# Add new field in logstash conf file

**URL:** <https://discuss.elastic.co/t/add-new-field-in-logstash-conf-file/85201>\
**Category:** Logstash\
**Created:** [May 10, 2017, 8:19am UTC](https://discuss.elastic.co/t/add-new-field-in-logstash-conf-file/85201 "2017-05-10T08:19:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dinesht15](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@dinesht15](https://discuss.elastic.co/u/dinesht15)\
**Post date:** [May 10, 2017, 8:19am UTC](https://discuss.elastic.co/t/add-new-field-in-logstash-conf-file/85201/1 "2017-05-10T08:19:02Z")

</div>

Hi,

I am new to logstash and this is my first task with it. I wanted to add two new fields called  
"GMTDateTime" and "CSTDateTime" to use them in my kibana reporting. Same work i was doing in SQL query by  
GMTDateTime = DATEADD(day, DATEDIFF(day,'19000101',Cast(date as date)), CAST(CAST(time as time) AS DATETIME2(7)));

Here Date is date part from date time field from iis log file and time is time part form date time field from iis log file.

Now I am using the above field to get daylight saving time through a SQL function and storing the values in another field CSTDateTime

CSTDateTime = dbo.fn\_GetDaylightSavingsTime(GMTDateTime,-6,-5);

I wanted to perform the same ask in logstash conf file so that these two field will be available on kibana for reporting need.

Below is my conf file code

input {  
file {  
type =\> "iis-w3c"  
path =\> "D:/logs/u\_ex170102001126.log"  
start\_position =\> "beginning"  
}  
}  
filter {

```
# ignore log comments
if [message] =~ "^#" {
	drop {}
}

```

mutate {  
add\_field =\> {  
"GMTDateTime" =\> ""  
"CSTDateTime" =\> ""  
}  
}

```
grok {
	match =>["message", "%{TIMESTAMP_ISO8601:datestamp} %{DATA:s_sitename} %{HOSTNAME:s_computername} %{IP:s_ip} %{WORD:cs_method} %{NOTSPACE:http_request_url} (- %{NUMBER:port} -) %{IPORHOST:real_clientip} (HTTP/%{NUMBER:http_version}) %{NOTSPACE:user_agent} %{NOTSPACE:cookie} %{NOTSPACE:cs_referer} %{URIHOST:cs_host} %{INT:sc_status} %{NUMBER:sc_substatus} %{NUMBER:sc_win32_status} %{NUMBER:sc_bytes} %{NUMBER:cs_bytes} %{NUMBER:time_taken}"]
}

```

}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
}  
}

Any help will be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2017, 8:21am UTC](https://discuss.elastic.co/t/add-new-field-in-logstash-conf-file/85201/2 "2017-06-07T08:21:50Z")

</div>

Closed on June 7, 2017, 8:21am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.