# Combine fields into one field but from Grok match

**URL:** <https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370>\
**Category:** Logstash\
**Created:** [August 7, 2018, 4:14pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370 "2018-08-07T16:14:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![waqark3389](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqark3389/32/34265_2.png) [@waqark3389](https://discuss.elastic.co/u/waqark3389)\
**Post date:** [August 7, 2018, 4:14pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370/1 "2018-08-07T16:14:28Z")

</div>

> match =\> ["message", "(?\<Original\_Time\>%{YEAR}.%{MONTHNUM}.%{MONTHDAY} %{TIME}Z) (?%{SYSLOG5424SD}):(?%{SYSLOG5424SD}):(?%{SYSLOG5424SD}) (?(.|\r|\n)\*)"]  
> break\_on\_match =\> false  
> mutate {
> 
> ```
> add_field => {"lognodeinstance" => "%{lognode} %{loginstance}"} 
> }
> 
> ```

As you can see I am created a named capture called "lognode" and "loginstance" - is there a way to combine these two into one field called lognodeinstance - I have attempted it above but this prints the text literally!

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 7, 2018, 4:33pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370/2 "2018-08-07T16:33:24Z")

</div>

Well, no, I cannot see any named capture called lognode or loginstance. If those fields existed then that would be the right way to add a new field combining them. If those fields do not exist then you should expect to get the unsubstituted text.

---

<div class="post-metadata">

**Author:** ![waqark3389](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqark3389/32/34265_2.png) [@waqark3389](https://discuss.elastic.co/u/waqark3389)\
**Post date:** [August 7, 2018, 4:50pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370/4 "2018-08-07T16:50:11Z")

</div>

@Badger So sorry - I was creating the named captures further down and trying to use them above, in the config file. I thought I was capturing them in the above match but I was doing this later! #facepalm.  
sorry for wasting your time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2018, 4:55pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370/5 "2018-09-04T16:55:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.