# Replace doesn't seem to be working

**URL:** <https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518>\
**Category:** Logstash\
**Created:** [April 30, 2024, 7:45pm UTC](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518 "2024-04-30T19:45:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [April 30, 2024, 7:45pm UTC](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518/1 "2024-04-30T19:45:34Z")

</div>

This is what I am trying:

```auto
# if geoip city and region are both blank, replace region value with country value
# this is to avoid double ?s in alerts for example "?,?"
if [geoip][city_name] == "?" and [geoip][region_name] == "?" {
    mutate {
        replace => { "[geoip][region_name]" => "%{[geoip][country_name]}" }
    }
}

```

However the "`?`" in `geoip.region_name` is still there, not replaced. Any idea why?

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [May 22, 2024, 3:08pm UTC](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518/2 "2024-05-22T15:08:36Z")

</div>

> [@roman-tasi](#):
>
> This is what I am trying:
> 
> ```auto
> # if geoip city and region are both blank, replace region value with country value
> # this is to avoid double ?s in alerts for example "?,?"
> if [geoip][city_name] == "?" and [geoip][region_name] == "?" {
> mutate {
> replace => { "[geoip][region_name]" => "%{[geoip][country_name]}" }
> }
> }
> 
> ```
> 
> However the "`?`" in `geoip.region_name` is still there, not replaced. Any idea why?

Hi,

The issue might be due to the condition in your if statement. In Logstash, the == operator checks for exact equality. If the fields [geoip][city\_name] and [geoip][region\_name] contain any additional whitespace or different casing, the condition will not be met, and the mutate filter will not be applied.

Or you should check for their existence before trying to access their values.

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 22, 2024, 3:22pm UTC](https://discuss.elastic.co/t/replace-doesnt-seem-to-be-working/358518/3 "2024-05-22T15:22:24Z")

</div>

> [@roman-tasi](#):
>
> However the "`?`" in `geoip.region_name` is still there, not replaced.

Another possiblity is that it is being replaced by the country\_name, which is also set to "?".