# Add field based on another **URL:** \ **Category:** Logstash\ **Created:** [September 30, 2020, 1:18pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511 "2020-09-30T13:18:46Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [September 30, 2020, 1:18pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/1 "2020-09-30T13:18:46Z")
Hello. I'd like to know if there's any possibility to add new field based on request filed, but with some regex. `(%{NOTSPACE:request}[?#$]\S*)` i'd like to add this one as field "request\_file" and the full output to stay in original filed "request" There's nothing related in documentation (or maybe lacks). Please give me some ideas. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 30, 2020, 1:22pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/2 "2020-09-30T13:22:20Z")
[grok](https://www.elastic.co/guide/en/logstash/7.9/plugins-filters-grok.html) perhaps? It is not clear what you really want to do. ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [September 30, 2020, 1:25pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/3 "2020-09-30T13:25:55Z")
Well, the original request for example pattern: `%{NOTSPACE:request}` `/api/v1/projects/details.php?&clickID= ********* ` should remain as `request` field Need to add new one field called `request_file` which should be taken from pattern with regex pattern: `(%{NOTSPACE:request}[?#$]\S*)` And should display only the requested file, for example. `/api/v1/projects/details.php` ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [September 30, 2020, 1:32pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/4 "2020-09-30T13:32:22Z")
I am not sure, and cannot even understand ELK stack. I've added this line to mutate filter. ` add_field => { "request_file" => ["(%{NOTSPACE:request}[?#$]\S*)"] }` I don't even know if it's correct. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 30, 2020, 1:39pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/5 "2020-09-30T13:39:43Z")
That is not going to work. I think you want grok. Assuming that the [request] field contains the string '/api/v1/projects/details.php?&clickID=\*\*\*\*\*\*\*\*\*' you could try ``` grok { match => { "request" => "%{NOTSPACE:request_file}\?" } } ``` or ``` grok { match => { "request" => "%{URIPATH:request_file}%{URIPARAM:request_params}" } } ``` ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [September 30, 2020, 1:42pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/6 "2020-09-30T13:42:16Z")
Can i use more that one grok in filter ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 30, 2020, 1:44pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/7 "2020-09-30T13:44:12Z")
Yes. ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [September 30, 2020, 1:45pm UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/8 "2020-09-30T13:45:39Z")
It does the trick, thanks! I have one more question, but maybe it's better to open new ticket? ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [October 1, 2020, 10:06am UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/9 "2020-10-01T10:06:08Z")
Well. the task were changed again. And i was forced to add `$uri` to nginx log format, and now i need some suggestion how to create a new pattern to display it. New log format ```auto server.example.com 123.123.123.123 [01/Oct/2020:09:52:08 +0000] "POST /ws/whitelabel.php HTTP/2.0" 200 27429 "https://example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36" "command=getUserCampaigns&token= ***********************************" "-" "-" "-" 0.152 "/ws/whitelabel.php" ``` As you can see the request\_file is now latest, how can I make it again to be added as field? Is it like that? `%{NOTSPACE:request_file}` ---
**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Post date:** [October 14, 2020, 11:24am UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/10 "2020-10-14T11:24:07Z")
It works but not relevant anymore. Anyway Thank You for tips. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 11, 2020, 11:24am UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511/11 "2020-11-11T11:24:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.