# Creating a tag out of the extracted field from the message **URL:** \ **Category:** Logstash\ **Created:** [November 4, 2015, 2:43pm UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753 "2015-11-04T14:43:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![swetav](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@swetav](https://discuss.elastic.co/u/swetav)\ **Post date:** [November 4, 2015, 2:43pm UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/1 "2015-11-04T14:43:02Z")
Hi I have parsed a log using "COMBINEDAPACHELOG". filter{ grok { match =\> ["message", "%{COMBINEDAPACHELOG}"] } } It's working well but now i need to extract string from the message tag and crerate a new tag out of the extracted one.I am not sure of how to do it. Any help would be highly appreciated. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 4, 2015, 6:37pm UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/2 "2015-11-04T18:37:02Z")
I suspect you mean "field" rather than "tag". Both exists as Logstash concepts, and `message` is a field rather than a tag. It's not clear exactly what you want to do. Please give an example. The COMBINEDAPACHELOG pattern already extracts fields from all parts of an Apache log entry. ---
**Author:** ![swetav](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@swetav](https://discuss.elastic.co/u/swetav)\ **Post date:** [November 5, 2015, 8:19am UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/3 "2015-11-05T08:19:10Z")
yeah..my bad..Message is a field.. TO be more specific : I have following lines in log: 15/10/12 21:21:30 DEBUG db.DBConfiguration: Fetching password from job credentials store 15/10/12 21:21:30 DEBUG db.DataDrivenDBInputFormat: Creating input split with lower bound '1=1' and upper bound '1=1' 15/10/12 21:21:31 INFO mapred.JobClient: Running job: job\_201510101XXXXX 15/10/12 21:21:32 INFO mapred.JobClient: map 0% reduce 0% 15/10/12 21:22:13 INFO mapred.JobClient: map 100% reduce 0% 15/10/12 21:22:31 INFO mapred.JobClient: Job complete: job\_20151010XXX 15/10/12 21:22:31 INFO mapred.JobClient: Counters: 23 15/10/12 21:22:31 INFO mapred.JobClient: File System Counters 15/10/12 21:22:31 INFO mapred.JobClient: FILE: Number of bytes read=0 15/10/12 21:22:31 INFO mapred.JobClient: FILE: Number of bytes written=190293 15/10/12 21:22:31 INFO mapred.JobClient: FILE: Number of read operations=0 15/10/12 21:22:31 INFO mapred.JobClient: FILE: Number of large read operations=0 15/10/12 21:22:31 INFO mapred.JobClient: FILE: Number of write operations=0 15/10/12 21:22:31 INFO mapred.JobClient: HDFS: Number of bytes read=87 15/10/12 21:22:31 INFO mapred.JobClient: HDFS: Number of bytes written=26807938 15/10/12 21:22:31 INFO mapred.JobClient: HDFS: Number of read operations=2 15/10/12 21:22:31 INFO mapred.JobClient: HDFS: Number of large read operations=0 15/10/12 21:22:31 INFO mapred.JobClient: HDFS: Number of write operations=1 15/10/12 21:22:31 INFO mapred.JobClient: Job Counters 15/10/12 21:22:31 INFO mapred.JobClient: Launched map tasks=1 15/10/12 21:22:31 INFO mapred.JobClient: Total time spent by all maps in occupied slots (ms)=43939 15/10/12 21:22:31 INFO mapred.JobClient: Total time spent by all reduces in occupied slots (ms)=0 15/10/12 21:22:31 INFO mapred.JobClient: Total time spent by all maps waiting after reserving slots (ms)=0 15/10/12 21:22:31 INFO mapred.JobClient: Total time spent by all reduces waiting after reserving slots (ms)=0 15/10/12 21:22:31 INFO mapred.JobClient: Map-Reduce Framework 15/10/12 21:22:31 INFO mapred.JobClient: Map input records=134771 15/10/12 21:22:31 INFO mapred.JobClient: Map output records=134771 message:15/10/12 04:18:07 INFO mapred.JobClient: Running job: job\_201510101XXX Now i want to extract job\_201510101XXX and Map output records and put them in separate field(after creating the field) so that i could create a graph in kibana ..job\_id v/s recods.. But i am not sure of how to do that... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 5, 2015, 11:55am UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/4 "2015-11-05T11:55:36Z")
Extracting the job id is easy _for that line_, but it sounds like you want that job id to be connected to lots of other log records. Correct? ---
**Author:** ![swetav](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@swetav](https://discuss.elastic.co/u/swetav)\ **Post date:** [November 5, 2015, 12:31pm UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/5 "2015-11-05T12:31:49Z")
yeah..exactly.. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 5, 2015, 3:13pm UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/6 "2015-11-05T15:13:42Z")
I suspect you can use the [aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) for this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/creating-a-tag-out-of-the-extracted-field-from-the-message/33753/7 "2017-07-06T05:23:50Z")