# Best way to add a field if the field contatins a specific string

**URL:** <https://discuss.elastic.co/t/best-way-to-add-a-field-if-the-field-contatins-a-specific-string/48342>\
**Category:** Logstash\
**Created:** [April 25, 2016, 5:04pm UTC](https://discuss.elastic.co/t/best-way-to-add-a-field-if-the-field-contatins-a-specific-string/48342 "2016-04-25T17:04:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DavidL](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@DavidL](https://discuss.elastic.co/u/DavidL)\
**Post date:** [April 25, 2016, 5:04pm UTC](https://discuss.elastic.co/t/best-way-to-add-a-field-if-the-field-contatins-a-specific-string/48342/1 "2016-04-25T17:04:28Z")

</div>

Hello,  
I am processing logs for a third party application. I already parsed out a field called "error\_message". I know that for some records, there is a error code in the error\_message. For example, "ERROR-11-8888", I want to be able to find that specific error code. If it exist in the error\_message, I want to get the error code and store it as a new field. What is the best way to do this? Thank you very much for the help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2016, 6:01pm UTC](https://discuss.elastic.co/t/best-way-to-add-a-field-if-the-field-contatins-a-specific-string/48342/2 "2016-04-25T18:01:13Z")

</div>

Use a grok filter.

```auto
filter {
  grok {
    match => ["error_message", "(?<error_code>ERROR-\d+-\d+)"]
  }
}

```

This example makes a few assumptions about what error codes look like so you may need to adjust the regular expression somewhat. You may also want to set the `tag_on_failure` option to an empty value to avoid tagging events with `_grokparsefailure` just because there's no error code in the error message—at least if it's okay that there is none.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/best-way-to-add-a-field-if-the-field-contatins-a-specific-string/48342/3 "2017-07-06T05:00:41Z")

</div>