# The fliter plugin mutate-convert method only convert the first element of an array

**URL:** <https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100>\
**Category:** Logstash\
**Created:** [April 12, 2016, 10:05am UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100 "2016-04-12T10:05:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [April 12, 2016, 10:05am UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/1 "2016-04-12T10:05:23Z")

</div>

I used jdbc input plugin to select a column named `available_cities` from mysql. It was a string field which formatted like this

```auto
"12, 13, 143, 123...."

```

And the filter was

```auto
filter {
    mutate {
        split => { "available_cities" => "," }
        convert => { "available_cities" => "integer" }
    }
}

# I also tried this
filter {
    mutate {
        split => { "available_cities" => "," }
    }
    mutate {
        convert => { "available_cities" => "integer" }
    }
}

```

The output was elasticsearch. My expectations was an `available_cities` field with multiple values

```auto
"available_cities": [12, 13, 143, 123....]

```

However, I only got number `12` in field `available_cities`.  
As I read the doc, I do not understand what the problem is.

> `convert`

> - Value type is hash
> - There is no default value for this setting.  
> Convert a field’s value to a different type, like turning a string to an integer. **If the field value is an array, all members will be converted.** If the field is a hash, no action will be taken.

---

<div class="post-metadata">

**Author:** ![Morriaty](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Morriaty](https://discuss.elastic.co/u/Morriaty)\
**Post date:** [April 13, 2016, 4:10am UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/2 "2016-04-13T04:10:18Z")

</div>

OMG, I'm misled by the es-head plugin.  
It only showed one element on the web page when the field had multiple values.

---

<div class="post-metadata">

**Author:** ![sfentress](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sfentress/32/17258_2.png) [@sfentress](https://discuss.elastic.co/u/sfentress)\
**Post date:** [April 11, 2017, 4:46pm UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/3 "2017-04-11T16:46:19Z")

</div>

I, too, would like to convert a string to an array of integers, and I set up my mutations exactly as you did, and am seeing it converted to only the first element. I don't understand your follow-up: are you saying that you were just seeing a visual artifact? I'm pretty sure I'm not getting the other values: if I search on the other values, I don't find them.

The data in MySQL:

```auto
my_field => "1, 2, 3"

```

My original, simple filter without conversion:

```auto
filter {
    mutate {
        split => { "my_field" => "," }
    }
}

```

The original output in Elasticsearch:

```auto
my_field: ["1", "2", "3"]

```

Searching for `myfield: 3` found the item.

But then when I added conversion:

```auto
filter {
    mutate {
        split => { "my_field" => "," }
        convert => { "my_field" => "integer" }
    }
}

```

my output was:

```auto
my_field: 1

```

and searching for `myfield: 3` returned no results.

Thoughts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/4 "2017-07-06T04:27:10Z")

</div>



---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 21, 2017, 9:00pm UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/5 "2017-09-21T21:00:57Z")

</div>



---

<div class="post-metadata">

**Author:** ![chrisribe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisribe/32/22398_2.png) [@chrisribe](https://discuss.elastic.co/u/chrisribe)\
**Post date:** [September 22, 2017, 7:13pm UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/6 "2017-09-22T19:13:53Z")

</div>

**Thanks @sfentress for getting this re-opened (elastic stop autoclosing these).**

_As I said in private here is the solution:_

You need to have two separate mutate statements, 1st one splits the string an creates an array.  
2nd one converts the array to the desired type.

> filter {  
> mutate {  
> split =\> { "available\_cities" =\> "," }  
> }  
> mutate {  
> convert =\> { "available\_cities" =\> "integer" }  
> }  
> }

This is the type of detail, that needs to be added to the documentation. Just add a note that a "seperate mutate must be performed AFTER the split operation".

> **[mutate | Logstash Reference \[5.4\] | Elastic](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-mutate.html#plugins-filters-mutate-split)**

> **[mutate | Logstash Reference \[5.4\] | Elastic](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-mutate.html#plugins-filters-mutate-convert)**

Would save us all a lot of time and sanity...  
Chris

---

<div class="post-metadata">

**Author:** ![sfentress](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sfentress/32/17258_2.png) [@sfentress](https://discuss.elastic.co/u/sfentress)\
**Post date:** [September 22, 2017, 8:32pm UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/7 "2017-09-22T20:32:55Z")

</div>

Awesome, thank you!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 1, 2018, 5:47pm UTC](https://discuss.elastic.co/t/the-fliter-plugin-mutate-convert-method-only-convert-the-first-element-of-an-array/47100/8 "2018-03-01T17:47:39Z")

</div>


