# Accessing individual values in a logstash

**URL:** <https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027>\
**Category:** Logstash\
**Created:** [January 24, 2021, 9:53am UTC](https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027 "2021-01-24T09:53:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![learner1](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@learner1](https://discuss.elastic.co/u/learner1)\
**Post date:** [January 24, 2021, 9:53am UTC](https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027/1 "2021-01-24T09:53:06Z")

</div>

I'm trying to mask some values in the logs but looks like it's not working because of the log format.  
Here is the format:

```auto
     "_source": {
    "log": "2021-01-24 07:15:37 +0000 [warn]: #0 dump an error event: error_class=Fluent::Plugin::ElasticsearchErrorHandler::ElasticsearchError error=\"400 - Rejected by Elasticsearch\" location=nil tag=\"myapp-tag\" time=2021-01-24 07:15:32.694763042 +0000 record={\"method\"=>\"GET\", \"path\"=>\"/404\", \"format\"=>\"html\", \"controller\"=>\"ErrorsController\", \"action\"=>\"not_found\", \"status\"=>404, \"duration\"=>2.66, \"view\"=>0.38, \"params\"=>{\"path\"=>\"/etc/<canary>\", \".ico\"=>nil}, \"app_name\"=>\"myapp-name\", \"host\"=>\"host.com\", \"remote_id\"=>\"123.213.78.179\"}\n"

```

For example, how do I access `app_name`?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2021, 9:53am UTC](https://discuss.elastic.co/t/accessing-individual-values-in-a-logstash/262027/2 "2021-02-21T09:53:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.