# Add field from ECS field (winlogbeats)
**URL:** https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507
**Category:** Logstash
**Created:** [October 28, 2020, 1:17am UTC](https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507 "2020-10-28T01:17:10Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)
#### Post date: [October 28, 2020, 1:17am UTC](https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507/1 "2020-10-28T01:17:10Z")
I am trying to add some fields to the logs coming from wingbeat 7.9 to Logstash.
I need to extract the value from either user.name or related.user and add a new 'username' field.
I was doing something like this but this just adds the text '%related.user' to the logs. Is this possible at all?
```auto
if [type] == "winlogbeat" and [user][name] {
mutate {
add_field => ["username", "%[user][name]" ]
}
}
```
Thanks,
Camilo
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 28, 2020, 3:46pm UTC](https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507/2 "2020-10-28T15:46:04Z")
> [@Camilo\_Diaz](#):
>
> `"%[user][name]"`
A sprintf reference should look like
```
"%{[user][name]}"
```
---
### Author:  [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)
#### Post date: [October 28, 2020, 8:25pm UTC](https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507/3 "2020-10-28T20:25:45Z")
Thanks @Badger. Dunno how I missed that 🙂
Working as expected now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 25, 2020, 8:25pm UTC](https://discuss.elastic.co/t/add-field-from-ecs-field-winlogbeats/253507/4 "2020-11-25T20:25:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.