# Replace field value by part of output message

**URL:** <https://discuss.elastic.co/t/replace-field-value-by-part-of-output-message/206011>\
**Category:** Logstash\
**Created:** [October 31, 2019, 9:51am UTC](https://discuss.elastic.co/t/replace-field-value-by-part-of-output-message/206011 "2019-10-31T09:51:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kavindu\_manaram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavindu_manaram/32/56614_2.png) [@kavindu\_manaram](https://discuss.elastic.co/u/kavindu_manaram)\
**Post date:** [October 31, 2019, 9:51am UTC](https://discuss.elastic.co/t/replace-field-value-by-part-of-output-message/206011/1 "2019-10-31T09:51:02Z")

</div>

I want to replace level filed value by output message "levelName" 's value. Is it possible to do this in logstash conf?

```
filter {
	if [fields][level] == "default" {
		grok {
      match => {"message" => ["(?m)%{TIMESTAMP_ISO8601:timestamp}\|%{NOTSPACE:orgCode}\|%{NOTSPACE:traceId}\|%{WORD:levelName}\|%{NOTSPACE:logger}\|%{GREEDYDATA:message}"]}
    }
	}
	mutate {
	lowercase => ["level"]
	replace => ["level", %{level}]
}
}

```

above conf is invalid according to logstash

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 31, 2019, 2:31pm UTC](https://discuss.elastic.co/t/replace-field-value-by-part-of-output-message/206011/2 "2019-10-31T14:31:09Z")

</div>

> [@kavindu\_manaram](#):
>
> above conf is invalid according to logstash

What error message do you get?

> [@](#):
>
> replace =\> ["level", %{level}]

That sets the field [level] to the value of the field [level], so it is a no-op. Did you mean to use this?...

```
replace => { "level" => "%{levelName}" }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2019, 2:31pm UTC](https://discuss.elastic.co/t/replace-field-value-by-part-of-output-message/206011/3 "2019-11-28T14:31:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.