# Adding items to a new field

**URL:** <https://discuss.elastic.co/t/adding-items-to-a-new-field/321995>\
**Category:** Logstash\
**Created:** [December 26, 2022, 4:15pm UTC](https://discuss.elastic.co/t/adding-items-to-a-new-field/321995 "2022-12-26T16:15:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Glad](https://avatars.discourse-cdn.com/v4/letter/g/5daacb/32.png) [@Glad](https://discuss.elastic.co/u/Glad)\
**Post date:** [December 26, 2022, 4:15pm UTC](https://discuss.elastic.co/t/adding-items-to-a-new-field/321995/1 "2022-12-26T16:15:31Z")

</div>

Hi, I recently started using Elastic and I'm having a problem. I am using a monitoring system for my tests to retrieve various data from the machines I am using. This monitoring system has an api that allows Logstash to retrieve information in JSON format.

My problem is the following: I would like the fields "device", "sensor", "lastvalue" to be grouped in the same field for example "test".

 ![Problème](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f31e86b9e07f6a6e6beae24636ff62515a606655.png)

Moreover, there is a constraint with the following structure --\> [sensors][number\_of\_sensors][device, sensor, lastvalue].

Example of what I get:`{ "sensors" => [[ 0] { "device" => "Probe Device", "lastvalue_raw" => 100.0, "lastvalue" => "100 %", "sensor" => "System Health", "message_raw" => "OK", "group" => "Local Probe", "status" => "Up" }, [1] { "device" => "Probe Device", "lastvalue_raw" => 100.0, "lastvalue" => "100 %", "sensor" => "Core Health", "message_raw" => "189 d (Age of Code) is above the warning limit of 90 d in Age of Code. Please consider upgrading to the latest version to improve security and stability", "group" => "Local Probe", "status" => "Warning" }, [2] { "device" => "Probe Device", "lastvalue_raw" => 100.0, "lastvalue" => "100 %", "sensor" => "Probe Health", "message_raw" => "OK", "group" => "Local Probe", "status" => "Up"`

I would like to group the above fields for each "number\_of\_sensors" into a "test" field.

Thank you in advance for your answers.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2023, 4:15pm UTC](https://discuss.elastic.co/t/adding-items-to-a-new-field/321995/2 "2023-01-23T16:15:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.