# Add existing fields to my logstash
**URL:** https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626
**Category:** Logstash
**Created:** [September 20, 2021, 1:32pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626 "2021-09-20T13:32:13Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)
#### Post date: [September 20, 2021, 1:32pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/1 "2021-09-20T13:32:13Z")
hello !
I would like to be able to add existing fields in an already stored index and to be able to work with them in logstash.
I understand that there are enrichment policies but I would like not to have to use kibana.
Is there some way to have 2 entries in logstash or some way to add all the values โโof a field from an elastic index?
Thanks in advanced!
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 20, 2021, 1:39pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/2 "2021-09-20T13:39:05Z")
I think what you are looking for is the [elasticsearch input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html). This will allow you to query an index and retrieve the data you are looking for then you can do your filtering or data enchriment and finally output it back to elasticsearch (using the same ID).
---
### Author:  [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)
#### Post date: [September 20, 2021, 1:43pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/3 "2021-09-20T13:43:37Z")
i need something similar but not an input.
i'm keeping data with jdcb from an oracle database wich an id-machine and i have other index with all the names of the machines (Catalog) , i want to keep the field machine\_name from the preindexed index and use it as a normal field in mi canvas,dashboard etc .
i see a elasticsearch filter plugin but i dont understand well how to add the field with all its values.
thank you!
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 20, 2021, 1:48pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/4 "2021-09-20T13:48:46Z")
Sound like the filter is what you need then. It will probably be something like this.
```auto
filter {
elasticsearch {
hosts => ["localhost:9200"]
index => "name-of-index"
query => "field-name-with-matching-id:%{[JDBC-FIELD-NAME-WITH-ID]}"
fields => { "new-field-name" => "field-name-of-index-you-want-data-from" }
}
}
```
---
### Author:  [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)
#### Post date: [September 20, 2021, 2:00pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/5 "2021-09-20T14:00:17Z")
im not doing something well
i want to add the name\_machine field to my index alone.
can't i do something like:
```auto
elasticsearch {
hosts => ["https://xxxxxxxx:9200"]
index => "indice"
user => elastic
password => xxxxxxxx
ssl => true
cacert => 'xxxxxxx/elasticsearch-ca.pem'
fields => { "new-field" => "%{machine_name}" }
}
```
using the fields parameter as a add\_field of a mutate keeping de names of the machines ??
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 20, 2021, 2:03pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/6 "2021-09-20T14:03:21Z")
> [@aaron-nimocks](#):
>
> `query => "field-name-with-matching-id:%{[JDBC-FIELD-NAME-WITH-ID]}"`
I think you are missing the above part.
In your JDBC input are you getting a field that has an `id` that would match the `id` in the elasticsearch index? If so that's the reason for the query. To find that single record you want and then assign the fields.
---
### Author:  [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)
#### Post date: [September 20, 2021, 2:15pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/7 "2021-09-20T14:15:26Z")
i dont see clear that relation... im sorry.
im going to put a concrete case.
i have and jdbc input keeping from oracle country\_name,backups\_ok and backups\_fail fields
and i have the catalog indexed in elk with a field named machine\_name wich is the name of the server of the backups.
I would like to add the field with the names of the machines to create a canvas in which I can see the backups\_ok and fail of each machine.
I apologize for my english !! ๐
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 20, 2021, 2:18pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/8 "2021-09-20T14:18:25Z")
Does your JDBC input have a field that will match to a specific record in your elastic catalog index?
You need to have a common field between your JDBC input and your index if you are going to enrich the data. That is the field you use to do the query.
---
### Author:  [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)
#### Post date: [September 21, 2021, 12:24pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/9 "2021-09-21T12:24:49Z")
okey i was creating a common field and i have "country\_name" and cod\_country with same values in both of them.
Now i want to keep the field machine\_name and mix it with my backups statistic from the other.
sorry for taking so long
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2021, 12:25pm UTC](https://discuss.elastic.co/t/add-existing-fields-to-my-logstash/284626/10 "2021-10-19T12:25:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.