# Unable to include runtime log data in 'mutate' filter plugin

**URL:** <https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125>\
**Category:** Logstash\
**Created:** [December 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125 "2020-12-18T16:43:34Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/1 "2020-12-18T16:43:34Z")

</div>

I am trying to fetch cloudflare log data via API and want add a new field such as `actor.email` in index.

My end goal is to add a new field in index having data in meaningful sentence like `A user someone@email.com(actor.email) is removed from organisation`

```
 input {
      http_poller {
        urls => {
          test2 => {
            method => get
            url => "https://api.cloudflare.com/client/v4/user/audit_logs"
            headers => {
                "X-Auth-Email" => "my@redacted.com"
                "X-Auth-Key" => "API_key"
                "Content-Type" => "application/json"
            }
         }
        }
            schedule => { cron => "* * * * * UTC"}
            codec => "json"
      }
    }
    filter {
    split
                    {
                            field => "result"
                    }
          mutate {
            add_field => { "foo_%{somefield}" => "Hello world, from %{email}" }
          }
    }
    output {
            stdout { codec => rubydebug }
    }

```

Here is my output where `%{email }` should be populated with email address.  
Can anyone help ?

 ![Selection_063](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35b188a4aaa744fb429383ca138a292648d4b1b2.png)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 18, 2020, 4:49pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/2 "2020-12-18T16:49:03Z")

</div>

Try `%{[result][email]}`?

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 18, 2020, 4:53pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/3 "2020-12-18T16:53:37Z")

</div>

hey @aaron-nimocks, I tried that. no success.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 18, 2020, 5:11pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/4 "2020-12-18T17:11:14Z")

</div>

I think this is similar to what you are seeing as data and the below works.

```auto
input {
  generator {
    lines => [
      '{ "results":[{ "email": "a@a.com" }, { "email": "b@b.com" }, { "email": "c@c.com" }] }'
    ]
    count => 1
    codec => "json"
  }
}
filter {
  split
    {
      field => "results"
    }
  mutate {
    add_field => { "test" => "%{[results][email]}" }
  }    
}
output {
  stdout { codec => "rubydebug" }
}

```

Outputs

```auto
{
       "results" => {
        "email" => "a@a.com"
    },
      "@version" => "1",
          "host" => "Aarons-MBP.domain",
          "test" => "a@a.com",
      "sequence" => 0,
    "@timestamp" => 2020-12-18T17:06:06.753Z
}
{
       "results" => {
        "email" => "b@b.com"
    },
      "@version" => "1",
          "host" => "Aarons-MBP.domain",
          "test" => "b@b.com",
      "sequence" => 0,
    "@timestamp" => 2020-12-18T17:06:06.753Z
}
{
       "results" => {
        "email" => "c@c.com"
    },
      "@version" => "1",
          "host" => "Aarons-MBP.domain",
          "test" => "c@c.com",
      "sequence" => 0,
    "@timestamp" => 2020-12-18T17:06:06.753Z
}

```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 18, 2020, 5:13pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/5 "2020-12-18T17:13:38Z")

</div>

As per your screenshot you should use

```auto
%{[result][actor][email]}?

```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 18, 2020, 5:15pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/6 "2020-12-18T17:15:04Z")

</div>

```auto
%{[result][actor][email]}?

```

This is correct. I didn't see `actor` in your image.

---

<div class="post-metadata">

**Author:** ![ankitdevnalkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitdevnalkar/32/46158_2.png) [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Post date:** [December 18, 2020, 5:18pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/7 "2020-12-18T17:18:34Z")

</div>

hey that worked. thanks buddy 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125/8 "2021-01-15T17:18:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.