# What's wrong with my mutate filter?

**URL:** <https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536>\
**Category:** Logstash\
**Created:** [September 14, 2020, 1:44pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536 "2020-09-14T13:44:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Haptomai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haptomai/32/75538_2.png) [@Haptomai](https://discuss.elastic.co/u/Haptomai)\
**Post date:** [September 14, 2020, 1:44pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536/1 "2020-09-14T13:44:23Z")

</div>

Hi there, first time requiring help here 😉

In order to filter some different inputs (actually same filebeat input, but multiple beats/formats are sent),  
I achieved to get this following logstash pipeline:

```auto
input {
    beats {
        port => "5044"
    }
}

filter {
  if [@metadata][beat] == "apm" {
    if [processor][event] == "sourcemap" {
      mutate {
        add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[processor][event]}" }
      }
    } else {
      mutate {
        add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[processor][event]}-%{+yyyy.MM.dd}" }
      }
    }
  }

  if [@metadata][beat] == "filebeat" {
    mutate {
      add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+yyyy.MM.dd}" }
    }

    if [path] == "/var/log/wblog" {
      dissect { mapping => { "message" => "%{timestamp1->} %{+timestamp1} %{+timestamp1} %{Theatre} %{Product} %{Severity} %{Body}"
        "Body" => "%{1} %{2} %{3} %{4} %{5} %{6} %{7}" }
      }

      kv { source => "Body" }
    }
 }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "${[@metadata][index]}"
  }
}

```

The problem is that I only get one index in ES, named **${[@metadata][index]}**  
I followed the exemple of the documentation on logstash output for apm-server [https://www.elastic.co/guide/en/apm/server/master/logstash-output.html](https://www.elastic.co/guide/en/apm/server/master/logstash-output.html)

I have no error on APM-Server side, nor Filebeat nor Logstash. I have no clue on what happens, could you please help me ?

I'm fairly new to ELK, maybe it's a rookie error 😅

Thx

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 14, 2020, 1:53pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536/2 "2020-09-14T13:53:57Z")

</div>

Instead of

```
${[@metadata][index]} 

```

you probably should be using

```
%{[@metadata][index]}
```

---

<div class="post-metadata">

**Author:** ![Haptomai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/haptomai/32/75538_2.png) [@Haptomai](https://discuss.elastic.co/u/Haptomai)\
**Post date:** [September 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536/3 "2020-09-14T14:58:48Z")

</div>

Gosh, that's right !

Stupid typo, Thanks Badger 🤗

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2020, 3:28pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536/5 "2020-10-12T15:28:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.