# Mutate - replace source value
**URL:** https://discuss.elastic.co/t/mutate-replace-source-value/672
**Category:** Logstash
**Created:** [May 14, 2015, 9:31am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672 "2015-05-14T09:31:56Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@achechen](https://discuss.elastic.co/u/achechen)
#### Post date: [May 14, 2015, 9:31am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/1 "2015-05-14T09:31:56Z")
I am trying to change the value of the @source field in my syslogs using mutate - replace. logstash configuration:
```
[/opt/logstash/bin] # cat /etc/logstash/conf.d/logstash.conf
input {
tcp {
port => 5000
type => syslog }
udp {
port => 5000
type => syslog }
gelf {
port => 12201
type => windows
codec => "json" }
}
filter {
if [message] =~ /default send string/ {
drop {}
}
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] }
}
if [source] == "0\:0\:0\:0\:0\:0\:0\:1" {
mutate {
replace => ["@source", "{%syslog_hostname}"]
}
}
date {
match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
gelf {
host => "xxxxxxxxx"
port => 12202
}
}
```
What I am trying to do is if the value of source field is 0:0:0:0:0:0:0:1 change it to the value of syslog\_hostname field.
The logs are still showing 0:0:0:0:0:0:0:1 as the source value.
I have also tried 0:0:0:0:0:0:0:1 instead of 0:0:0:0:0:0:0:1 and if [@source] instead of if [source] in the configuration file.
Thank you in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 14, 2015, 10:10am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/2 "2015-05-14T10:10:34Z")
There are a couple of problems with this configuration:
- Is the field named `source` or `@source`? Either way you're referring to the field inconsistently (sometimes `source` and sometimes `@source`).
- The colon shouldn't be escaped, so your conditional should say `if [source] == "0:0:0:0:0:0:0:1" {` (assuming the field is named `source`).
- `{%syslog_hostname}` should be `%{syslog_hostname}`.
---
### Author:  [@achechen](https://discuss.elastic.co/u/achechen)
#### Post date: [May 14, 2015, 10:35am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/3 "2015-05-14T10:35:16Z")
Thank you!
I have corrected the config as follows:
```
if [source] == "0:0:0:0:0:0:0:1" {
mutate {
replace => ["source", "%{syslog_hostname}"]
}
}
```
But logs are still coming into elasticsearch with 0:0:0:0:0:0:0:1 value in the source field.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 14, 2015, 11:31am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/4 "2015-05-14T11:31:24Z")
Reduce your example to the bare minimum so that you can debug it more easily. Use stdin and stdout for input/output and have nothing but your mutate filter. Like this:
```
input { stdin { codec => json } }
output { stdout { codec => rubydebug } }
filter {
if [source] == "0:0:0:0:0:0:0:1" {
mutate {
replace => ["source", "%{syslog_hostname}"]
}
}
}
```
Then feed this on stdin of a Logstash process with the configuration above:
```
{"source": "0:0:0:0:0:0:0:1", "syslog_hostname": "foo"}
```
Do you get the expected results?
---
### Author:  [@achechen](https://discuss.elastic.co/u/achechen)
#### Post date: [May 14, 2015, 1:24pm UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/5 "2015-05-14T13:24:55Z")
It works now, it was my mistake ☹ Thank you for your help!
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [March 22, 2016, 8:18am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/6 "2016-03-22T08:18:51Z")
Hi I am trying to replace field "component " but not showing in output what exactly i am doing wrong . I am new to ELK. below is my logstash config.
input {
tcp {
'port' =\> '9563'
}
}
filter {
json {
source =\> 'message'
}
if [component] == "0" {
mutate {
replace =\> ["component", "others"]
}
}
if [component] == "1" {
mutate {
replace =\> ["component", "datawarehouse"]
}
}
}
output {
stdout { codec =\> rubydebug }
elasticsearch{ hosts =\> "90.0.3.63:9200" }
file {
'path' =\> '/tmp/output.log'
}
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 22, 2016, 9:01am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/7 "2016-03-22T09:01:17Z")
This thread is quite old. Please start your own thread instead.
---
### Author:  [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)
#### Post date: [April 18, 2017, 9:16am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/8 "2017-04-18T09:16:35Z")
i too face the same scenario..someone please guide us,Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/mutate-replace-source-value/672/9 "2017-07-06T04:26:59Z")