# Can not access dot (eg foo.bar) fields in logstash

**URL:** https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884
**Category:** Logstash
**Created:** [August 22, 2015, 8:39pm UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884 "2015-08-22T20:39:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ankmathur14](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)
#### Post date: [August 22, 2015, 8:39pm UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884/1 "2015-08-22T20:39:34Z")

</div>

How to access dot fields in logstash.

if [foo.bar] == "xyz" {  
grok {  
add\_field =\> {"new\_field", "pqr"}  
}  
}

Field "foo.bar" exists and its value is "xyz" but its not going in the 'if' block

I also tried foo.bar but no luck.

logstash -1.5.3

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 23, 2015, 6:11pm UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884/2 "2015-08-23T18:11:00Z")

</div>

Quoting the [Field References documentation](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references):

> The syntax to access a field is [fieldname]. If you are referring to a top-level field, you can omit the and simply use fieldname. To refer to a nested field, you specify the full path to that field: [top-level field][nested field].

---

<div class="post-metadata">

### Author: ![ankmathur14](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)
#### Post date: [August 25, 2015, 7:08am UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884/3 "2015-08-25T07:08:07Z")

</div>

Thanks so much!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884/4 "2017-07-06T05:30:59Z")

</div>