# A field referenced by another field

**URL:** <https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668>\
**Category:** Logstash\
**Created:** [June 11, 2020, 10:05am UTC](https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668 "2020-06-11T10:05:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Florent\_Fauvin](https://avatars.discourse-cdn.com/v4/letter/f/d2c977/32.png) [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\
**Post date:** [June 11, 2020, 10:05am UTC](https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668/1 "2020-06-11T10:05:57Z")

</div>

Hello,

I would like to copy the value of a 1st field, into a 2nd field which is referenced by a 3rd field.

Example:

field1 = "OK"  
field2 = ""  
field3 = "field2"

How to copy the value of field1 to field2 using field3 ?

(I'm trying to use %{field3} but it doesn't work ☹ )

Thanks for your help  
Florent

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 11, 2020, 11:49am UTC](https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668/2 "2020-06-11T11:49:57Z")

</div>

You can do that with Ruby ([Logstash Ruby filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html)). I didn't test it, so I hope I didn't make a mistake. But something like this should work:  
`event.set(event.get('field3'), event.get('field1'))`

---

<div class="post-metadata">

**Author:** ![Florent\_Fauvin](https://avatars.discourse-cdn.com/v4/letter/f/d2c977/32.png) [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\
**Post date:** [June 11, 2020, 12:56pm UTC](https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668/3 "2020-06-11T12:56:32Z")

</div>

> [@Florent\_Fauvin](#):
>
> referenced

Thank you very much, your ruby command is working.  
Too bad we can't do it natively with logstash, it is however not an "exotic" need I think ...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 12:56pm UTC](https://discuss.elastic.co/t/a-field-referenced-by-another-field/236668/4 "2020-07-09T12:56:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.