# Replace multiple value in a specified field
**URL:** https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780
**Category:** Logstash
**Created:** [June 6, 2018, 10:23am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780 "2018-06-06T10:23:42Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@f26227279](https://discuss.elastic.co/u/f26227279)
#### Post date: [June 6, 2018, 10:23am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/1 "2018-06-06T10:23:42Z")
Hi, I want to replace 6 to TCP and 17 to UDP in the PROTOCOL field.
this is my logstash config:
```
input{
tcp{
host => "163.19.X.X"
port => 5510
codec => json
}
}
filter{
if [PROTOCOL] == "6"{
mutate{replace => {"PROTOCOL"=>"TCP"}}
}
if [PROTOCOL] == "17"{
mutate{replace => {"PROTOCOL"=>"UDP"}}
}
}
output{
elasticsearch {
codec => "json"
hosts => ["163.19.X.X:9200","163.19.X.X:9200","163.19.X.X:9200"]
user => "elastic"
password => "9ol./;p0"
}
```
but it can't work.
plz help me ☹
---
### Author:  [@arkady\_renko](https://discuss.elastic.co/u/arkady_renko)
#### Post date: [June 7, 2018, 3:39pm UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/2 "2018-06-07T15:39:47Z")
is PROTOCOL string or integer?
sample input would be helpful to debug.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 7, 2018, 4:17pm UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/3 "2018-06-07T16:17:20Z")
Or change the output to be 'stdout { codec =\> rubydebug }'. We can see that PROTOCOL is a string in Kibana, but that does not require that it is one in logstash. If rubydebug shows
```
PROTOCOL => 5
```
rather than
```
PROTOCOL => "5"
```
then you should change the if condition to match it
---
### Author:  [@f26227279](https://discuss.elastic.co/u/f26227279)
#### Post date: [June 12, 2018, 1:13am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/4 "2018-06-12T01:13:35Z")
thanks for your reply !
I found the "PROTOCOL" default type is number, and I want to change it to string such as 6 to TCP.
How can I do?
this is the logstash debug log:
`[2018-06-12T09:09:09,431][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.06.12", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"logstash-2018.06.12", "_type"=>"doc", "_id"=>"CI2H8WMBuct0wI0D_4PU", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [PROTOCOL]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"TCP\""}}}}}`
---
### Author:  [@f26227279](https://discuss.elastic.co/u/f26227279)
#### Post date: [June 12, 2018, 2:55am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/5 "2018-06-12T02:55:42Z")
it can work now!
final config:
```
input{
tcp{
host => "163.19.XX.X"
port => 5510
codec => json
}
}
filter{
if [PROTOCOL]==6 {
mutate{replace => {"PROTOCOL"=>"TCP"}}
}
if [PROTOCOL]==17 {
mutate{replace => {"PROTOCOL"=>"UDP"}}
}
if [PROTOCOL]==1 {
mutate{replace => {"PROTOCOL"=>"ICMP"}}
}
}
output{
elasticsearch {
codec => "json"
hosts => ["163.19.X.XX:9200"]
#user => "elastic"
#password => "9ol./;p0"
}
stdout{codec=> rubydebug}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 12, 2018, 6:59am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/6 "2018-06-12T06:59:25Z")
FYI a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter would be another way of doing this. For 3 values I don't think it matters which one you use.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2018, 6:59am UTC](https://discuss.elastic.co/t/replace-multiple-value-in-a-specified-field/134780/7 "2018-07-10T06:59:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.