# Mutate - add\_field - only shows string not the value
**URL:** https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816
**Category:** Logstash
**Created:** [June 24, 2023, 3:32pm UTC](https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816 "2023-06-24T15:32:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@humblemags](https://discuss.elastic.co/u/humblemags)
#### Post date: [June 24, 2023, 3:32pm UTC](https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816/1 "2023-06-24T15:32:41Z")
Hi,
I am using Windows 10 with 7.17.6 on localhost install. Filebeat is input being sent to Logstash.
Yes, I know the json parser will handle this for me. But I do not understand why "someNewField"
does not have the value? -- Thank you
"someNewField" =\> "%{[message][paymentType]}",
This is my input:
```auto
{"id":11,"timestamp":"2019-08-03T19:37:51Z","paymentType":"Mastercard"}
```
This is my logstash conf:
```auto
input {
beats {
port => 5044
}
}
filter {
json {
source => "message"
}
mutate {
add_field => {
"someNewField" => "%{[message][paymentType]}"
}
}
}
output {
stdout { }
}
```
This is my output (i removed irrelevant lines):
```auto
{
"log" => {
"file" => {
"path" => "C:\\filebeat-7.17.6-windows-x86_64\\datainputs\\sample-json.log"
},
"someNewField" => "%{[message][paymentType]}",
"@timestamp" => 2023-06-24T15:23:40.505Z,
"input" => {
"type" => "log"
},
"id" => 12,
"@version" => "1",
"paymentType" => "Mastercard",
"message" => "{\"id\":12,\"timestamp\":\"2019-08-03T19:37:51Z\",\"paymentType\":\"Mastercard\"}",
"timestamp" => "2019-08-03T19:37:51Z",
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 24, 2023, 8:16pm UTC](https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816/2 "2023-06-24T20:16:08Z")
> [@humblemags](#):
>
> Yes, I know the json parser will handle this for me. But I do not understand why "someNewField"
> does not have the value?
Because there is no `paymentType` field nested under a `message` field.
Your message field looks like this:
```auto
{"id":11,"timestamp":"2019-08-03T19:37:51Z","paymentType":"Mastercard"}
```
When you parse it using the `json` filter the field `paymentType` will be created at the root of your document.
So, you need to use only `%{paymenteType}` in your mutate, not `[message][paymentType]`.
---
### Author:  [@humblemags](https://discuss.elastic.co/u/humblemags)
#### Post date: [June 24, 2023, 8:37pm UTC](https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816/3 "2023-06-24T20:37:34Z")
Well you are remarkable. That works!!
I was trying to work with the RHS (right hand side) with `%{paymenteType}` `[message][paymentType]`, and `%{[message][paymentType]}`, and `"%{[message][paymentType]}"` with other things I have been working on.
I get confused when any of those RHS syntaxes work and dont work.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2023, 8:38pm UTC](https://discuss.elastic.co/t/mutate-add-field-only-shows-string-not-the-value/336816/4 "2023-07-22T20:38:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.