# Adding fields to configuration file

**URL:** <https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110>\
**Category:** Logstash\
**Created:** [January 15, 2020, 9:51am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110 "2020-01-15T09:51:00Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 15, 2020, 9:51am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/1 "2020-01-15T09:51:00Z")

</div>

Hi,  
I am running multiple java applications and creating logging files for each one, so i decided to use elastic stack for Centralised Log Management. My question is how can i add port and IP address fields to my index pattern. should i use mutate filter plugin or do i specify them in my input.

Thanks.

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 15, 2020, 10:04am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/2 "2020-01-15T10:04:34Z")

</div>

Hi,

you can use the mutate plugin filter with the add\_field option

mutate {  
add\_field =\> { "foo" =\> "bar" }  
}

you'll get a field called "foo" with the value "bar"

here is the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 15, 2020, 10:06am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/3 "2020-01-15T10:06:54Z")

</div>

EDIT : i saw you were trying to search from Kibana

go in "Patterns" and choose your pattern then you can use the refresh button in the top right corner

 ![Sélection_054](https://us1.discourse-cdn.com/elastic/original/3X/4/8/482d82d7cc43a7ceca18a0cc23529607df62f541.png)

---

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 15, 2020, 10:12am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/4 "2020-01-15T10:12:39Z")

</div>

Hi grumo35,

Actually this is what i was looking for, Thank you so much. Last question, is it possible for Logstash to enter the port number of the java application after sending a log request?

Is it done like this in my **Logstash configuration file**

```
input {
  file {
    type => "java"
    path => "/home/user/microservice1logging/microservice1.log"
    start_position => "beginning"
  }
}

filter {
    mutate {
	add_field => { "Portname" => "%{server.port}" }
	}
}

output {
   
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

```

Using %{server.port}?

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 15, 2020, 10:20am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/5 "2020-01-15T10:20:06Z")

</div>

Elasticsearch is using nested fields so as you see "." dots in fields name this mean the fields actually looks like :

```auto
"server":{
    "port:"80"
    "ip":"127.0.0.1"
}

```

server.port in Kibana equals [server][port] in logstash

```auto
filter {
    mutate {
	add_field => { "Portname" => "%{[server][port]}" }
	}
}

```

---

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 15, 2020, 10:30am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/6 "2020-01-15T10:30:06Z")

</div>

I am getting them hard coded instead of the actual values for the IP address and Port of my java application. Do i have to include them in the input of my logstash conf file?

```
{
       "message" => "2020-01-15 02:25:20.375 INFO [microservice1,26bb961d71430a27,26bb961d71430a27,false] 22525 --- [http-nio-8001-exec-4] c.s.m.c.Microservice1Controller : This is an INFO log",
    "@timestamp" => 2020-01-15T10:25:21.403Z,
          "host" => "ubuntu",
     "IPaddress" => "%{[server][ip]}",
      "@version" => "1",
      "Portname" => "%{[server][port]}",
          "path" => "/home/user/microservice1logging/microservice1.log",
          "type" => "java"
}
```

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [January 15, 2020, 10:42am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/7 "2020-01-15T10:42:40Z")

</div>

I'm not sure of what you're trying to do here,

What you're doing here is adding the field "Portname" with the value of the field "server.port", but does the server.port field existed previously ?

Can you provide source log samples ?

---

<div class="post-metadata">

**Author:** ![amin224](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@amin224](https://discuss.elastic.co/u/amin224)\
**Post date:** [January 15, 2020, 11:30am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/8 "2020-01-15T11:30:28Z")

</div>

Never mind thank you so much for helping me

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2020, 11:30am UTC](https://discuss.elastic.co/t/adding-fields-to-configuration-file/215110/9 "2020-02-12T11:30:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.