# Create new field from existing one

**URL:** <https://discuss.elastic.co/t/create-new-field-from-existing-one/236778>\
**Category:** Logstash\
**Created:** [June 11, 2020, 7:54pm UTC](https://discuss.elastic.co/t/create-new-field-from-existing-one/236778 "2020-06-11T19:54:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 11, 2020, 7:54pm UTC](https://discuss.elastic.co/t/create-new-field-from-existing-one/236778/1 "2020-06-11T19:54:07Z")

</div>

Create new field with proper url content.

this path are sometime 10 level deep and sometime 20.

this is what I have

```
full_file_name: /home/sachin/Tests/noise/spread/xspread/xspread_a_10_v1.tl.gz
project: sachin
file_name: xspread_a_10_v1.tl.gz

to new field 

url_file: 'http://server1/Projects/JMV3/less_file.php?project=sachin&act=multiview&path=%2F%2Fhome%2sachin%2FTests%2Fnoise%2Fspread%2Fspred%2F&files=xspread_a_10_v1.tl.gz'

```

seems like I have to add follwing in beginning of the path  
[http://server1/Projects/JMV3/less\_file.php?project=%{project}&act=multiview&path=%2F](http://server1/Projects/JMV3/less_file.php?project=%25%7Bproject%7D&act=multiview&path=%2F)

and then replace all / with %2F and add  
%2F&File=%{file\_name}

how do I do it?

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [June 11, 2020, 9:44pm UTC](https://discuss.elastic.co/t/create-new-field-from-existing-one/236778/2 "2020-06-11T21:44:53Z")

</div>

I have used grok and created this and it works.  
actually this was old method where I needed %2F no more I can just pass the path with /

mutate {  
add\_field =\> { "file\_url" =\> "[http://server/Projects/JM/less\_file.php?act=multiview&proj=%{project}&path=%{location}/&files=%{file\_name}.gz](http://server/Projects/JM/less_file.php?act=multiview&proj=%25%7Bproject%7D&path=%25%7Blocation%7D/&files=%25%7Bfile_name%7D.gz)" }  
}

and from full path I got file\_name  
grok {  
match =\> { "file\_path" =\> "%{GREEDYDATA:api\_class}" }  
}  
mutate {  
# split the field on /  
split =\> ["api\_class" , "/"]  
# save the last element of the array as the api\_method.  
add\_field =\> ["file\_name", "%{[api\_class][-1]}" ]  
}

grok { match =\> { "file\_path" =\> "%{GREEDYDATA:location}(/%{DATA}.log)" } }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 9:45pm UTC](https://discuss.elastic.co/t/create-new-field-from-existing-one/236778/3 "2020-07-09T21:45:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.