# Catenate two fields as message

**URL:** https://discuss.elastic.co/t/catenate-two-fields-as-message/157243
**Category:** Logs
**Created:** [November 18, 2018, 7:56pm UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243 "2018-11-18T19:56:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Anton1](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Anton1](https://discuss.elastic.co/u/Anton1)
#### Post date: [November 18, 2018, 7:56pm UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243/1 "2018-11-18T19:56:05Z")

</div>

I got the logs ui working with my own index. However, message and loglevel are two different fields.

Is it possible to catenate level and message so that both are shown in logs ui?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 19, 2018, 7:06am UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243/2 "2018-11-19T07:06:54Z")

</div>

Usually the message field contains the full message. Is that not the case for your logs?

---

<div class="post-metadata">

### Author: ![Anton1](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Anton1](https://discuss.elastic.co/u/Anton1)
#### Post date: [November 19, 2018, 7:28am UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243/3 "2018-11-19T07:28:02Z")

</div>

Not in our case, no. I guess it might be possible to massage the data in logstash to make it work.  
Was just curious if it was possible. It would be nice if such functionality was added.

---

<div class="post-metadata">

### Author: ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [November 19, 2018, 10:57am UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243/4 "2018-11-19T10:57:35Z")

</div>

Thank you for the suggestion, @Anton1! Making the reconstruction of the log message customizable is definitely on our list. Right now though, creating a merged `message` field during ingestion in Logstash would be the way to go.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2018, 10:57am UTC](https://discuss.elastic.co/t/catenate-two-fields-as-message/157243/5 "2018-12-17T10:57:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.