# Add new field using part of existing value **URL:** \ **Category:** Logstash\ **Created:** [May 27, 2020, 12:43am UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434 "2020-05-27T00:43:46Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 27, 2020, 12:43am UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/1 "2020-05-27T00:43:46Z")
Hello - I would like to create a new field named "process\_name". I would like to use part of the an existing field's value to add to the newly created field. Ex: Sample JSON Log : ```auto "cb_server":"cbserver","computer_name":"xxxx-WA","direction":"outbound","domain":"","event_type":"netconn","local_ip":"::1","local_port":1234,"md5":"ASDFASDFASDFAS","pid":12345,"process_guid":"123412341234123405722f4","process_path":"c:\\users\\name\\appdata\\roaming\\createagent-1.1\\create_bridge.exe","protocol":1,"proxy":false,"remote_ip":"asdfasdf","remote_port":1234,"sensor_id":1234,"sha256":"ASDFASDF@#$!@#$%","timestamp":1589578181,"type":"ingress.event.netconn" ``` Is it possible to create a new field called "process\_name" with just using "create\_bridge.exe" value from the existing field "process\_path"? Logstash filter: ```auto filter { if [log_type] == "netconn" { grok { match => { "message" => ["%{GREEDYDATA:netconn_raw}"] } } json { source => "netconn_raw" } mutate { remove_field => ["netconn_raw", "message", "timestamp"] } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 27, 2020, 12:48pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/2 "2020-05-27T12:48:46Z")
The grok filter makes no sense, why not just use ``` source => "message" ``` in the json filter? Also, instead of using a separate mutate you can add the remove\_field option to the json filter. That way it only gets removed if it is parsed successfully. You can use grok to extract the process path. I haven't tested it, but something like ``` grok { match => { "process_path" => "\\(?[^\\]+)$" } } ``` You may need to play around with the number of backslashes in each place (2, 4, ..). ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 27, 2020, 3:50pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/3 "2020-05-27T15:50:12Z")
@Badger - Thanks for taking the time to help me with this. I took your suggestions and made the following changes to my filter and I am seeing some progress: ```auto filter { if [log_type] == "netconn" { json { source => "message" remove_field => ["timestamp"] } grok { match => [ "process_path", "%{PATH:process_path}\\%{DATA:process_name}", "process_path", "%{UNIXPATH:process_path}/%{DATA:process_name}" ] remove_field => ["message"] } } } ``` The logs are being parsed but the process\_path field is showing two vaules: ![Capture2](https://us1.discourse-cdn.com/elastic/original/3X/1/5/1581de3bd6934dcc8ae335c0cca6389e59aea435.jpeg) How would I go about creating a new field titled process\_name using just the svchost.exe portion? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 27, 2020, 4:15pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/4 "2020-05-27T16:15:59Z")
> [@Feedy](#): > > `"process_path", "%{PATH:process_path}\\%{DATA:process_name}"` You have a [process\_path] field and you are asking grok to add a [process\_path] field, so you end up with an array. Add the following option ``` overwrite => ["process_path"] ``` What [process\_name] field do the resulting events have? ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 27, 2020, 4:27pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/5 "2020-05-27T16:27:15Z")
@Badger - I still want to keep the field name "process\_path" and its associated value but I would also like to create a new field named "process\_name" but only use the last portion of the process\_path value as the process\_name value. So essentially I would have the following fields: ```auto process_path = c:\windows\system32\svchost.exe process_name = svchost.exe ``` As of right now process\_name is not being created. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 27, 2020, 4:38pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/6 "2020-05-27T16:38:03Z")
> [@Feedy](#): > > As of right now process\_name is not being created. That's hard to believe unless you are getting a \_grokparsefailure, but the doubling up of process\_path tells you are not getting a parse failure. Note that the UNIXPATH pattern can be [very, very expensive](https://github.com/logstash-plugins/logstash-patterns-core/issues/159). That is why I suggested anchoring to end-of-string and using a character group that excludes the directory separator. Try ``` grok { overwrite => ["process_path"] match => { "process_path" => [ "%{DATA:process_path}\\(?[^\\]+)$", "%{DATA:process_path}/(?[^/]+)$", ] } } ``` That should be cheaper. ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 28, 2020, 4:45pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/7 "2020-05-28T16:45:27Z")
@Badger - I am now seeing the new field "process\_name" being created. I noticed that there is a change to the "process\_path" field and the last portion is being dropped from its value. Not a huge deal but was just wondering if there was a way to keep that field to show the full path and also how do I account for events that do not have the "process\_path" field and are resulting in grokparsefailure tags? The grokparsefailure isn't a huge issue because the logs are still being parsed but since they don't have the field process\_path that's why its receiving that tag(in my humble opinion). Latest Filter: ```auto filter { if [log_type] == "netconn" { json { source => "message" remove_field => ["timestamp"] } grok { overwrite => ["process_path"] match => ["process_path", "%{DATA:process_path}\\(?[^\\]+)$", "process_path", "%{DATA:process_path}/(?[^/]+)$" ] remove_field => ["message"] } } } ``` ![Capture3](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99500936381cc01e9fdd7bc52fa0436b3704432c.jpeg) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 28, 2020, 5:07pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/8 "2020-05-28T17:07:47Z")
If you do not want to modify process\_path then do not overwrite it: ```auto grok { match => { "process_path" => [ "\\(?[^\\]+)$", "/(?[^/]+)$", ] } } ``` ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 28, 2020, 5:19pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/9 "2020-05-28T17:19:56Z")
@Badger - yeah I gave that a try before I replied but it lists an array for the value. I can live with the current results I am getting at this point. Thanks for all your help. ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [May 28, 2020, 6:04pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/10 "2020-05-28T18:04:38Z")
@Badger - I re-read your latest reply and realized I read it incorrectly. After making the change you recently suggested its working as should. thanks again. Final config listed below just incase anybody has the same issue: ```auto filter { if [log_type] == "netconn" { json { source => "message" remove_field => ["timestamp"] } grok { match => ["process_path", "\\(?[^\\]+)$", "process_path", "/(?[^/]+)$" ] remove_field => ["message"] } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2020, 6:05pm UTC](https://discuss.elastic.co/t/add-new-field-using-part-of-existing-value/234434/11 "2020-06-25T18:05:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.