# Create new field with metadata content

**URL:** https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052
**Category:** Logstash
**Created:** [June 15, 2018, 8:33am UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052 "2018-06-15T08:33:27Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [June 15, 2018, 8:33am UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/1 "2018-06-15T08:33:28Z")

</div>

Hey guys,

Thanks to my pipeline, I can extract data and store it to a metadata field :

```
 if ([ID2] == "000003")
  {
    grok
    {
      match => { "DESCRIPTION" => ["%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:RESTE}"] }
    }
    ruby
    {
      code => "@save_the_date = event.get('DATE_BATCH')"
    }
  }
  else
  {
    ruby
    {
      code => "event.set('DATE_BATCH', @save_the_date)"
    }

```

So now, how to add\_field with @save\_the\_date content ? because i tried to do :

```
add_field => {
      "TESTDATE" => "%{@save_the_date}"
    }

```

But it doesn't work

Can somebody help me ?

Thx for all

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2018, 1:44pm UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/2 "2018-06-15T13:44:00Z")

</div>

I don't understand. Your second ruby filter should do exactly what you're looking for.

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [June 15, 2018, 1:49pm UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/3 "2018-06-15T13:49:32Z")

</div>

I try to do that because in this case @save\_the\_date is empty .. Look at my first discussion with Badger on this subject to understand better :

> [@Method to timestamp my logstash events](https://discuss.elastic.co/t/method-to-timestamp-my-logstash-events/135888):
>
> Hello everybody, I have this input log : INFO;0000;000001;\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* INFO;0000;000002;\* LOG D'EXECUTION \* INFO;0000;000003;\* /data/EDT/batchs/files/logs/MNS014MT-20180612-20180613-0105.log \* INFO;0000;000004;\* …

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2018, 2:02pm UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/4 "2018-06-15T14:02:51Z")

</div>

Okay, but then the real problem is that `@save_the_date` is empty, not that you can't save it into a field.

I don't know why you started a new thread. The old problem seems to remain unsolved.

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [June 15, 2018, 2:05pm UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/5 "2018-06-15T14:05:31Z")

</div>

Ok thx you for answer I'll solve this one and continue to speak on the other one

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2018, 2:05pm UTC](https://discuss.elastic.co/t/create-new-field-with-metadata-content/136052/6 "2018-07-13T14:05:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
