# Add\_field not performing variable substitution
**URL:** https://discuss.elastic.co/t/add-field-not-performing-variable-substitution/53629
**Category:** Logstash
**Created:** [June 22, 2016, 8:54am UTC](https://discuss.elastic.co/t/add-field-not-performing-variable-substitution/53629 "2016-06-22T08:54:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jeffsmartpipe](https://discuss.elastic.co/u/jeffsmartpipe)
#### Post date: [June 22, 2016, 8:54am UTC](https://discuss.elastic.co/t/add-field-not-performing-variable-substitution/53629/1 "2016-06-22T08:54:26Z")
Hi all,
Newbie to logstash here but I'm sure this should work. I am creating a metric and need to be able to split by http result code. The result code is stored in %{rcode}. In the below the variable is being substituted in the metric name correctly but not in the add\_field method.
Any ideas?
Thanks
Jeff
filter {
if [type] == "heeaccesslogs" {
metrics {
meter =\> "heeevents\_rcode\_%{rcode}"
add\_tag =\> "metric"
add\_field =\> { "rcode" =\> "%{rcode}" }
add\_field =\> { "type" =\> "heemetric" }
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 4, 2016, 6:48pm UTC](https://discuss.elastic.co/t/add-field-not-performing-variable-substitution/53629/2 "2016-07-04T18:48:45Z")
Show us an example of the kind of event you want to process (preferably using a `stdout { codec => rubydebug }` output).
> add\_field =\> { "rcode" =\> "%{rcode}" }
This doesn't make sense. You're trying to assign a field to its current value.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/add-field-not-performing-variable-substitution/53629/3 "2017-07-06T04:49:38Z")