# Add additional field (count of another field) **URL:** \ **Category:** Logstash\ **Created:** [January 14, 2020, 3:34pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008 "2020-01-14T15:34:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![anon42972578](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@anon42972578](https://discuss.elastic.co/u/anon42972578)\ **Post date:** [January 14, 2020, 3:34pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/1 "2020-01-14T15:34:06Z")
Hello, i have documents with multiline fields in `my.field` and need to count the number of received filenames. @Fabio-sama suggested me in another thread (which was in the wrong section) something like that: > { > "my\_field":[ > { > "filename": "test1.json", > "type" : "File" > }, > { > "filename": "test2.json", > "type" : "File" > } > ], > "number\_of\_filenames": 2 > } How can I do that in logstash in a simple way ? @Fabio-sama: is that `my_field` field always a list of objects? And is `filename` present in each of them? I'm asking if you have to make any check on the single objects or if you blindly get the size of the list. `It is a list of objects OR is an empty field. So it is empty OR the structure i posted above` best regards, treknado ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 14, 2020, 3:35pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/2 "2020-01-14T15:35:34Z")
By empty you mean an empty list? an empty string? Or nothing at all (field is not present)? Please post an example of a document where that field is "empty". ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 14, 2020, 3:53pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/3 "2020-01-14T15:53:16Z")
Well, the following should work anyway: ``` ruby { code => " my_field = event.get('my_field') number_of_filenames = my_field.nil? ? 0 : my_field.size event.set('number_of_filenames', number_of_filenames) " } ``` Put it in the filter section of the LS pipeline ---
**Author:** ![anon42972578](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@anon42972578](https://discuss.elastic.co/u/anon42972578)\ **Post date:** [January 14, 2020, 3:57pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/4 "2020-01-14T15:57:05Z")
i am a little bit confused. It looks like kibana created some new fields (which are not visible in discover) in my index pattern: `my_field.name` `my_field.type` I checked via the Elastic API if the value of my\_field is a string and found out: it is not a string. Looks like an inner object. so the answer is: the field is present, and the field is not mapped. ![test](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66d234dec926d2afaa42fd52620b356dff5c6d08.png) ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 14, 2020, 4:05pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/5 "2020-01-14T16:05:12Z")
As suggested there, you have to refresh your Index Pattern to see the mapping of the new field. Also, if it's not automatically recognized as a integer, use a template to set the right mapping. Btw, which version of the stack are you using? ---
**Author:** ![anon42972578](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@anon42972578](https://discuss.elastic.co/u/anon42972578)\ **Post date:** [January 14, 2020, 4:08pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/6 "2020-01-14T16:08:56Z")
yeah, i tried to do that. the index-pattern-refresh did not change anything. Also delete the index pattern and create a new index pattern did not change anything. i am using 7.4.2 ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 14, 2020, 4:10pm UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/7 "2020-01-14T16:10:36Z")
Wait, the `my_field` field should be the one that was already there. Is there the new numeric field `number_of_filenames`? That is the field you have to make the sum on. ---
**Author:** ![anon42972578](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@anon42972578](https://discuss.elastic.co/u/anon42972578)\ **Post date:** [January 16, 2020, 8:54am UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/8 "2020-01-16T08:54:55Z")
ah, i did not read the ruby code you posted above. will try it out today. But i have still the issue, that` my_field` is not mapped properly. when the list in `my_field` is `[]`, the mapping from ES is strange. ---
**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Post date:** [January 16, 2020, 10:43am UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/9 "2020-01-16T10:43:37Z")
Ok so, do you confirm me you can now do what you were trying to do when you started this thread (or even the previous one in the Kibana section), that is making the sum of all the items of a specific field? For this second mapping problem, can you share a sample of a document with a non-empty my\_field field and another with a empty one? Maybe also a snapshot of the Discover section to see the error in mapping. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 13, 2020, 10:43am UTC](https://discuss.elastic.co/t/add-additional-field-count-of-another-field/215008/10 "2020-02-13T10:43:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.