# Mutate and Columns combined

**URL:** <https://discuss.elastic.co/t/mutate-and-columns-combined/36327>\
**Category:** Logstash\
**Created:** [December 3, 2015, 10:33pm UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327 "2015-12-03T22:33:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Optius\_Prime](https://avatars.discourse-cdn.com/v4/letter/o/a87d85/32.png) [@Optius\_Prime](https://discuss.elastic.co/u/Optius_Prime)\
**Post date:** [December 3, 2015, 10:33pm UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327/1 "2015-12-03T22:33:45Z")

</div>

Hello Fellow Logstash users.

I have just started to use ELK and am impressed with it. I am trying to propose a project to my senior management. However i am getting a problem in trying to upload the data in appropriate fields - Fields are getting created but they are all strings. I understand that i need to use Mutate - Convert in my log.

PLEASE apologize me if it is a silly mistake. Could some one who has more experience point out my mistake and unblock me.  
I am getting error as

D:\logstash-2.1.0\bin\>logstash -f Logstash1.conf --configtest  
io/console not supported; tty will not be manipulated  
Error: Expected one of #, =\> at line 19, column 3 (byte 430) after filter {  
csv {  
columns =\> ["@timestamp", "logtype", "Machinename","Threads","CPUUtilizationPercent", "MemoryUtilizationPercent" ,"EthernetSentKbps" ,"EthernetReceivedKbps"]  
mutate

My data is in CSV and .log files  
My Config file is as follows.

input {  
stdin { }  
file {  
path =\> "d:\perfmon.csv"  
type =\> "csv"  
start\_position =\> "beginning"  
}  
file {  
path =\> "D:\logs\service\*.log"  
type =\> "\t"  
start\_position =\> "beginning"  
}  
}

filter {  
csv {  
columns =\> ["@timestamp", "logtype", "Machinename","Threads","CPUUtilizationPercent", "MemoryUtilizationPercent" ,"EthernetSentKbps" ,"EthernetReceivedKbps"]  
mutate  
{  
convert =\> ["Threads", "integer"]  
convert =\> ["CPUUtilizationPercent", "integer"]  
convert =\> ["MemoryUtilizationPercent", "float"]  
convert =\> ["EthernetSentKbps", "float"]  
convert =\> ["EthernetReceivedKbps", "float"]  
add\_field =\> {

```
							"logsource" => "%{logsource}"
							"method" => "%{method}"
					}
	}
    separator => ","
}

if "log" in [tags] {
		// Need to define the Log fields and the Format for specific fields.
}

```

}  
output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 4, 2015, 6:56am UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327/2 "2015-12-04T06:56:37Z")

</div>

You're missing the closing brace for the csv filter (i.e. right before "mutate").

---

<div class="post-metadata">

**Author:** ![Optius\_Prime](https://avatars.discourse-cdn.com/v4/letter/o/a87d85/32.png) [@Optius\_Prime](https://discuss.elastic.co/u/Optius_Prime)\
**Post date:** [December 4, 2015, 8:27pm UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327/3 "2015-12-04T20:27:51Z")

</div>

thanks -

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327/4 "2017-07-06T05:19:55Z")

</div>