# Create event on change of field

**URL:** https://discuss.elastic.co/t/create-event-on-change-of-field/275363
**Category:** Logstash
**Created:** [June 9, 2021, 3:16am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363 "2021-06-09T03:16:27Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)
#### Post date: [June 9, 2021, 3:16am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363/1 "2021-06-09T03:16:27Z")

</div>

Hi All

I need some help getting started in the right direction with a logstash configuration please:

We have log events coming into logstash right now. From each of the events we currently parse the name of a computer and the name of the WiFi access point that the computer is connected to.

What we need to do is compare the wifi access point for a computer each time a log event comes into logstash and create an ES event only when the new wifi access point is different to the last wifi access point (EG the computer has moved access points)

Can someone point me in the right direction please?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2021, 3:31am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363/2 "2021-06-09T03:31:42Z")

</div>

> [@johnwood](#):
>
> Can someone point me in the right direction please?

Take a look at the second configuration in [this](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/3) post.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2021, 3:32am UTC](https://discuss.elastic.co/t/create-event-on-change-of-field/275363/3 "2021-07-07T03:32:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
