https://discuss.elastic.co/u/LeonZC)\ **Post date:** [October 31, 2019, 11:57am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/5 "2019-10-31T11:57:57Z")
I finally got it to work, the main problem was the `if [source] =~ "file.log"` statement was not grabbing the file thus it couldn't find "Z0" in the field "zone" that's why the mutate wasn't working. I solved it by removing that if statement so now the filter will be applied to the log files that filebeat is grabbing which are not of type syslog. I also fixed my syntax thanks to you guys because the syntax that i had wasn't correct. Here is my final code: ``` filter { grok { match => { "message" => "%{DAY:day} %{MONTH:month} %{MONTHDAY:date} %{TIME:time} %{YEAR:year} \[%{GREEDYDATA:zone}\]\[%{GREEDYDATA:module}\]\[%{GREEDYDATA:severity}\]: %{GREEDYDATA:message_content}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } } filter { if [zone] == "Z0" { mutate { replace => { "zone" => "Zone0 - BlockA" } } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2019, 11:58am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-filter-fails/205827/6 "2019-11-28T11:58:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.