# Mutate switch statement?

**URL:** https://discuss.elastic.co/t/mutate-switch-statement/54720
**Category:** Logstash
**Created:** [July 5, 2016, 10:58am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720 "2016-07-05T10:58:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![memelet](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@memelet](https://discuss.elastic.co/u/memelet)
#### Post date: [July 5, 2016, 10:58am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720/1 "2016-07-05T10:58:02Z")

</div>

I am trying to convert the mongodb log levels from single characters to normal values. Is there a simpler way to do this than:

```
      if [level] == "D" {
        mutate { gsub => ["level", "D", "DEBUG"] }
      }
      if [level] == "I" {
        mutate { gsub => ["level", "I", "INFO"] }
      }
      if [level] == "W" {
        mutate { gsub => ["level", "W", "WARN"] }
      }
      if [level] == "E" {
        mutate { gsub => ["level", "E", "ERROR"] }
      }
      if [level] == "F" {
        mutate { gsub => ["level", "F", "FATAL"] }
      }
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 5, 2016, 11:24am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720/2 "2016-07-05T11:24:20Z")

</div>

Use the translate filter.

---

<div class="post-metadata">

### Author: ![memelet](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@memelet](https://discuss.elastic.co/u/memelet)
#### Post date: [July 5, 2016, 11:58am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720/3 "2016-07-05T11:58:41Z")

</div>

Excellent, thanks!

```
      translate {
        field => "level"
        dictionary => [
          "D", "DEBUG",
          "I", "INFO",
          "W", "WARN",
          "E", "ERROR",
          "F", "FATAL"
        ]
        exact => true
      }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720/4 "2017-07-06T04:49:29Z")

</div>