# Copy field on event

**URL:** https://discuss.elastic.co/t/copy-field-on-event/87631
**Category:** Logstash
**Created:** [May 30, 2017, 8:22pm UTC](https://discuss.elastic.co/t/copy-field-on-event/87631 "2017-05-30T20:22:47Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![rocavalcante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocavalcante/32/18648_2.png) [@rocavalcante](https://discuss.elastic.co/u/rocavalcante)
#### Post date: [May 30, 2017, 8:22pm UTC](https://discuss.elastic.co/t/copy-field-on-event/87631/1 "2017-05-30T20:22:47Z")

</div>

I'm new to logstash, I'm trying to use logstash and filebeat.  
'The filebeat sends the events (lines) of a log file \* .txt, and logstash does the filter and cature the messages I want, however the main messages are in the first lines of code of the log, the doubt is:  
How to aggregate these events with the stored dog information 1.  
Question 2: How to hide the other log events to be able to use this in a database.  
P; s: I already used mutate, aggretate and grok and even had success. Could you tell me what I'm missing.

example log:

XPTO,  
NG,A0000  
1704195438  
V0.1.34

TEST

fist-pipleine

input {  
beats {  
port =\> "5043"  
}

}

filter {

# change "\_" to "-" title archive

mutate {  
gsub =\> ["source", "\_", "-"]

}

# capture name of archive 'log' 'SFCS / MAC / XXXXXXXX / DATA / HORA'

grok {  
match =\> ["source", "%{WORD:t1}(?:[-])%{WORD:t2}(?:[-])%{WORD:mac}(?:[-])%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}(?:[-])%{HOUR:hour}%{MINUTE:minute}%{SECOND:second}.txt$"]  
}

# check first lines of archive

grok {  
match =\> ["message", "(?.\*?),$"]  
match =\> ["message", "%{WORD:word2}(?:[,])%{WORD:word3}"]  
}

grok {  
match =\> ["name", "(?.\*?),$"]  
}

#Test mutate  
mutate {  
replace =\> { "%{word1}" =\> "%{s}"}  
add\_field =\> {"%{word1}[myNewField]" =\> "%{s}"}  
}

# add field "datetime" with data captured

mutate { add\_field =\> ["datetime", "%{month}/%{day}/%{year} %{hour}:%{minute}"] }  
mutate { remove\_field =\> ["year", "day", "month", "hour", "minute"] }

teste aggregate  
if [message] == "XPTO," {  
aggregate {  
task\_id =\> "%{word1}"  
code =\> "map['exemplo'] = 0"  
map\_action =\> "create"

}  
}

if [message] == "1704195438" {  
aggregate {  
task\_id =\> "%{word1}"  
code =\> "map['exemplo'] += event.get('duration')"  
map\_action =\> "update"

}  
}

# mutate {

# add\_field =\> {"juntos" =\> "%{word1}/%{word2}/%{word3}"}

# remove\_field =\> ["word1", "word2", "word3"]

}

output {

stdout { codec =\> rubydebug { metadata =\> true } }  
#stdout {  
#codec =\> json\_lines

# jdbc {

# connection\_string =\> "jdbc:postgresql://myip/mydb"

# username =\> "myuser"

# password =\> "mypassword"

# statement =\> [INSERT INTO efc\_log(log\_recebido)VALUES ('XPTO');]

# 

# }

}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2017, 8:22pm UTC](https://discuss.elastic.co/t/copy-field-on-event/87631/2 "2017-06-27T20:22:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.