# Added fields are not displaying **URL:** \ **Category:** Logstash\ **Created:** [July 6, 2015, 9:57am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937 "2015-07-06T09:57:00Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Post date:** [July 6, 2015, 9:57am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/1 "2015-07-06T09:57:01Z")
Hi, I have added some fields like received\_at and received\_from using add\_field in logstash configuration file,but these fields are not displaying anywhere. Where these fields will be displayed.I want these fields to be displayed in logstash.stdout file. here is my logstash configuration file. filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } please anyone suggest me... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2015, 10:39am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/2 "2015-07-06T10:39:52Z")
This should work. Is your grok filter successful (i.e. doesn't add a `_grokparsefailure` tag)? Please reduce your configuration to a minimal example that exhibits the problem. ---
**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Post date:** [July 6, 2015, 10:45am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/3 "2015-07-06T10:45:52Z")
Thanks Magnus, I am not getting \_grokparsefailure tag.But these fields are not displaying in logstash.stdout file. have any suggestions to make these fields displayed in logstash.stdout file? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 6, 2015, 10:48am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/4 "2015-07-06T10:48:20Z")
Do you see any of the other parsed fields, e.g. syslog\_pid, in the output? What does your input block look like? ---
**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Post date:** [July 6, 2015, 10:56am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/5 "2015-07-06T10:56:43Z")
No ,i'm not getting other fields also in the output. My input block is like this: input { lumberjack { port =\> 5000 type =\> "logs" ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } ---
**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Post date:** [July 6, 2015, 11:10am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/6 "2015-07-06T11:10:08Z")
output is like this : "message" =\> "@version" =\> "@timestamp" =\> "type" =\> "file" =\> "host" =\> "offset" =\> what changes i have to do to display the remaining fields also in the output? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2015, 11:11am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/7 "2015-07-06T11:11:32Z")
But it's not _quite_ like that, right? Surely you have something after "=\>" on each line? Are you using the rubydebug codec for your output plugin? ---
**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Post date:** [July 6, 2015, 11:18am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/8 "2015-07-06T11:18:15Z")
yes i'm using ruby debug, my original output look like this: ``` "message" => "Jul 6 02:31:19 ..........................", "@version" => "1", "@timestamp" => "2015-07-06T10:54:47.659Z", "type" => "cloudera", "file" => "/var/log/navigator.log", "host" => "syslogserver", "offset" => "9293240" ``` why the fields i'm parsing are not getting displayed in the output? please help me... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2015, 11:20am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/9 "2015-07-06T11:20:03Z")
Your grok filter is wrapped in a ``` if [type] == "syslog" { ... } ``` conditional, yet the type of this message is "cloudera". ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937/10 "2017-07-06T05:35:30Z")