# Add\_field in logstash does not work

**URL:** <https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616>\
**Category:** Logstash\
**Created:** [June 8, 2022, 2:04am UTC](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616 "2022-06-08T02:04:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PriyaM21](https://avatars.discourse-cdn.com/v4/letter/p/ccd318/32.png) [@PriyaM21](https://discuss.elastic.co/u/PriyaM21)\
**Post date:** [June 8, 2022, 2:04am UTC](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616/1 "2022-06-08T02:04:50Z")

</div>

I am trying to add a new custom field from the message but new field do not show up in Kabana. There is no error in logstash logs.  
Below is my logstash code  
if [fields][app\_name] == "cobra" {   
if [source] =~ /^".\*(\|/)(CobraLogsArchive\_Dev).csv"$/ {  
csv {  
separator =\> ","  
columns =\> ["AtWhen","ByWho","What","Params","Appname","ID"]  
}  
grok {  
match =\> { "message" =\> "%{GREEDYDATA:AtWhen},%{GREEDYDATA:ByWho},%{GREEDYDATA:What},%{GREEDYDATA:Params},%{GREEDYDATA:ApplicationName},%{GREEDYDATA:IDnumber}" }  
overwrite =\> ["message"]  
add\_tag =\> ["cobracustomlogs"]   
}  
date {  
match =\> ["AtWhen","YYY-MM-dd HH:mm:ss:SSS"]  
target =\> "AtWhen"  
}  
mutate { convert =\> ["ID", "integer"] }  
mutate { add\_field =\> {"application\_name" =\> "%{ApplicationName}"} }

```
	}	
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2022, 2:05am UTC](https://discuss.elastic.co/t/add-field-in-logstash-does-not-work/306616/2 "2022-07-06T02:05:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.