# New operation for the mutate filter?

**URL:** <https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070>\
**Category:** Logstash\
**Created:** [February 14, 2017, 3:40pm UTC](https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070 "2017-02-14T15:40:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [February 14, 2017, 3:40pm UTC](https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070/1 "2017-02-14T15:40:07Z")

</div>

I often find myself using the `ruby` filter below in order to "move" a sub-structure at the root level in order to use it as the main event.

```
  ruby {
     code => "
        event.to_hash.delete_if {|k, v| k != 'payload'}
        event.to_hash.update(event.get('payload').to_hash)
        event.to_hash.delete_if {|k, v| k == 'payload'}
     "
  }

```

Disclaimer: I'm a Ruby noob, so I'm pretty sure there's a better way to achieve the exact same thing. Feel free to chime in if you have a better way.

For instance, the raw events I get are of the following form:

```
{
     "bla": "bla",
     "meh": "meh",
     "payload" : {
          "foo" : "1224",
          "bar" : "woohoo",
          "baz" : 0,
          "timestamp" : 1449356706000
     }
}

```

And I would like the event to actually be whatever is inside the `payload` field:

```
{
     "foo" : "1224",
     "bar" : "woohoo",
     "baz" : 0,
     "timestamp" : 1449356706000
 }

```

I could create a new `filter` plugin just for this, but I'm wondering if this operation shouldn't belong to the existing `mutate` filter. And if yes, how would that operation be called? `extract`, `reify`, `move`, `promote`, `copy` ?

I welcome any thoughts on this.

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [February 15, 2017, 10:14am UTC](https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070/2 "2017-02-15T10:14:54Z")

</div>

I ended up adding a new "copy" operation to the `mutate` filter.

The feature request is described here:

> <https://github.com/logstash-plugins/logstash-filter-mutate/issues/90>

The pull request is available here:

> <https://github.com/logstash-plugins/logstash-filter-mutate/pull/91>

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 15, 2017, 9:41pm UTC](https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070/3 "2017-02-15T21:41:41Z")

</div>

Fantastic idea and PR 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2017, 9:42pm UTC](https://discuss.elastic.co/t/new-operation-for-the-mutate-filter/75070/4 "2017-03-15T21:42:29Z")

</div>

Closed on March 15, 2017, 9:42pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.