# Mutate filter doesn't work with error.message (heartbeat) field
**URL:** https://discuss.elastic.co/t/mutate-filter-doesnt-work-with-error-message-heartbeat-field/116261
**Category:** Logstash
**Created:** [January 19, 2018, 3:07pm UTC](https://discuss.elastic.co/t/mutate-filter-doesnt-work-with-error-message-heartbeat-field/116261 "2018-01-19T15:07:20Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)
#### Post date: [January 19, 2018, 3:07pm UTC](https://discuss.elastic.co/t/mutate-filter-doesnt-work-with-error-message-heartbeat-field/116261/1 "2018-01-19T15:07:20Z")
Hello,
trying to do a quick filter to replace a given heartbeat field value based on the value of other field but it seems when the field has a dot in the name `t error.message`, the filter doesn't work:
works:
```
if [ip] == "10.10.11.25" {
mutate {
replace => ["up", "true"]
}
}
```
doesn't work:
```
if [error.message] == "401 Unauthorized" {
mutate {
replace => ["up", "true"]
}
}
```
Is there anything special about those types of fields or I am missing something here?
Thanks in advance,
--Boz
---
### Author:  [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)
#### Post date: [January 19, 2018, 3:20pm UTC](https://discuss.elastic.co/t/mutate-filter-doesnt-work-with-error-message-heartbeat-field/116261/2 "2018-01-19T15:20:53Z")
Sorry, got it to work. I just learned subfields existed. specifying [error][message] fixed it.
if [error][message] == "401 Unauthorized" {
mutate {
replace =\> ["up", "true"]
}
}
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2018, 3:21pm UTC](https://discuss.elastic.co/t/mutate-filter-doesnt-work-with-error-message-heartbeat-field/116261/3 "2018-02-16T15:21:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.