# Add field of one grok in another grok

**URL:** <https://discuss.elastic.co/t/add-field-of-one-grok-in-another-grok/150304>\
**Category:** Logstash\
**Created:** [September 28, 2018, 7:44am UTC](https://discuss.elastic.co/t/add-field-of-one-grok-in-another-grok/150304 "2018-09-28T07:44:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [September 28, 2018, 7:44am UTC](https://discuss.elastic.co/t/add-field-of-one-grok-in-another-grok/150304/1 "2018-09-28T07:44:04Z")

</div>

Hi Team,

I am using multiple grok to extract multiple pattern from the log file.  
Below is the sample grok filters which I am using  
grok {  
message =\> {"%{NUMBER:Filed1} %{GREEDYDATA:message}" }  
}

grok {  
message =\> {"%{NUMBER:Filed1} test %{GRREDYDATA:filed2} %{GREEDYDATA:message}" }  
}

Now in kibana discover page i am using below filed :  
Filed1 Filed2 message

I want to show Filed1 and Filed 2 in every row. To achieve this i am trying to add Filed1 and Filed2 using mutate add\_filed.But i a not able to do it.

Kindly advice how can i add filed of one grok in another grok, or how can add filed of one grok in every event.

Thanks

---

<div class="post-metadata">

**Author:** ![richagautam](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Post date:** [October 3, 2018, 1:00pm UTC](https://discuss.elastic.co/t/add-field-of-one-grok-in-another-grok/150304/2 "2018-10-03T13:00:42Z")

</div>

Hi Team,

achieve above scenario , i trying to write ruby filter. but i am getting exception " Syntax error, unexpected '\n' " at pt= event['path']

For testing purpose I have put for loop on 10 records only.

ruby {  
code =\> "

```
			for i in 10
			{
			  tc = ''
                              pt = ''
			 if(event['TESTCASENAME'].nil?)
	                  {
			  tc = event['TESTCASENAME']
			  pt = event['path'] }
			 if ( event['TESTCASENAME'] == nil && event['Path']==pt)
			  {event['TESTCASENAME'] = tc)	
			  }
			}"
	 } 

```

Kindly advice is this the correct approach and why this error is coming ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2018, 1:00pm UTC](https://discuss.elastic.co/t/add-field-of-one-grok-in-another-grok/150304/3 "2018-10-31T13:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.