# Some problem of if and mutate in logstash filter
**URL:** https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585
**Category:** Logstash
**Created:** [May 4, 2018, 8:33am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585 "2018-05-04T08:33:09Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@zxc654951](https://discuss.elastic.co/u/zxc654951)
#### Post date: [May 4, 2018, 8:33am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/1 "2018-05-04T08:33:09Z")
I had json format log and outputto elasticseach. I try to use "if" and "mutate" which copy Message to new field. But the new field can't viewed in elasticsearch and kibana. My Message field like "S", "E", "any string"...
and my code like below.
filter{
if [Message]=="S"{
mutate{copy=\>{"Message"=\>"action"}}
}
else if [Message]=="E"{
mutate{copy=\>{"Message"=\>"action"}}
}
}
**Another try：**
filter{
if [Message]=="S"{
add\_field{"Message"=\>"Action"}
mutate{copy=\>{"Message"=\>"action"}}
}
else if [Message]=="E"{
mutate{copy=\>{"Message"=\>"action"}}
}
}
Thanks for answer.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 4, 2018, 7:39pm UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/2 "2018-05-04T19:39:13Z")
Please show an example event produced by Logstash. You can use a `stdout { codec => rubydebug }` output to dump a raw representation of the event.
---
### Author:  [@zxc654951](https://discuss.elastic.co/u/zxc654951)
#### Post date: [May 7, 2018, 1:53am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/3 "2018-05-07T01:53:18Z")
filter{
date{
match=\>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
target=\>"LogDateTime\_2"
}
if [Message]=="S"{
mutate{
add\_field=\>{"ActionState"=\>"Message"}
copy=\>{"Message" =\> "ActionState"}}
}
}
Events like below：
{
"NhiSystemID" =\> " AAXX1001X01",
"LogDateTime\_2" =\> 2018-04-30T08:53:38.626Z,
"LogDateTime" =\> "2018-04-30 16:53:38.626668",
"Message" =\> "S",
"LogLevel" =\> "info",
"TransactionID" =\> "2a693137 ",
"path" =\> "/home/tim/log test/20180430\_2.log",
"@timestamp" =\> 2018-05-07T01:47:56.639Z,
"Scope" =\> "GEMFIRE",
"Daemon" =\> "4",
"@version" =\> "1",
"host" =\> "tim-VirtualBox",
"NhiActionID" =\> "11",
"ProcessID" =\> "0x00008X7X",
"ActionState" =\> [
[0] "S",
[1] "Message"
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 7, 2018, 6:23am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/4 "2018-05-07T06:23:20Z")
Okay, and what's the problem?
Keep in mind that the options given to the mutate filter aren't necessarily executed in the order given. If you have different mutate operations that depend on each other you should use different mutate filters. In this particular case the `copy` operation will run first, followed by the `add_field` operation.
---
### Author:  [@zxc654951](https://discuss.elastic.co/u/zxc654951)
#### Post date: [May 7, 2018, 9:06am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/5 "2018-05-07T09:06:27Z")
Thanks, it work by "add\_field" before "if" and "copy". But I get another problem. When I use logstash -f , can work to view "S" and "E" in kibana. When I use logstash -t -f and "Configuration OK", it not work.
filter{
date{
match=\>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
target=\>"LogDateTime\_2"
}
mutate{add\_field=\>{"ActionState"=\>" "}}
if [Message]=="S"{
mutate{copy=\>{"Message" =\> "ActionState"}}}
else if [Message]=="E"{
mutate{copy=\>{"Message" =\> "ActionState"}}}
}
output{elasticsearch{hosts=\>"localhost:9200"}}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 7, 2018, 10:12am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/6 "2018-05-07T10:12:52Z")
> When I use logstash -f , can work to view "S" and "E" in kibana. When I use logstash -t -f and "Configuration OK", it not work.
What do you mean? When you use `-t` Logstash will only parse the configuration and tell you if it looks okay. It won't process any data.
---
### Author:  [@zxc654951](https://discuss.elastic.co/u/zxc654951)
#### Post date: [May 8, 2018, 1:24am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/7 "2018-05-08T01:24:19Z")
My recognition is wrong. Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2018, 1:24am UTC](https://discuss.elastic.co/t/some-problem-of-if-and-mutate-in-logstash-filter/130585/8 "2018-06-05T01:24:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.