change dynamic field value in logstash

Question

I'm using a filter in logstash. I wanna change value of a dynamic field in logstash. I'm using below codes in my filter:

if [state_ls_keyvalue] == "False" {
            
    mutate{
        add_field => {"%{field_ls_keyvalue}" => "%{enrich_column}"}
    }

} else {
     mutate{
       remove_field => ["%{field_ls_keyvalue}"]
     }

     mutate{
       add_field => {"%{field_ls_keyvalue}" => "%{enrich_column}"}
     }
}

but it does not work. how shall I handle it?

Answer 1

The problem is related to type of field in elasticsearch. we can handle with mapping and change it.

using only add_field, the value of new field appends into old one.

using remove_field and then add_field, replace the value of new field to old one.