# Can not add a new field using if filter and add\_field

**URL:** <https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127>\
**Category:** Logstash\
**Created:** [June 29, 2020, 2:39pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127 "2020-06-29T14:39:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [June 29, 2020, 2:39pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/1 "2020-06-29T14:39:06Z")

</div>

Newbie here. Trying to add another field but not working. I have added below set of codes to a .conf file under /etc/conf.d. Logs for logstash not showing any error. Am I doing something wrong here? Using the new 7.8 version. Through winlogbeat.yml I am already injecting "winlogbeat" to the tags. Right now my tags look like -  
winlogbeat, ActiveDirectory, beats\_input\_codec\_plain\_applied

filter {  
if "winlogbeat" in [tags] and [event\_id] == 4624 {  
mutate {  
add\_field =\> { "messagemy" =\> "An account was successfully logged on" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![chandu5565](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@chandu5565](https://discuss.elastic.co/u/chandu5565)\
**Post date:** [June 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/2 "2020-06-29T14:44:30Z")

</div>

If you are using and operator both the conditions has to be true. use below filter it should work.

filter {  
if "winlogbeat" in [tags] and "4624" in [event\_id] {  
mutate {  
add\_field =\> { "messagemy" =\> "An account was successfully logged on" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [June 29, 2020, 3:10pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/3 "2020-06-29T15:10:07Z")

</div>

Just updated to suggested filter, didn't work.

End goal is to have that 1st line of the message filed as a new field. Even if I make this work, I have to maintain individual filters for all event IDs. Is there a better way to extract the 1st like from the message field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 29, 2020, 3:33pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/4 "2020-06-29T15:33:12Z")

</div>

Is event\_id nested inside an object, such as [winlog][event\_id], for example.

---

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [June 29, 2020, 3:45pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/5 "2020-06-29T15:45:46Z")

</div>

If I expand the document, it shows as winlog.event\_id. Here is the screenshot.

![windows event id table](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82268f38c28b565021e80a6dada3234eae8a859d.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 29, 2020, 4:24pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/6 "2020-06-29T16:24:04Z")

</div>

If event\_id is a field nested inside the winlog object then although in kibana you would refer to it as winlog.event\_id, in logstash you have to refer to it as [winlog][event\_id]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2020, 4:24pm UTC](https://discuss.elastic.co/t/can-not-add-a-new-field-using-if-filter-and-add-field/239127/7 "2020-07-27T16:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.