# Some fields are missing after rename.
**URL:** https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459
**Category:** Logstash
**Created:** [December 15, 2023, 2:47pm UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459 "2023-12-15T14:47:54Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 15, 2023, 2:47pm UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/1 "2023-12-15T14:47:54Z")
After logstash-oss is upgraded from 7.6.0 to 7.12.1, some fields are lost after parsing the nested JSON data of Kafka.
Kafka JSON example data: `{"timestamp":1702630468791,"region":"cn-north-3","eventId":"QER_INFO","args":{"unNum":2,"totalNum":12,"eventId":"QER_INFO"}}`
The parsing configuration in Logstash is as follows:
```auto
else if [eventId] == "QER_INFO" {
mutate {
rename => {
"[args][unNum]" => "[__args][unNum]"
"[args][totalNum]" => "[__args][totalNum]"
"__args" => "args"
}
}
mutate {
convert => { "[args][unNum]" => "integer" }
convert => { "[args][totalNum]" => "integer" }
}
}
```
Why does args contain only the totalNum field in the ES data that is actually imported to the database? No error is found in Logstash run logs.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 15, 2023, 2:56pm UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/2 "2023-12-15T14:56:46Z")
Hello and welcome,
Please share your entire logstash configuration, it is not possible to try to replicate without knowing how you are parsing your data.
Also, this filter is a little confusing, it is not clear what you want to achieve with it:
```auto
mutate {
rename => {
"[args][unNum]" => "[__args][unNum]"
"[args][totalNum]" => "[__args][totalNum]"
"__args" => "args"
}
}
```
Please also share the output you are getting for the sample message you shared and what is the expected output.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 15, 2023, 6:57pm UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/3 "2023-12-15T18:57:02Z")
> [@JHub-Wei](#):
>
> ```auto
> mutate {
> rename => {
> "[args][unNum]" => "[__args][unNum]"
> "[args][totalNum]" => "[__args][totalNum]"
> "__args" => "args"
> }
> }
>
> ```
You are making assumptions about the order of entries in a hash. In the distant past, that was valid, since Ruby hashes are ordered. But Java hashes are not, so upon the javafication of the pipeline engine, those assumptions became invalid. It looks like you only want to keep two entries within the [args] field. Split this into two rename filters, one for the two entries, one for [\_\_args].
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 1:36am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/4 "2023-12-16T01:36:32Z")
Kafka data is reported by the service party. Assume that the data is unreliable. To avoid unexpected exceptions during parsing, the args field is filtered. Only the unNum and totalNum fields are retained and other fields are discarded. and convert it to the integer type. Received with a new field \_\_args and renamed to args
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 1:46am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/5 "2023-12-16T01:46:58Z")
The output of the sample message shared is as follows:
```auto
{
"_index" : "wsk_access__qer_info_2023.12.15",
"_type" : "_doc",
"_id" : "PfZTa4wBxI1zWeQYzPgL",
"_score" : null,
"_source" : {
"args" : {
"totalNum" : 12
},
"eventId" : "QER_INFO",
"@timestamp" : "2023-12-15T16:54:28.791Z",
"_eventId" : "qer_info",
"region" : "cn-north-3",
"timestamp" : 1702630468791,
"@version" : "1"
},
"sort" : [
1702630468791
]
}
```
The expected output is:
```auto
{
"_index" : "wsk_access__qer_info_2023.12.15",
"_type" : "_doc",
"_id" : "PfZTa4wBxI1zWeQYzPgL",
"_score" : null,
"_source" : {
"@timestamp" : "2023-12-15T16:54:28.791Z",
"args" : {
"unNum" : 2,
"totalNum" : 12
},
"timestamp" : 1702630468791,
"eventId" : "QER_INFO",
"@version" : "1",
"region" : "cn-north-3",
"_eventId" : "qer_info"
},
"sort" : [
1702630468791
]
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 16, 2023, 1:48am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/6 "2023-12-16T01:48:28Z")
> [@JHub-Wei](#):
>
> Only the unNum and totalNum fields are retained and other fields are discarded. and convert it to the integer type. Received with a new field \_\_args and renamed to args
As mentioned You need to use two different mutates, it won't work this way as there is no guarantee on the order of the operations.
You need something like this:
```auto
mutate {
rename => {
"[args][unNum]" => "[__args][unNum]"
"[args][totalNum]" => "[__args][totalNum]"
}
}
mutate {
rename => {
"[__args]" => "[args]"
}
}
```
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 1:51am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/7 "2023-12-16T01:51:19Z")
One more thing, I find if I change the following writing, it will output as I expect:
```auto
else if [eventId] == "QER_INFO" {
mutate {
rename => ["[args][unNum]","[__args][unNum]"]
rename => ["[args][totalNum]","[__args][totalNum]"]
rename => ["__args","args"]
}
mutate {
convert => { "[args][unNum]" => "integer" }
convert => { "[args][totalNum]" => "integer" }
}
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 16, 2023, 1:55am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/8 "2023-12-16T01:55:59Z")
As mentioned, I would suggest that you use a complete different mutate block, if you are doing multiple mutates on the same field you should use a different mutate block.
This is mentioned in the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html).
> Each mutation must be in its own code block if the sequence of operations needs to be preserved.
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 1:56am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/9 "2023-12-16T01:56:06Z")
Do you mean that this way of writing does not work in logstash-oss version 7.12.1?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 16, 2023, 2:12am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/10 "2023-12-16T02:12:20Z")
Right, I think it stopped working in 5.0, but I could be wrong about that version number.
Split the three renames into two mutate filters.
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 2:22am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/11 "2023-12-16T02:22:09Z")
Thank you very much, this solved my problem
---
### Author:  [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)
#### Post date: [December 16, 2023, 2:22am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/12 "2023-12-16T02:22:57Z")
Thank you very much, this solved my problem.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 13, 2024, 2:23am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459/13 "2024-01-13T02:23:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.