# Mutate message in Logstash

**URL:** <https://discuss.elastic.co/t/mutate-message-in-logstash/233272>\
**Category:** Logstash\
**Created:** [May 19, 2020, 8:11am UTC](https://discuss.elastic.co/t/mutate-message-in-logstash/233272 "2020-05-19T08:11:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joseph-Gan-wk](https://avatars.discourse-cdn.com/v4/letter/j/ba9def/32.png) [@Joseph-Gan-wk](https://discuss.elastic.co/u/Joseph-Gan-wk)\
**Post date:** [May 19, 2020, 8:11am UTC](https://discuss.elastic.co/t/mutate-message-in-logstash/233272/1 "2020-05-19T08:11:04Z")

</div>

Hi all,  
I want to ask is that Logstash filtering support the case like this:-

value field is ABCDE, abcde, 12345, @#$%

if the value field is ABCDE and abcde,  
then overwrite ABCE and abcde to 98765.

```auto
mutate {
	match => ["destination", "RSC 8 Entry Zone","RSC 8 Exit Zone","RSC ENTRY GENERAL ACCESS","RSC EXIT GENERAL ACCESS","RSC9 T1 MALE ENTRY TURNSTILE","RSC9 T1 MALE EXIT TURNSTILE"]
	update => {"destination", "RSC"}
	}

```

\*mutate filter is no support match  
something like that, but i am not sure what method is suitable to use.

---

<div class="post-metadata">

**Author:** ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)\
**Post date:** [May 19, 2020, 9:31am UTC](https://discuss.elastic.co/t/mutate-message-in-logstash/233272/2 "2020-05-19T09:31:05Z")

</div>

For just a couple of values as your introductory example, you may use a conditional block `if [field] in ["ABCDE", "abcde"] {...` with [mutate - replace](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace)

If there is a bigger list of entries you want to replace with different values (in your configuration example, just a unique value for all the entries), you could also use a [translate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) with a dictionary, which might be more readable and flexible.  
Take care of the option `override => true` to actually overwrite the field.

---

<div class="post-metadata">

**Author:** ![Joseph-Gan-wk](https://avatars.discourse-cdn.com/v4/letter/j/ba9def/32.png) [@Joseph-Gan-wk](https://discuss.elastic.co/u/Joseph-Gan-wk)\
**Post date:** [May 21, 2020, 7:11am UTC](https://discuss.elastic.co/t/mutate-message-in-logstash/233272/3 "2020-05-21T07:11:32Z")

</div>

@andres-perez  
thanks, it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2020, 7:11am UTC](https://discuss.elastic.co/t/mutate-message-in-logstash/233272/4 "2020-06-18T07:11:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.