# Add a field depending on first log

**URL:** <https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653>\
**Category:** Logstash\
**Created:** [June 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653 "2021-06-01T14:37:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Chichi](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\
**Post date:** [June 1, 2021, 2:37pm UTC](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653/1 "2021-06-01T14:37:14Z")

</div>

Hello,

I would like to add a field in my logstash pipeline. But this field would be a dynamic field.

Here is a sample of my file :

date\_log;job\_id;service\_id;name;progress;status;duration

```auto
2021-06-01 16:16:03;nJzP4g;7759;masterJob;begin;;
2021-06-01 16:16:04;nJzP4g;7759;subJob;begin;;
2021-06-01 16:16:05;nJzP4g;7759;subJob;end;success;13
2021-06-01 16:16:06;nJzP4g;7759;masterJob;end;success;62114
2021-06-01 16:16:07;AJzhd2;7760;secondaryJob;begin;;
2021-06-01 16:16:09;AJzhd2;7760;subJob2;begin;;
2021-06-01 16:16:10;AJzhd2;7760;subJob2;end;success;13
2021-06-01 16:16:12;AJzhd2;7760;secondaryJob;end;success;62114

```

I would like to add "type" field for all jobs that are between the beginning of masterJob and the end :

Example of the final result :

date\_log;job\_id;service\_id;name;progress;status;duration;type

```auto
2021-06-01 16:16:03;nJzP4g;7759;masterJob;begin;;;masterJob
2021-06-01 16:16:04;nJzP4g;7759;subJob;begin;;;masterJob
2021-06-01 16:16:05;nJzP4g;7759;subJob;end;success;13;masterJob
2021-06-01 16:16:06;nJzP4g;7759;masterJob;end;success;62114;masterJob
2021-06-01 16:16:07;AJzhd2;7760;secondaryJob;begin;;;secondaryJob
2021-06-01 16:16:09;AJzhd2;7760;subJob2;begin;;;secondaryJob
2021-06-01 16:16:10;AJzhd2;7760;subJob2;end;success;13;secondaryJob
2021-06-01 16:16:12;AJzhd2;7760;secondaryJob;end;success;62114;secondaryJob

```

So :  
`if name = masterJob and status = begin`  
then all the following lines will have `type = masterJob` until we have the line `name = masterJob and status = end`

Same thing for "secondaryJob"

How can I do that with the different filters of logstash ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2021, 2:38pm UTC](https://discuss.elastic.co/t/add-a-field-depending-on-first-log/274653/2 "2021-06-29T14:38:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.