# Problems with mutate and python

**URL:** <https://discuss.elastic.co/t/problems-with-mutate-and-python/113584>\
**Category:** Logstash\
**Created:** [December 29, 2017, 12:21pm UTC](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584 "2017-12-29T12:21:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dabyd](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@dabyd](https://discuss.elastic.co/u/dabyd)\
**Post date:** [December 29, 2017, 12:21pm UTC](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584/1 "2017-12-29T12:21:13Z")

</div>

Hello,

I have prblems with mutate. I have problems separating the message into variables. For the variable "@campo1" the operation is correct, but for the other variables it does not work. it includes quotes or question marks.

I send my data by python:

while True:  
pulsaciones = random.uniform(50, 130)  
data = {'@campo1': pulsaciones, '@user':'Jhon Tr', 'hostname':socket.gethostname(), '@campo2':pulsaciones, '@campo3':pulsaciones }  
data\_string = json.dumps(data)  
s.send(json.dumps(data))

My config.conf  
input {  
tcp {  
# codec =\> json  
host =\> "127.0.0.1"  
port =\> 5959  
}

}

filter {  
mutate {  
gsub =\> [  
"message", '{', "",  
"message", '}', ""  
]  
gsub =\> [  
"message", "[\?#-]",".",  
"message", "/","\_"  
]  
}  
kv {  
source =\> "message"  
trim\_value =\> """  
trim\_key =\> ""\ ()"  
field\_split =\> ","  
value\_split =\> ":"  
remove\_field =\> ["message"]  
}  
mutate {  
convert =\> { "@campo1" =\> "integer" }  
convert =\> { "@campo2" =\> "integer" }  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
user =\> elastic  
password =\> changeme  
}

```
    stdout {
            codec => rubydebug
    }

```

}

And i see that in logstash

{  
""@campo2" =\> "90.56460061568626",  
"@timestamp" =\> 2017-12-29T12:08:53.893Z,  
""@campo3" =\> "90.56460061568626",  
"port" =\> 50550,  
"@version" =\> "1",  
"host" =\> "127.0.0.1",  
""@user" =\> "Jhon Tr",  
"@campo1" =\> 90,  
""hostname" =\> "osboxes"  
}

And i see that in kibana

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdc31896b634cbf004114464347df05fad6b3ec6.jpg)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 30, 2017, 8:55pm UTC](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584/2 "2017-12-30T20:55:44Z")

</div>

Use a json filter or json codec to process JSON data. With a tcp input like this you might have to use a json\_lines codec and change the Python code to end each JSON blob with a newline character.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 27, 2018, 8:55pm UTC](https://discuss.elastic.co/t/problems-with-mutate-and-python/113584/3 "2018-01-27T20:55:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.