# Mutate rename issue after upgrade
**URL:** https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558
**Category:** Logstash
**Created:** [June 1, 2021, 1:20am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558 "2021-06-01T01:20:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 1, 2021, 1:20am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558/1 "2021-06-01T01:20:42Z")
Hello,
I have a pipeline where that receives data from a F5 load balancer and parses it with the `cef` codec, in the filters I have a series of mutate using rename to change the name of some fields to their `ecs` correspondent, for example `requestMethod` is renamed to `http.request.method` and `response_code` is renamed to `http.response.status_code`.
Today I upgraded from 7.9.3 to 7.12.1 and one of the renames strangely stopped working, which broke some visualizations and alerts.
The renames appears in the pipeline in the following order among some other rename operations:
```auto
other renames
rename => { "requestMethod" => "[http][request][method]"}
rename => { "response_code" => "[http][response][status_code]"}
other renames
```
After the upgrade the rename for `http.response.status_code` stopped working, I tried to move it further down inside the `mutate` filter, but it didn't work, I needed to change the rename to an add\_field to bring back the field into my documents as it is needed.
```auto
other renames
rename => { "requestMethod" => "[http][request][method]"}
add_field => { "[http][response][status_code]" => "%{response_code}" }
other renames
```
I tried to replicate the issue in my lab, but the problem did not occur.
Has anyone seen anything like this before or have some tips of what I should investigate?
I use a lot of renames in my pipelines and now I will need to check everyone of them for this kind of issue.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 1, 2021, 1:28am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558/2 "2021-06-01T01:28:31Z")
> [@leandrojmp](#):
>
> ```auto
> rename => { "requestMethod" => "[http][request][method]"}
> rename => { "response_code" => "[http][response][status_code]"}
>
> ```
Does it make any difference if you do
```
rename => {
"requestMethod" => "[http][request][method]"
"response_code" => "[http][response][status_code]"
}
```
I never use multiple instances of an option on a filter because very occasionally logstash combines them in unexpected ways.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 1, 2021, 2:27am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558/3 "2021-06-01T02:27:50Z")
I think you are right, something weird is happening when logstash is combining those multiple rename options.
I have a big mutate block with multiple rename options, I've always used rename like this and never reached any weird issue until now.
I tried to change the order and the same field was still missing, tried to rename both fields in the same rename option and the same thing happened.
What solved the issue was to use a single rename option inside a new mutate block.
```auto
mutate {
rename => {
"requestMethod" => "[http][request][method]"
"response_code" => "[http][response][status_code]"
}
}
```
I will review all my pipelines to correct this, what is weird is that I wasn't able to replicate it yet, probably it is a issue that will only happen on some specific conditions like the number of renames for example.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2021, 2:28am UTC](https://discuss.elastic.co/t/mutate-rename-issue-after-upgrade/274558/4 "2021-06-29T02:28:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.