# Mutate beats field
**URL:** https://discuss.elastic.co/t/mutate-beats-field/74940
**Category:** Logstash
**Created:** [February 13, 2017, 11:06pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940 "2017-02-13T23:06:25Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 13, 2017, 11:06pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/1 "2017-02-13T23:06:25Z")
I cannot seem to get this to work:
`mutate { add_field => { "hostname" => "%{beat.hostname}" } }`
I used this template of code quite a bit and it is working just fine for other items.
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 13, 2017, 11:09pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/2 "2017-02-13T23:09:22Z")
I end up with this, visible from Kibana:
> t hostname %{BEAT.HOSTNAME}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 14, 2017, 6:45am UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/3 "2017-02-14T06:45:54Z")
You're using the wrong notation for nested fields.
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 14, 2017, 3:37pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/4 "2017-02-14T15:37:54Z")
Ohhh, so:
%{[beat].[hostname]} ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 14, 2017, 3:41pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/5 "2017-02-14T15:41:30Z")
No, `%{[beat][hostname]}`.
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 14, 2017, 3:44pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/6 "2017-02-14T15:44:38Z")
Ah....muchas gracias!
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 14, 2017, 3:45pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/7 "2017-02-14T15:45:28Z")
In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?
I want get some of them in line with other fields names created from my groks.
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 14, 2017, 4:22pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/8 "2017-02-14T16:22:30Z")
I can see in new logs coming in, that worked. Thank you very much sir.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 14, 2017, 5:45pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/9 "2017-02-14T17:45:56Z")
> In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?
I doubt you can change the field names being sent from those tools but you can certainly use Logstash to rename them.
---
### Author:  [@kopacko](https://discuss.elastic.co/u/kopacko)
#### Post date: [February 14, 2017, 5:55pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/10 "2017-02-14T17:55:57Z")
Yea true. Didn't want to add any undue cycles unless I needed to.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2017, 5:56pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940/11 "2017-03-14T17:56:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.