# Adding a field to a metrics event
**URL:** https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203
**Category:** Logstash
**Created:** [June 28, 2024, 10:56am UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203 "2024-06-28T10:56:00Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [June 28, 2024, 10:56am UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/1 "2024-06-28T10:56:00Z")
Hi there, I am having a big issue with a really simple situation. I am trying to add a custom field to the event generated by the metrics filter plugin, however, it seems that the metrics plugin first creates the event and then adds the fields, therefore it doesn't have access to the same fields in previous events.
Here's a code example:
```auto
input{
......
mutate {
add_field => { "custom_field" => "some_custom_value" } ### In reality this comes from my input directly (filebeat)
}
}
filter{
metrics {
meter => ["%{count_on_this}"]
add_tag => ["metrics"]
add_field => { "my_field" => "%{custom_field}" }
}
}
```
The resulting event is going to contain `"my_field": "%{custom_field}"` but will never resolve the value. Is there a way to make this work?
The limitation is that the value of my custom field comes from the received input, and therefore I cannot hardcode it into the metrics event.
Thanks in advance.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 28, 2024, 11:35am UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/2 "2024-06-28T11:35:54Z")
> [@Jose\_E](#):
>
> The resulting event is going to contain `"my_field": "%{custom_field}"` but will never resolve the value. Is there a way to make this work?
No, there is not. The metrics filter records creates a new event which contains metrics related to previously seen events. The add\_field option can only reference fields on the newly created event. There is an [issue](https://github.com/logstash-plugins/logstash-filter-metrics/issues/49) for this, but the behaviour wll never change.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [June 28, 2024, 2:15pm UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/3 "2024-06-28T14:15:16Z")
_Gasp_
How about using the aggregate filter or somehow defining the parameter as a constant?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 28, 2024, 2:44pm UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/4 "2024-06-28T14:44:08Z")
An aggregate would suffer from the same issue. If you are metering events over a 15-minute period, which of those many events should be used to do the substitution of the field reference? logstash cannot assume that the referenced field will be the same on all the metered events. If it is then why use a field reference for it? Just use the string value in the add\_field option.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [June 28, 2024, 3:21pm UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/5 "2024-06-28T15:21:07Z")
I see the point. Too bad then ☹ If I find out a workaround I will make sure to update the post.
---
### Author:  [@Jose\_E](https://discuss.elastic.co/u/Jose_E)
#### Post date: [July 3, 2024, 10:27am UTC](https://discuss.elastic.co/t/adding-a-field-to-a-metrics-event/362203/6 "2024-07-03T10:27:26Z")
Just for curiosity purposes, I bypassed this limitation by adding an extra filter in the pipeline. Basically, I defined 3 conditionals based on the value of the field I wanted to set in metrics.
```auto
if "value1" in [custom_field] {
metrics{
.....
add_field => { "custom_field => "value1" }
}
} else if "value2" in [custom_field] {
metrics{
.....
add_field => { "custom_field => "value2" }
}
}
```
And then in a later step I process the event created by the metrics function. That did the trick for me.