# Logstash replace: contatenate string with other field values

**URL:** <https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731>\
**Category:** Logstash\
**Created:** [November 21, 2016, 2:15pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731 "2016-11-21T14:15:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![slinky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slinky/32/13323_2.png) [@slinky](https://discuss.elastic.co/u/slinky)\
**Post date:** [November 21, 2016, 2:15pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/1 "2016-11-21T14:15:37Z")

</div>

In the [docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace) there is this replace example:

filter {  
mutate {  
replace =\> { "message" =\> "%{source\_host}: My new message" }  
}  
}

Now I wanna do something like this:

filter {  
mutate {  
replace =\> { "autonomous\_system.asn" =\> "as%{autonomous\_system\_number}" }  
}  
}

The "as" is a literal string and should form 1 one word with %{autonomous\_system\_number} (so without a space).

Sample output should be:  
"autonomous\_system.asn": "as1234"  
"autonomous\_system.asn": "as5678"

When I try my above example approach, the docs will not be indexed.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 21, 2016, 2:21pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/2 "2016-11-21T14:21:50Z")

</div>

Depending on your ES release field names can't contain periods. If you want a nested field, i.e.

```nohighlight
"autonomous_system": {
  "asn": "as1234"
}

```

in JSON, use the correct syntax for that (`[autonomous_system][asn]`).

---

<div class="post-metadata">

**Author:** ![slinky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slinky/32/13323_2.png) [@slinky](https://discuss.elastic.co/u/slinky)\
**Post date:** [November 21, 2016, 2:41pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/3 "2016-11-21T14:41:44Z")

</div>

I am using ES5. I changed the config to:  
replace =\> { "[autonomous\_system][asn]" =\> "as%{[autonomous\_system][asn]}" }

Now it made the index:  
green open %{autonomous\_system.asn} lVhCw3IcSOe2JPFV96A2Hw 5 1 18

I'm guessing ES sees the field as literal because there is no space between "as" and the field.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 21, 2016, 2:46pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/4 "2016-11-21T14:46:17Z")

</div>

> I'm guessing ES sees the field as literal because there is no space between "as" and the field.

No, that has nothing to do with it.

What does your configuration look like? What does an example event look like? Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![slinky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slinky/32/13323_2.png) [@slinky](https://discuss.elastic.co/u/slinky)\
**Post date:** [November 25, 2016, 2:02pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/5 "2016-11-25T14:02:52Z")

</div>

I found out that I was using another wrong JSON nested field syntax in  
output{ elasticsearch {index =\> "%{autonomous\_system.asn}" } }

Changed that also to index =\> "%{[autonomous\_system][asn]} and it worked.

So problem solved. Thanks for the help! What should I do with this topic now?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 25, 2016, 3:02pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/6 "2016-11-25T15:02:21Z")

</div>

> What should I do with this topic now?

You don't have to do anything.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2016, 3:02pm UTC](https://discuss.elastic.co/t/logstash-replace-contatenate-string-with-other-field-values/66731/7 "2016-12-23T15:02:21Z")

</div>

Closed on December 23, 2016, 3:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.