# Add Unique Id to logs in logstash

**URL:** <https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001>\
**Category:** Logstash\
**Created:** [July 20, 2016, 3:44pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001 "2016-07-20T15:44:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![prabhakar349](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@prabhakar349](https://discuss.elastic.co/u/prabhakar349)\
**Post date:** [July 20, 2016, 3:44pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/1 "2016-07-20T15:44:07Z")

</div>

we are trying to add a new feild to the json document which we get from kafka, where this field needs to have an unique id

we tried with following options with in filter  
mutate  
grok  
json

nothing worked for us below is the input message that we get from kafka

```auto
{
  "timeMillis" : 1468957083192,
  "thread" : "restartedMain",
  "level" : "ERROR",
  "message" : "Started Application in 5.19 seconds (JVM running for 5.866)",
  "source" : {
    "class" : "org.springframework.boot.StartupInfoLogger",
    "method" : "logStarted",
    "file" : "StartupInfoLogger.java",
    "line" : 57
  },
  "endOfBatch" : false,
  "logEventId" : "1c9f2239-543d-436e-873d-7e143f33ac7c",
  "loggerFqcn" : "org.apache.commons.logging.impl.SLF4JLocationAwareLog",
  "test" : "tesssssssing",
  "hostName" : "24a074f2dde8",
  "applicationName" : "@project.artifactId@",
  "errorId" : 101
}

```

below is our logstash cofiguration we are using ansible to deploy it

```auto
input {
 
  kafka {
    topic_id => "{{kafka_log_consumer_topic_id}}"
    group_id => "{{kafka_consumer_group_id}}"
    zk_connect => "{{zk_consumer_connect_url}}"
  }
 
}
 
filter{
json{
   add_field => {"testId" => "sample"}
  }
}

output {
 
if [level] == "ERROR" or [level] == "WARN" or [level] == "FATAL" {
 
  elasticsearch {
    hosts => "{{elastic_search_hosts}}"
  }
 
  kafka {
    topic_id => "{{kafka_error_publish_topic}}"
    bootstrap_servers => "{{kafka_error_publish_host}}"
  }
 
}
 
else {
  elasticsearch {
    hosts => "{{elastic_search_hosts}}"
  }
}
 
}
 

```

tried with

```auto
filter{
json{
   add_field => {"testId" => "sample"}
  }
}
 
filter{
mutate{
   add_field => {"testId" => "sample"}
}
}
 
filter {
  uuid {
    add_field => {"testId" => "@uuid"}
  }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 20, 2016, 4:22pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/2 "2016-07-20T16:22:40Z")

</div>

```auto
uuid {
  add_field => {"testId" => "@uuid"}
}

```

What is `@uuid` supposed to mean? The `target` option is required for that filter so perhaps

```auto
uuid {
  target => "testId"
}

```

does what you want.

---

<div class="post-metadata">

**Author:** ![prabhakar349](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@prabhakar349](https://discuss.elastic.co/u/prabhakar349)\
**Post date:** [July 20, 2016, 5:06pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/3 "2016-07-20T17:06:55Z")

</div>

I will try this option so the above will add testId field with unique id ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 21, 2016, 6:14pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/4 "2016-07-21T18:14:21Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![prabhakar349](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@prabhakar349](https://discuss.elastic.co/u/prabhakar349)\
**Post date:** [July 21, 2016, 7:13pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/5 "2016-07-21T19:13:56Z")

</div>

Thankyou it worked fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001/6 "2017-07-06T04:46:54Z")

</div>