# Logstash Replacing A Value

**URL:** <https://discuss.elastic.co/t/logstash-replacing-a-value/108781>\
**Category:** Logstash\
**Created:** [November 22, 2017, 6:57pm UTC](https://discuss.elastic.co/t/logstash-replacing-a-value/108781 "2017-11-22T18:57:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\
**Post date:** [November 22, 2017, 6:57pm UTC](https://discuss.elastic.co/t/logstash-replacing-a-value/108781/1 "2017-11-22T18:57:06Z")

</div>

I am working on filtering ftp logs that are in xml format. Everything works fine, but this one column that's labeled "host". If that column has data in it, that data will be put into elasticsearch. However, if that column has a blank spot, the source IP of the host that the xml is coming from goes into that spot instead of it being left blank 😕

I have tried to use

replace =\> {"host: 1.1.1.1" =\> "host: N/A"}

but logs do not ship at all. When I check the logstash logs, there is an error in there that says Filed names cannot use periods.

Do you have a way you recommend I replace that value with N/A or even a blank space, if the value is equal to the shipping host IP?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 22, 2017, 7:13pm UTC](https://discuss.elastic.co/t/logstash-replacing-a-value/108781/2 "2017-11-22T19:13:52Z")

</div>

Logstash events have a field called host, which is set to the name of the machine it runs on. You are overwriting that sometimes. If you do not overwrite it then it keeps the value it started with. You could try using a different field name for the data you are trying to index. Or if you really insist

```
if [host] == "1.1.1.1" {
    mutate { remove_field => ["host"] }
    mutate { add_field => { "host" => "NA" } }
  }
```

But I would definitely suggest using a different field if you can.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2017, 7:14pm UTC](https://discuss.elastic.co/t/logstash-replacing-a-value/108781/3 "2017-12-20T19:14:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.