# Add new field based on request field

**URL:** https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243
**Category:** Logstash
**Created:** [August 17, 2016, 11:01am UTC](https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243 "2016-08-17T11:01:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Viswanath\_S](https://avatars.discourse-cdn.com/v4/letter/v/8c91f0/32.png) [@Viswanath\_S](https://discuss.elastic.co/u/Viswanath_S)
#### Post date: [August 17, 2016, 11:01am UTC](https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243/1 "2016-08-17T11:01:10Z")

</div>

Hi,

I am trying to add a new field based on request field value.

if the request field contains "fetchAccountDetails" add a new field called "requestCatagory" with value as "FETCH\_ACCOUNT\_DATA"

if the request field contains "fetchUserInfo" add a new field called "requestCatagory" with value as "FETCH\_USER\_DATA"

I am trying to use mutate as below but getting error.

> grok {  
> match =\> { "message" =\> "%{COMBINEDAPACHELOG}%{SPACE}%{IPORHOST:appserverIp} %{NONNEGINT:appserverport} %{NONNEGINT:responsetimemillis:int} %{GREEDYDATA:restofmessage}" }  
> }

> mutate {  
> if [message] =~ "/fetchAccountDetails/_"{  
> add\_field =\>  
> {  
> "requestcategory" =\> "FETCH\_ACCOUNT\_DATA"  
> }  
> } else if [message] =~ "/fetchUserInfo/_"{  
> add\_field =\>  
> {  
> "requestcategory" =\> "FETCH\_USER\_DATA"  
> }  
> }else {  
> add\_field =\>  
> {  
> "requestcategory" =\> "OTHER"  
> }  
> }  
> }  
> Please advise how to achieve this.

Thanks,  
Viswanath

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 17, 2016, 8:15pm UTC](https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243/2 "2016-08-17T20:15:32Z")

</div>

> if [message] =~ "/fetchAccountDetails/\*"{

That might work, but prefer

```
if [message] =~ /\/fetchAccountDetails\// {

```

or this:

```
if "/fetchAccountDetails/" in [message] {

```

Also, you can't have conditionals _inside_ filters. You have to wrap the filters.

```plaintext
if ... {
  mutate { ... }
} else {
  mutate { ... }
}

```

---

<div class="post-metadata">

### Author: ![Viswanath\_S](https://avatars.discourse-cdn.com/v4/letter/v/8c91f0/32.png) [@Viswanath\_S](https://discuss.elastic.co/u/Viswanath_S)
#### Post date: [August 18, 2016, 6:32am UTC](https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243/3 "2016-08-18T06:32:24Z")

</div>

Thanks. It is working

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/add-new-field-based-on-request-field/58243/4 "2017-07-06T04:42:54Z")

</div>