# Add field when line contains EXCEPTION

**URL:** <https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656>\
**Category:** Logstash\
**Created:** [February 8, 2022, 8:13pm UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656 "2022-02-08T20:13:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [February 8, 2022, 8:13pm UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/1 "2022-02-08T20:13:53Z")

</div>

Hi,  
logstash read the file line by line and add each line to Elasticsearch ok but i just want to add it with a condition when he find "EXCEPTION".  
example of my log file:

```auto
01/01/2022 15:00:02 546- MAIN EXCEPTION : 
System.IO.IOException: Unable.......
    at System ......
    at System ....
01/01/2022 15:00:03 535- S....
01/01/2022 15:00:03 535- GA.....

```

I want to send just the "exception" to Elasticsearch.

Any help would be sincerely appreciate!  
Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 8, 2022, 11:01pm UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/2 "2022-02-08T23:01:00Z")

</div>

Sounds like you want something like

```
if "EXCEPTION" in [message] { mutate { add_field => { "someField" => "someValue" } } }
```

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 9, 2022, 8:30am UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/3 "2022-02-09T08:30:32Z")

</div>

Or if you want to drop other messages than EXCEPTION, it could be:

```auto
if !("EXCEPTION" in [message]) {drop{}}

```

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [February 9, 2022, 8:50am UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/4 "2022-02-09T08:50:10Z")

</div>

Thanks Badger,TOMO\_M

That's what i want, and if i want to add another condition before the drop ? i tried this but didn't work:

```auto
if !("EXCEPTION" and "System.Net.Sockets" in [message]) {drop{}}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [February 9, 2022, 9:07am UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/5 "2022-02-09T09:07:39Z")

</div>

About conditional syntax, see [here](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals).

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [February 9, 2022, 9:12am UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/6 "2022-02-09T09:12:34Z")

</div>

Thanks Tomohiro.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2022, 9:12am UTC](https://discuss.elastic.co/t/add-field-when-line-contains-exception/296656/7 "2022-03-09T09:12:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.