# Add new field from an old one \[Solved\]
**URL:** https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439
**Category:** Logstash
**Created:** [August 9, 2017, 1:22pm UTC](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439 "2017-08-09T13:22:21Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Chemse](https://discuss.elastic.co/u/Chemse)
#### Post date: [August 9, 2017, 1:22pm UTC](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439/1 "2017-08-09T13:22:22Z")
Hello, I have the field Mat equal to:
`Mat = "07/07/2017-03:09:39 0235918 LEFER GUILLAUME Tps"`
and I did this but it doesn't work
```
mutate {
split => { "Mat" => " " }
remove_field => ["Mat[2]","Mat[2]","Mat[2]"]
}
mutate {
add_field => {"time" => "%{Mat[0]}"}
add_field => {"matricule" => "%{Mat[1]}"}
}
```
can you help me please !! how can I create a new field from a hash table
Thanks 🙂
---
### Author:  [@Chemse](https://discuss.elastic.co/u/Chemse)
#### Post date: [August 9, 2017, 3:30pm UTC](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439/2 "2017-08-09T15:30:21Z")
Solved by doing this 🙂
```
grok {
match => ["Mat", "%{NOTSPACE:time} %{NOTSPACE:matricule} %{NOTSPACE:matri}"]
}
mutate {
remove_field => ["matri"]
remove_field => ["Mat"]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 6, 2017, 3:30pm UTC](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439/3 "2017-09-06T15:30:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.