# Creating a new field based on substring
**URL:** https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248
**Category:** Logstash
**Created:** [June 10, 2018, 12:18am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248 "2018-06-10T00:18:57Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Pradana](https://discuss.elastic.co/u/Pradana)
#### Post date: [June 10, 2018, 12:18am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/1 "2018-06-10T00:18:57Z")
I have below message :
2018-06-08 21:35:44,182 DEBUG [org.mobicents.smsc.library.CdrGenerator] 2018-06-08 21:35:44.171,62895416500343,1,1,6282880640846,1,1,success\_esme,SS7\_HR,message,null,92044,0,null,null,null,null,628964011092,null,0,15,null,0,0,,,,2,"Yth.Bpk/Ibu kredit d","",,,
I filtered it using :
%{TIMESTAMP\_ISO8601:logdate} %{LOGLEVEL:debugtype} %{DATA:source} %{TIMESTAMP\_ISO8601:smsdate},%{WORD:sourceaddr},%{NUMBER:addrton},%{NUMBER:addrnpi},%{WORD:destaddr},%{NUMBER:sourceton},%{NUMBER:sourcenpi},%{WORD:status}
I want to add another filed, let says "operator" based on the first 5 digit of sourceaddr.
How i can achieved above objective ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 10, 2018, 1:20am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/2 "2018-06-10T01:20:00Z")
[This](https://discuss.elastic.co/t/extracting-a-substring/134268) provides an example of extracting a fixed number of characters as a prefix to a field.
---
### Author:  [@Pradana](https://discuss.elastic.co/u/Pradana)
#### Post date: [June 10, 2018, 5:25am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/3 "2018-06-10T05:25:28Z")
Thanks for your comment. I have read the sample but still i am not sure how to apply it. Can you elaborate more on this ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 10, 2018, 5:55am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/4 "2018-06-10T05:55:10Z")
Have you tried a separate grok block with the following:
```auto
grok { match => ["sourceaddr", "^(?.....)"] }
```
---
### Author:  [@Pradana](https://discuss.elastic.co/u/Pradana)
#### Post date: [June 10, 2018, 8:51am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/5 "2018-06-10T08:51:14Z")
I try like below in [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) :
%{TIMESTAMP\_ISO8601:logdate} %{LOGLEVEL:debugtype} %{DATA:source} %{TIMESTAMP\_ISO8601:smsdate},%{WORD:sourceaddr},%{NUMBER:addrton},%{NUMBER:addrnpi},%{WORD:destaddr},%{NUMBER:sourceton},%{NUMBER:sourcenpi},%{WORD:status}["sourceaddr", "^(?.....)"]
Above pattern doesn't give me another field operator.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 10, 2018, 9:54am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/6 "2018-06-10T09:54:12Z")
Put it in two separate grok blocks. The first one extracts all the fields and the second the 5 character prefix.
---
### Author:  [@Pradana](https://discuss.elastic.co/u/Pradana)
#### Post date: [June 11, 2018, 11:15am UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/7 "2018-06-11T11:15:20Z")
Hi Christian,
Thanks for your suggestion. Its working. Now I have a field call operator with only 5 string on it. But I have another problem, it seems, after adding this field, the field is not part of the index. How I include them into index ?
---
### Author:  [@Pradana](https://discuss.elastic.co/u/Pradana)
#### Post date: [June 11, 2018, 1:52pm UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/8 "2018-06-11T13:52:22Z")
Hi,
It seems the issue is in Kibana. After adding the field to become index in kibana, the field can be visualized now.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2018, 1:52pm UTC](https://discuss.elastic.co/t/creating-a-new-field-based-on-substring/135248/9 "2018-07-09T13:52:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.