# Mutate is not working as expected

**URL:** <https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423>\
**Category:** Logstash\
**Created:** [January 17, 2020, 7:54am UTC](https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423 "2020-01-17T07:54:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\
**Post date:** [January 17, 2020, 7:54am UTC](https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423/1 "2020-01-17T07:54:49Z")

</div>

Hello All ,

I am trying to convert MaxTasks field to Interger , I tried two ways here . Specifying the Number format in Grok filter also converting it to Integer using Mutate filter. But of no use. Anything wrong here ? please help.

```
    filter {

mutate {
      remove_field => ["host"]
		}

if "srvr_logs" in [tags] 
{
grok {
match => {"message" => "%{WORD:EventType}%{SPACE}%{WORD:EventSubType}%{SPACE}%{INT:Severity}%{SPACE}%{WORD:SARMID}%{NOTSPACE}%{SPACE}%{PROG:EventDate}%{SPACE}%{TIME:EventTime}%{SPACE}%{GREEDYDATA:LogMessage}"}
	}
}
else {

ruby {
            code => '
                event.set("message", event.get("message").split("\n"))
            '
				}
        split {
            field => "message"
				}
grok {
    match => {
      "message" => [
      #Most specific grok:
        "%{WORD:ServerName}%{SPACE}%{WORD:Comp_Alias}%{SPACE}%{WORD:CompStatus}%{SPACE}%{WORD:CompStartMode}%{SPACE}%{NUMBER:RunningTasks	}%{SPACE}%{NUMBER:MaxTasks}%{SPACE}%{GREEDYDATA:CompName}",
      #Less specific:
        "%{WORD:SBLSRVR_NAME}%{SPACE}%{WORD:SBLSRVR_STATE}"
     ]
  }

}
mutate {
         convert => { "MaxTasks" => "integer" }
       }  
}
       
}
```

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 17, 2020, 8:55am UTC](https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423/2 "2020-01-17T08:55:52Z")

</div>

Hello,  
Have you created a new mapping for your index ?

---

<div class="post-metadata">

**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\
**Post date:** [January 17, 2020, 10:54am UTC](https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423/3 "2020-01-17T10:54:46Z")

</div>

Hello @grumo35 ,

Thanks for your reply. I have deleted the old indexes and restarted the logstash. Changed the grok filter as below. It worked . Thanks

`%{WORD:ServerName}%{SPACE}%{WORD:Comp_Alias}%{SPACE}%{WORD:CompStatus}%{SPACE}%{WORD:CompStartMode}%{SPACE}%{NUMBER:RunningTasks:int	}%{SPACE}%{NUMBER:MaxTasks:int}%{SPACE}%{GREEDYDATA:CompName}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2020, 10:54am UTC](https://discuss.elastic.co/t/mutate-is-not-working-as-expected/215423/4 "2020-02-14T10:54:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.