# Add\_field not working

**URL:** <https://discuss.elastic.co/t/add-field-not-working/302887>\
**Category:** Logstash\
**Created:** [April 21, 2022, 9:23am UTC](https://discuss.elastic.co/t/add-field-not-working/302887 "2022-04-21T09:23:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 21, 2022, 9:23am UTC](https://discuss.elastic.co/t/add-field-not-working/302887/1 "2022-04-21T09:23:04Z")

</div>

Hi, the following is my logstash conf file for passing a few sample audit log messages  
sample messages:

```auto
type=SYSCALL msg=audit(1547800652.003:103): arch=c00000b7 syscall=200 success=no exit=-13 a0=c a1=ffffe65a3648 a2=10 a3=2 items=0 ppid=1 pid=5916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="atf_agent" exe="/usr/1aw/bin/atf_agent" subj=system_u:system_r:atf_agent_t key=(null)
type=SYSCALL msg=audit(1647800652.003:103): arch=c00000b7 syscall=200 success=no exit=-17 a0=c a1=ffffe65a3648 a2=10 a3=2 items=0 ppid=1 pid=5916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="atf_agent" exe="/usr/1aw/bin/atf_agent" subj=system_u:system_r:atf_agent_t key=(null)

```

logstash config file:

```auto
input {
  file {
    path => ["C:/elk stack/sample.log"]
    start_position => "beginning"
    sincedb_path => NULL 
    type => "audit"
  }
}

filter {
  if [type] == "audit" {
  grok {
    match => { "message" => "type=%{DATA:audit_type}\smsg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\):.*?( msg=\'(?<sub_msg>.*?)\')?$" }
    named_captures_only => true
  }
  kv {
    exclude_keys => ["msg", "type"]
  }
  kv {
    source => "sub_msg"
  }
  date {
    match => ["audit_epoch", "UNIX"]
  }
  mutate {
    rename => [
      "auid", "uid_audit",
      "fsuid", "uid_fs",
      "suid", "uid_set",
      "ses", "session_id"
    ]
    remove_field => ['sub_msg', 'audit_epoch']
  }
      if [exit] == -1{
    mutate {
      add_field => { "Error" => "Operation not permitted" }
    }
  } else if [exit] == -2{
    mutate {
      add_field => { "Error" => "No such file or directory" }
    }
  } else if [exit] == -3{
    mutate {
      add_field => { "Error" => "No such process" }
    }
  } else if [exit] == -4{
    mutate {
      add_field => { "Error" => "Interrupted system call" }
    }
  } else if [exit] == -5{
    mutate {
      add_field => { "Error" => "I/O error" } 
    }
  } else if [exit] == -6{
    mutate {
      add_field => { "Error" => "No such device or address" }
    }
  } else if [exit] == -7{
    mutate {
      add_field => { "Error" => "Argument list too long" }
    }
  } else if [exit] == -8{
    mutate {
      add_field => { "Error" => "Exec format error" }
    }
  } else if [exit] == -9{
    mutate {
      add_field => { "Error" => "Bad file number" }
    }
  } else if [exit] == -10 {
    mutate {
      add_field => { "Error" => "No child processes" }
    }
  } else if [exit] == -11 {
    mutate {
      add_field => { "Error" => "Try again" } 
    }
  } else if [exit] == -12 {
    mutate {
      add_field => { "Error" => "Out of memory" }
    }
  } else if [exit] == -13 {
    mutate {
      add_field => { "Error" => "Permission denied" }
    }
  } else if [exit] == -14 {
    mutate {
      add_field => { "Error" => "Bad address" }
    }
  } else if [exit] == -15 {
    mutate {
      add_field => { "Error" => "Block device required" }
    }
  } else if [exit] == -16 {
    mutate {
      add_field => { "Error" => "Device or resource busy" }
    }
  } else if [exit] == -17 {
    mutate {
      add_field => { "Error" => "File exists" } 
    }
  } else if [exit] == -18 {
    mutate {
      add_field => { "Error" => "Cross device link" }
    }
  } else if [exit] == -19 {
    mutate {
      add_field => { "Error" => "No such device" }
    }
  } else if [exit] == -20 {
    mutate {
      add_field => { "Error" => "Not a directory" }
    }
  } else if [exit] == -21 {
    mutate {
      add_field => { "Error" => "Is a directory" }
    }
  } else if [exit] == -22 {
    mutate {
      add_field => { "Error" => "Invalid argument" }
    }
  } else if [exit] == -23 {
    mutate {
      add_field => { "Error" => "File table overflow" } 
    }
  } else if [exit] == -24 {
    mutate {
      add_field => { "Error" => "Too many open files" }
    }
  } else if [exit] == -25 {
    mutate {
      add_field => { "Error" => "Not a typewriter" }
    }
  } else if [exit] == -26 {
    mutate {
      add_field => { "Error" => "Text file busy" } 
    }
  } else if [exit] == -27 {
    mutate {
      add_field => { "Error" => "File too large" }
    }
  } else if [exit] == -28 {
    mutate {
      add_field => { "Error" => "No space left on device" }
    }
  } else if [exit] == -29 {
    mutate {
      add_field => { "Error" => "Illegal seek" }
    }
  } else if [exit] == -30 {
    mutate {
      add_field => { "Error" => "Read only file system" }
    }
  } else if [exit] == -31 {
    mutate {
      add_field => { "Error" => "Too many links" }
    }
  } else if [exit] == -32 {
    mutate {
      add_field => { "Error" => "Broken pipe" } 
    }
  } else if [exit] == -33 {
    mutate {
      add_field => { "Error" => "Math argument out of domain of func" }
    }
  } else if [exit] == -34 {
    mutate {
      add_field => { "Error" => "Math result not representable" }
    }
  }
}
}

output {
  elasticsearch {
    hosts => "http://localhost:9200"
    index => "testing"
    #index => "%{aircraft_id}"
  }
  stdout {codec => "rubydebug"}
}

```

However, the new field "Error" is not getting added. need help in figuring out why that is so  
thanks in advance

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [April 21, 2022, 9:57am UTC](https://discuss.elastic.co/t/add-field-not-working/302887/2 "2022-04-21T09:57:07Z")

</div>

Hi,

First, you should add the last condition :

```auto
else {
  mutate {
    add_field => { "Error" => "No error message if exit value is equal to ${[exit]}" }
  }
}

```

Second, I'm not sure but i think the kv filter return string values, and in your case, you compare the exit field with an integer, so i recommand you to convert it in integer before making if tests:

```auto
mutate {
  convert => {
    "exit" => "integer"
  }
}

```

Cad.

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 21, 2022, 10:31am UTC](https://discuss.elastic.co/t/add-field-not-working/302887/3 "2022-04-21T10:31:10Z")

</div>

Made both the changes, it works now  
Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2022, 10:31am UTC](https://discuss.elastic.co/t/add-field-not-working/302887/4 "2022-05-19T10:31:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.