# Mutate Convert not working as I expect

**URL:** <https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133>\
**Category:** Logstash\
**Created:** [May 5, 2021, 5:45am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133 "2021-05-05T05:45:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lachlan.simpson](https://avatars.discourse-cdn.com/v4/letter/l/50afbb/32.png) [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\
**Post date:** [May 5, 2021, 5:45am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133/1 "2021-05-05T05:45:14Z")

</div>

RHEL8.3, ELK 7.12.1, I am using `convert` as documented, but I just can't see what I've done wrong. Here's the filter, [per the docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert)

```auto
filter {
  if [pbs_accounting] {
    csv {
      separator => ";"
      columns => ["date", "pbs.event_code", "pbs.job_id", "pbs.job_conf"]
      quote_char => "%"
    }
    kv {
      source => "pbs.job_conf"
      remove_field => "pbs.job_conf"
      prefix => "pbs.conf."
    }
    if [pbs.conf.Exit_status] {
      mutate {
        convert => {
          "pbs.conf.Exit_status" => "integer"
        }
      }
    }
  }
}

```

This is what I see in Kibana

 ![Screenshot 2021-05-05 153957](https://us1.discourse-cdn.com/elastic/original/3X/8/7/8756940198bc8b43a0d426a27fc3c9a32f0ed711.png)

I have re-indexed ES.

From the picture/Kibana, I see: correct field name and type, but incorrect label (t for string instead of # for integer?)

How can I solve or fix this?

---

<div class="post-metadata">

**Author:** ![lachlan.simpson](https://avatars.discourse-cdn.com/v4/letter/l/50afbb/32.png) [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\
**Post date:** [May 5, 2021, 5:52am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133/2 "2021-05-05T05:52:41Z")

</div>

Actually - if the `pbs.conf.Exit_status` field didn't exist, would that cause a problem?

[later] Worth noting that checking it exists first doesn't fix the problem. Probably fixes other problems though.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [May 5, 2021, 8:02am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133/3 "2021-05-05T08:02:08Z")

</div>

@lachlan.simpson ,  
Yes if this field does not exist than it will cause a problem.

Try to add `pbs.conf.Exit_status` field in csv filter under column and in your csv as well.

---

<div class="post-metadata">

**Author:** ![lachlan.simpson](https://avatars.discourse-cdn.com/v4/letter/l/50afbb/32.png) [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\
**Post date:** [May 5, 2021, 9:29am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133/4 "2021-05-05T09:29:15Z")

</div>

The problem is that it doesn't exist on it's own at the `csv` level - it's in the `pbs.job_conf` ("message") field, which is why I then use `kv` to split them out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2021, 9:29am UTC](https://discuss.elastic.co/t/mutate-convert-not-working-as-i-expect/272133/5 "2021-06-02T09:29:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.