# Add new field data using Regex

**URL:** https://discuss.elastic.co/t/add-new-field-data-using-regex/231205
**Category:** Logstash
**Created:** [May 5, 2020, 6:35pm UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205 "2020-05-05T18:35:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)
#### Post date: [May 5, 2020, 6:35pm UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205/1 "2020-05-05T18:35:14Z")

</div>

Hello,

I'm trying to do something rather simple by extracting a Microsoft KB from a string (in my case, the summary field), and adding it to a new field called "patch". I have the regex, just not sure what filter to use and the appropriate syntax.

My code:

I'm copying the summary field to a new field called patch, and then attempting to modify the field contents to only contain the result of the regex search.

```
filter {
  mutate {
gsub => [
  "ip_address", "/32", ""
]
copy => { "summary" => "patch" }
replace => { "patch" => "(KB\d+)" }
  }
}

```

Here is my source event:

```
{
                              "os_name" => "Windows Server 2016 Standard Edition",
                             "@version" => "1",
                           "ip_address" => "192.168.65.228",
    "last_assessed_for_vulnerabilities" => 2020-04-09T14:51:53.823Z,
                     "reporting period" => "2020.05",
                              "summary" => "2018-05 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4103723)",
                          "data_source" => "Nexpose",
                           "@timestamp" => 2020-05-05T18:31:04.605Z,
                                "patch" => "2018-05 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4103723)",
                            "host_name" => "epo",
                             "severity" => "Severe",
                             "asset_id" => 1181,
                          "solution_id" => 60397,
                                  "url" => "http://support.microsoft.com/help/4103723"
}

```

This is what I was hoping to accomplish:

```
{
                              "os_name" => "Windows Server 2016 Standard Edition",
                             "@version" => "1",
                           "ip_address" => "192.168.65.228",
    "last_assessed_for_vulnerabilities" => 2020-04-09T14:51:53.823Z,
                     "reporting period" => "2020.05",
                              "summary" => "2018-05 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4103723)",
                          "data_source" => "Nexpose",
                           "@timestamp" => 2020-05-05T18:31:04.605Z,
                                "patch" => "KB4103723",
                            "host_name" => "epo",
                             "severity" => "Severe",
                             "asset_id" => 1181,
                          "solution_id" => 60397,
                                  "url" => "http://support.microsoft.com/help/4103723"
}

```

Thanks!

---

<div class="post-metadata">

### Author: ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [May 5, 2020, 7:07pm UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205/2 "2020-05-05T19:07:21Z")

</div>

There are different ways to extract the string.

One option is to use `grok`.  
No need for the `copy` and `replace` in the mutate.  
Set the `tag_on_failure` to false if not all the summary fields contain the string.

```auto
grok {
	match => {
		"summary" => "\((?<patch>KB[0-9]+)\)$"
	}
        tag_on_failure => false
}

```

You can test it at [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) or in Kibana if you have a basic license:  
[https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html)

---

<div class="post-metadata">

### Author: ![JeremyP](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@JeremyP](https://discuss.elastic.co/u/JeremyP)
#### Post date: [May 7, 2020, 1:26am UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205/3 "2020-05-07T01:26:54Z")

</div>

Thank you kind sir. I had to tweak the regex a little bit to take into account some additional variations in the message but you certainly put me back onto the right track. Take care.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 4, 2020, 1:26am UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205/4 "2020-06-04T01:26:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.