# Reference "numbered" fields in sprintf format

**URL:** https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064
**Category:** Logstash
**Created:** [August 26, 2016, 5:58pm UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064 "2016-08-26T17:58:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![kaung](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaung/32/11165_2.png) [@kaung](https://discuss.elastic.co/u/kaung)
#### Post date: [August 26, 2016, 5:58pm UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064/1 "2016-08-26T17:58:05Z")

</div>

I want to read the following json object in logstash.

> "aggregations": {  
> "\_percentile": {  
> "values": {  
> "5.0": 10,  
> "95.0": 10  
> }

The following doesn't work:

> mutate {  
> add\_field =\> { "target" =\> "%{[aggregations][\_percentile][values][5.0]}" }  
> }

exception:

> "reason"=\>"Field name [5.0] cannot contain '.'"

Neither the following:

> mutate {  
> add\_field =\> { "target" =\> "%{[aggregations][\_percentile][values]['5.0']}" }  
> }

No exception but `target` doesn't get the value

> "target":"%{[aggregations][\_percentile][values]['5.0']}

Is there a different syntax to read "number" fields? Technically, the field names are quoted. They are valid json syntax and should be treated as strings. Not sure why logstash sprintf format is not able to handle this.

---

<div class="post-metadata">

### Author: ![kaung](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaung/32/11165_2.png) [@kaung](https://discuss.elastic.co/u/kaung)
#### Post date: [August 26, 2016, 6:08pm UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064/2 "2016-08-26T18:08:50Z")

</div>

I used the following ruby filter wokaround. But it would be nice if mutate filter doesn't have so many surprises.

```
  ruby{
    code => "
      event['target'] = event['aggregations']['_percentile']['values']['5.0'];
    "
  }
```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 27, 2016, 11:38pm UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064/3 "2016-08-27T23:38:03Z")

</div>

Please raise an issue against the plugin so we can take a closer look 🙂

---

<div class="post-metadata">

### Author: ![kaung](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaung/32/11165_2.png) [@kaung](https://discuss.elastic.co/u/kaung)
#### Post date: [August 29, 2016, 3:13am UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064/4 "2016-08-29T03:13:01Z")

</div>

as you wish 🙂

> <https://github.com/logstash-plugins/logstash-filter-mutate/issues/82>

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064/5 "2017-07-06T04:41:15Z")

</div>