# Use Mutate after KV filter
**URL:** https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460
**Category:** Logstash
**Created:** [June 17, 2020, 11:17am UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460 "2020-06-17T11:17:07Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [June 17, 2020, 11:17am UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460/1 "2020-06-17T11:17:07Z")
Is it not possible to use mutate filter after kv filter on fields created by the kv filter?
I have key value pairs which get divided by a kv filter. this is working great, the new fields appears on discover menu in kibana.
If i add a mutate filter on the new fields, this seems to be ignored.
Example: mutate { rename =\> ["dst" , "destination.ip"] }
---
### Author:  [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)
#### Post date: [June 17, 2020, 1:44pm UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460/2 "2020-06-17T13:44:27Z")
> [@ksremo](#):
>
> Example: mutate { rename =\> ["dst" , "destination.ip"] }
Try `mutate { rename => ["dst" , "[destination][ip]"] }`
---
### Author:  [@ksremo](https://discuss.elastic.co/u/ksremo)
#### Post date: [June 17, 2020, 2:18pm UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460/3 "2020-06-17T14:18:42Z")
thx for answer.
behavior is the same with brackets.
strange is that it is working for action field with syntax mutate { rename =\> ["action" , "event.action"] }
additional info: action is the first key value pair in the data blob
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 17, 2020, 8:46pm UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460/4 "2020-06-17T20:46:04Z")
This would be easier to debug if you posted the ruby debug output of an example event.
Are you sure that the field is actually called "dst" and not " dst" or something like that? (That would explain why the first one works and could easily be solved by the `trim_key` option in the kv filter)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2020, 8:46pm UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460/5 "2020-07-15T20:46:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.