# Create a field with information from another field

**URL:** <https://discuss.elastic.co/t/create-a-field-with-information-from-another-field/230216>\
**Category:** Logstash\
**Created:** [April 28, 2020, 4:58pm UTC](https://discuss.elastic.co/t/create-a-field-with-information-from-another-field/230216 "2020-04-28T16:58:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pmo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pmo/32/79080_2.png) [@pmo](https://discuss.elastic.co/u/pmo)\
**Post date:** [April 28, 2020, 4:58pm UTC](https://discuss.elastic.co/t/create-a-field-with-information-from-another-field/230216/1 "2020-04-28T16:58:31Z")

</div>

Hi expert,  
I would like to know if it's possible to create a new field with information that are taken from another field.  
I'm using sql connection.

I've a field named :

- Code\_postal (that has 3 or 5 digits - I only need to take care of the 5 digits)

I would like to create a field named :

- departement (should take the 2 first digits of the **Code\_postal** field).

How Can I do that in logstash, I was thinking about Regexp to do that but never see any exemple.

Best Regards,  
PM

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 28, 2020, 5:11pm UTC](https://discuss.elastic.co/t/create-a-field-with-information-from-another-field/230216/2 "2020-04-28T17:11:51Z")

</div>

You could try

```
grok { match => { "Code_postal" => "^(?<departement>[\d]{2})" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2020, 5:11pm UTC](https://discuss.elastic.co/t/create-a-field-with-information-from-another-field/230216/3 "2020-05-26T17:11:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.