# Logstash translate and replace filter not working

**URL:** <https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582>\
**Category:** Logstash\
**Created:** [June 18, 2020, 7:40am UTC](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582 "2020-06-18T07:40:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 7:40am UTC](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582/1 "2020-06-18T07:40:02Z")

</div>

I have 5 log files using the below Golang log pattern:

`2020-06-17 11:50:04 CEST | CORE | INFO | (pkg/collector/corechecks/net/ntp.go:162 in Run) | Failed to get clock offset from any ntp host`

And below is my filter:

```
filter {
        dissect {
            mapping => {
                "message" => "%{timestamp} %{+timestamp} %{tz}|%{module}|%{log_level}|%{package}|%{msg}"
            }
            remove_tag => ["_dissectfailure"]
        }
        translate {
            field => "[tz]"
            destination => "[tz_num]"
            dictionary => {
                "CET" => "+0100"
                "CEST" => "+0200"
            }
        }
        mutate {
            strip => ["timestamp","tz","module","log_level","package","msg"]
            replace => ["timestamp", "%{timestamp} %{tz_num}"]
        }
        date {
            match => ["timestamp" , "YYYY-MM-DD HH:mm:ss Z"]
        }
        mutate {
            remove_field => ["tz", "tz_num"]
        }
}

```

The problem is with the mutate(replace) which is not able to append the tz\_num. So, in the output, I always see like this:

` "timestamp" => "2020-06-17 11:50:04 %{tz_num}",`

Can you please advise what could be the problem here?

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [June 18, 2020, 12:18pm UTC](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582/2 "2020-06-18T12:18:56Z")

</div>

> [@marco2005](#):
>
> ```auto
> mutate {
> strip => ["timestamp","tz","module","log_level","package","msg"]
> replace => ["timestamp", "%{timestamp} %{tz_num}"]
> }
> 
> ```

replace is applied before strip. so your timestamp will be replaced first. you can use separate mutate blocks to control execution according to [this](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2020, 12:19pm UTC](https://discuss.elastic.co/t/logstash-translate-and-replace-filter-not-working/237582/3 "2020-07-16T12:19:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.