# Rename field after extracting it from another field
**URL:** https://discuss.elastic.co/t/rename-field-after-extracting-it-from-another-field/145772
**Category:** Logstash
**Created:** [August 23, 2018, 3:27pm UTC](https://discuss.elastic.co/t/rename-field-after-extracting-it-from-another-field/145772 "2018-08-23T15:27:09Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@erezgby](https://discuss.elastic.co/u/erezgby)
#### Post date: [August 23, 2018, 3:27pm UTC](https://discuss.elastic.co/t/rename-field-after-extracting-it-from-another-field/145772/1 "2018-08-23T15:27:10Z")
Hi,
I'm using kv filter in order to extract several fields out of "attributes" field, which works just fine.
But then, I need to apply a mutate filter (rename in my case on one of this key-value pair that was extracted)
I tried the following:
json {
source =\> "message"
}
grok {
match =\> ["message", "%{DATESTAMP:time}|\s+%{DATA:trackingid}|\s+%{DATA:attributes}|\s+%{NUMBER:responsetime}?"]
add\_field =\> {
"level" =\> "info"
"application\_name" =\> "sample\_app"
}
}
kv {
source =\> "attributes"
field\_split =\> ", "
}
mutate {
rename =\> { "originalValue" =\> "newValue" }
}
The "originalValue" exists in the attributes, but the rename is not working in that case.
Any suggestions?
Thanks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 23, 2018, 6:24pm UTC](https://discuss.elastic.co/t/rename-field-after-extracting-it-from-another-field/145772/2 "2018-08-23T18:24:24Z")
Please show an example of a processed event. Use a `stdout { codec => rubydebug }` output to dump the raw event.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2018, 6:24pm UTC](https://discuss.elastic.co/t/rename-field-after-extracting-it-from-another-field/145772/3 "2018-09-20T18:24:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.