# Mutate, copy, destination field name expansion

**URL:** <https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428>\
**Category:** Logstash\
**Created:** [January 23, 2019, 2:51pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428 "2019-01-23T14:51:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ffknob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ffknob/32/37008_2.png) [@ffknob](https://discuss.elastic.co/u/ffknob)\
**Post date:** [January 23, 2019, 2:51pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428/1 "2019-01-23T14:51:27Z")

</div>

I'm trying to copy a field to a nested one with mutate-copy with a dynamic destination field name being (e. g. not hard coded in the pipeline conf). The thing is, the mutate-copy operation doesn't seens to expand the destination's field name:

```
mutate {
add_field =&gt; {
"id" =&gt; "NFe%{[origem][procEventoNFe][0][retEvento][0][infEvento][0][chNFe][0]}"
"timestamp" =&gt; "%{[origem][procEventoNFe][0][retEvento][0][infEvento][0][dhRegEvento]}"
"nSeqEvento" =&gt; "%{[origem][procEventoNFe][0][retEvento][0][infEvento][0][nSeqEvento]}"
}
copy =&gt; { "origem" =&gt; "[eventos][%{nSeqEvento}]" }
}

```

It generates in Elasticsearch the "events" -\> "%{nSeqEvento}" structure, and not something like "events" -\> "1".

Was that expected?

By the way

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 23, 2019, 5:07pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428/2 "2019-01-23T17:07:39Z")

</div>

Agreed. The following

```
input { generator { count => 1 message => '' } }
filter {
    mutate { add_field => { "a" => "b" "s" => 1 } }
    mutate { copy => { "a" => "%{s}" } }
}
output { stdout { codec => rubydebug } }

```

produces

```
      "%{s}" => "b"

```

I did not expect that.

---

<div class="post-metadata">

**Author:** ![ffknob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ffknob/32/37008_2.png) [@ffknob](https://discuss.elastic.co/u/ffknob)\
**Post date:** [January 24, 2019, 12:51pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428/3 "2019-01-24T12:51:50Z")

</div>

I'm actually trying to push objects into a nested field in Elasticsearch... The idea was to use the value of an identifier field to define the key of the nested object ([eventos][%{nSeqEvento}])...

Is there another way to "push" objects into a nested field in ES? Perhaps without having to define an identifier.

---

<div class="post-metadata">

**Author:** ![ffknob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ffknob/32/37008_2.png) [@ffknob](https://discuss.elastic.co/u/ffknob)\
**Post date:** [January 24, 2019, 1:19pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428/4 "2019-01-24T13:19:21Z")

</div>

I managed to work with something like this:

```
		ruby {
    		code => "
				nSeqEvento = event.get('[nSeqEvento]');
				event.set('[eventos][' + nSeqEvento + ']', event.get('[origem]'))
			"
  		}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2019, 1:29pm UTC](https://discuss.elastic.co/t/mutate-copy-destination-field-name-expansion/165428/5 "2019-02-21T13:29:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.