# Add Field With Logsstah If It Does Not Exist

**URL:** <https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285>\
**Category:** Logstash\
**Created:** [February 13, 2019, 8:24pm UTC](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285 "2019-02-13T20:24:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [February 13, 2019, 8:24pm UTC](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285/1 "2019-02-13T20:24:47Z")

</div>

We send log data to Logstash through Winlogbeat, and we add a field to the data.

fields:  
campus: mu

We want the Logstash filter to add the field “campus” and set the value to null or unknown if the field does not exist. Doing so would be helpfull if the winlogbeat.yml file is incorrect on a system.

Does anyone have any suggestions on how to do so?

Our current Logstash filter is:

filter {

if [event\_id] == 4624 or [event\_id] == 4625 or [event\_id] == 4648 or [event\_id] == 4688 {

truncate {

id =\> "truncate\_long"

fields =\> "message"

length\_bytes =\> 200

}

}

}

We tried this, but it did not work.

filter {

if [event\_id] == 4624 or [event\_id] == 4625 or [event\_id] == 4648 or [event\_id] == 4688 {  
truncate {  
id =\> "truncate\_long"  
fields =\> "message"  
length\_bytes =\> 200  
}  
}  
if ![fields][campus] {  
mutate { add\_field =\> { "fields.campus" =\> "unk" } }  
}  
}

---

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [February 13, 2019, 8:44pm UTC](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285/2 "2019-02-13T20:44:30Z")

</div>

NM - we got it now. Had to do this instead.

if ![fields][campus] {  
mutate { add\_field =\> { "[fields][campus]" =\> "unk" } }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2019, 8:52pm UTC](https://discuss.elastic.co/t/add-field-with-logsstah-if-it-does-not-exist/168285/3 "2019-03-13T20:52:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.