# Add field from an array

**URL:** <https://discuss.elastic.co/t/add-field-from-an-array/35453>\
**Category:** Logstash\
**Created:** [November 24, 2015, 1:00pm UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453 "2015-11-24T13:00:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![incogniro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incogniro/32/5875_2.png) [@incogniro](https://discuss.elastic.co/u/incogniro)\
**Post date:** [November 24, 2015, 1:00pm UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/1 "2015-11-24T13:00:23Z")

</div>

The syslog patterns parse into the message field which causes the message field to become an array.

I would like to add a new field with mutate which uses as it's value the content of message[1] although I'm getting issues. Note that message[0] contains the original message.

```
  mutate { # Logstash syslog patterns parse into the message field therefore move into seperate field.
    add_field => ['text' => "%{message}[1]"]
  }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2015, 1:43pm UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/2 "2015-11-24T13:43:36Z")

</div>

If you set `overwrite => ["message"]` for the grok filter it'll overwrite the original value instead of creating an array. If you really want to save the original field value (useful if you ever want to reindex but otherwise rather pointless) you can rename `message` prior to the grok filter (and then you don't need the override option).

> ```
> add_field => ['text' => "%{message}[1]"]
> 
> ```

You're mixing syntaxes. Pick one of:

```
add_field => ['text', "%{message}[1]"]
add_field => { 'text' => "%{message}[1]" }

```

---

<div class="post-metadata">

**Author:** ![incogniro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incogniro/32/5875_2.png) [@incogniro](https://discuss.elastic.co/u/incogniro)\
**Post date:** [November 25, 2015, 2:37pm UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/3 "2015-11-25T14:37:41Z")

</div>

Thanks Magnus although I did the following:  
`
ruby { code => "event['text'] = event['message'][1]" }
`

---

<div class="post-metadata">

**Author:** ![DanG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dang/32/6175_2.png) [@DanG](https://discuss.elastic.co/u/DanG)\
**Post date:** [November 25, 2015, 8:49pm UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/4 "2015-11-25T20:49:46Z")

</div>

You meant `overwrite => ["message"]`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 26, 2015, 6:55am UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/5 "2015-11-26T06:55:12Z")

</div>

> You meant `overwrite => ["message"]`

Yes indeed—thanks! I've edited the original post.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/add-field-from-an-array/35453/6 "2017-07-06T05:21:11Z")

</div>