# Adding data to additional fields depending on the content of the message

**URL:** <https://discuss.elastic.co/t/adding-data-to-additional-fields-depending-on-the-content-of-the-message/36026>\
**Category:** Logstash\
**Created:** [December 1, 2015, 10:23am UTC](https://discuss.elastic.co/t/adding-data-to-additional-fields-depending-on-the-content-of-the-message/36026 "2015-12-01T10:23:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Usm](https://avatars.discourse-cdn.com/v4/letter/u/e9c0ed/32.png) [@Usm](https://discuss.elastic.co/u/Usm)\
**Post date:** [December 1, 2015, 10:23am UTC](https://discuss.elastic.co/t/adding-data-to-additional-fields-depending-on-the-content-of-the-message/36026/1 "2015-12-01T10:23:51Z")

</div>

Hello!  
I have next situation. I need to add fields to each log message if it has specific information (matching with some regexp).  
Is there any possibillity to check the message to matching some regexp and if it is matched add\_field with cutom information? It is possible to do this in one iteration, in one config file of logstash?  
Thank you for your attention.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 1, 2015, 11:14am UTC](https://discuss.elastic.co/t/adding-data-to-additional-fields-depending-on-the-content-of-the-message/36026/2 "2015-12-01T11:14:29Z")

</div>

```auto
filter {
  if [some-field] =~ /some-regexp/ {
    mutate {
      add_field => { "some-other-field" => "any string" }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/adding-data-to-additional-fields-depending-on-the-content-of-the-message/36026/3 "2017-07-06T05:20:37Z")

</div>