# Mutate replace using if

**URL:** <https://discuss.elastic.co/t/mutate-replace-using-if/301393>\
**Category:** Logstash\
**Created:** [April 2, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-replace-using-if/301393 "2022-04-02T15:09:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![travlest](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@travlest](https://discuss.elastic.co/u/travlest)\
**Post date:** [April 2, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-replace-using-if/301393/1 "2022-04-02T15:09:05Z")

</div>

Hi, I have a question regarding updating and removing logstash. My situation is, that I am collecting logs using API, for the first time data is being shipped into logstash, the "GeoIP" is empty space, but it will have updated/removed in the future.

If there are any changes for the "GeoIP" field, I already set it will store date and time into the field "Whois\_geoip\_changes" using the below code, and it's working as shown in the picture.

 ![aa_720](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed6edc3d18a763b7d9db221409bb91b0237b3589.png)

```auto
if [Geoip] =~ /.+/ {
   mutate {
    replace => { "Whois_geoip_changes" => "%{@timestamp}" }
  }
}

```

But the problem now is, that the @datetime for other fields will keep on changing even though the data is still the same. I would like to know, is it possible to

1. if data (example _Nameserver_ field) removes, the "_Whois\_nameservers\_changes_" date will still show the date on when is the data being removed.

2. if data (example _Nameserver_ field) did not have any changes or updates, the "_Whois\_nameservers\_changes_" (@datetime) date will still remain the same.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2022, 3:09pm UTC](https://discuss.elastic.co/t/mutate-replace-using-if/301393/2 "2022-04-30T15:09:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.