# Mutate add\_field and rename don't work

**URL:** https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868
**Category:** Logstash
**Created:** [February 10, 2021, 12:26pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868 "2021-02-10T12:26:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Ernesto\_Guerra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesto_guerra/32/77872_2.png) [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)
#### Post date: [February 10, 2021, 12:26pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868/1 "2021-02-10T12:26:13Z")

</div>

Hi,  
I'm trying to use mutate filter to change the name of a field. I've tried rename but it doesn't do anything, and tried creating a new field and passing the contents of the old one and didn't work either.

My first try was to rename field "o" to "operacion"

The code was:

```auto
mutate {
        rename => { "o" => "operacion" }
      }

```

It didn't do anything.

Then I tried adding a field and passing the value of "o".

My code is:

```auto
  mutate {
        add_field => { "operacion" => "%{o}"}
      }

```

And as a result I get the following result:

```auto
{
            "g1" => 0,
    "@timestamp" => 2021-02-10T12:07:31.282Z,
             "o" => "PILOTO",
            "g2" => 0,
          "host" => "ubuntu",
      "@version" => "1",
     "operacion" => "%{o}",
             "i" => "3780385637",
            "g3" => 0
}

```

It doesn't parse the data of the field it just adds the literal "%{o}"

Thanks in advance.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [February 10, 2021, 12:57pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868/2 "2021-02-10T12:57:43Z")

</div>

The below works for me. Could it be where you are placing your `mutate` block?

```auto
input {
  generator {
    lines => ['{ "o":"text" }']
    codec => "json"
  }
}
filter {
  mutate {
    rename => { "o" => "operacion" }
  }
}
output { stdout { } }

```

---

<div class="post-metadata">

### Author: ![Ernesto\_Guerra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ernesto_guerra/32/77872_2.png) [@Ernesto\_Guerra](https://discuss.elastic.co/u/Ernesto_Guerra)
#### Post date: [February 10, 2021, 2:43pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868/3 "2021-02-10T14:43:31Z")

</div>

Thank you. Both, add\_field and rename worked perfectly in the moment that I specified the codec line

```auto
codec => "json"

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 10, 2021, 2:44pm UTC](https://discuss.elastic.co/t/mutate-add-field-and-rename-dont-work/263868/4 "2021-03-10T14:44:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.