# Add\_field parameter in filter plugins

**URL:** https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333
**Category:** Logstash
**Created:** [December 16, 2015, 9:50am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333 "2015-12-16T09:50:31Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![srinivas](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@srinivas](https://discuss.elastic.co/u/srinivas)
#### Post date: [December 16, 2015, 9:50am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333/1 "2015-12-16T09:50:32Z")

</div>

Hi,  
Can anyone explain what does add\_field do ?

`filter { mutate { add_field => { "COLUMN2" => "%{COLUMN1}" } } }`  
What is the difference between add\_field present in mutate, clone, kv and grok plugins

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 16, 2015, 10:24am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333/2 "2015-12-16T10:24:08Z")

</div>

> Can anyone explain what does add\_field do ?

It adds a field to the current event. I don't know how to explain that in any different way.

> What is the difference between add\_field present in mutate, clone, kv and grok plugins

With the exception of mutate, add\_field and remove\_field only apply if the filter was successful (where the meaning of success depends on the filter). In other words,

```auto
filter {
  grok {
    match => ["foo", "..."]
    remove_field => ["foo"]
  }
}

```

is a convenient way of parsing a field with grok and deleting the original field only if the grok match was successful.

---

<div class="post-metadata">

### Author: ![srinivas](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@srinivas](https://discuss.elastic.co/u/srinivas)
#### Post date: [December 16, 2015, 10:53am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333/4 "2015-12-16T10:53:55Z")

</div>

> [@srinivas](#):
>
> adds a field means is that added as a new column in es index if output is an elasticsearch index

adds a field means is that added as a new column in es index if output is an elasticsearch index

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 16, 2015, 11:37am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333/5 "2015-12-16T11:37:08Z")

</div>

> adds a field means is that added as a new column in es index if output is an elasticsearch index

Elasticsearch has no "column" concept, but yes.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/add-field-parameter-in-filter-plugins/37333/6 "2017-07-06T05:18:12Z")

</div>


