# Creating fields on special case log messages

**URL:** <https://discuss.elastic.co/t/creating-fields-on-special-case-log-messages/60309>\
**Category:** Elasticsearch\
**Created:** [September 12, 2016, 3:59pm UTC](https://discuss.elastic.co/t/creating-fields-on-special-case-log-messages/60309 "2016-09-12T15:59:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![christopher\_pax](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christopher_pax/32/9856_2.png) [@christopher\_pax](https://discuss.elastic.co/u/christopher_pax)\
**Post date:** [September 12, 2016, 3:59pm UTC](https://discuss.elastic.co/t/creating-fields-on-special-case-log-messages/60309/1 "2016-09-12T15:59:16Z")

</div>

I have multiple service logs being shipped from every host to logstash using rsyslog.

```
# mssg log
auth,authpriv.* @logsashserver:5548
kern.* @logsashserver:5548
mail.* @logsashserver:5548

```

after being ingested by logstash and shipped to elasticsearch, I would have various logs from different programs. each with different messages. below is an example of a sshd message:

```
{
  "_index": "mssg-2016.09.12",
  "_type": "mssg",
  "_id": "example",
  "_score": null,
  "_source": {
    "message": "pam_unix(sshd:session): session opened for user bob by (uid=0)",
    "@version": "1",
    "@timestamp": "2016-09-12T14:42:29.000Z",
    "type": "mssg",
    "host": "123.123.123.123",
    "priority": 86,
    "timestamp": "Sep 12 10:42:29",
    "logsource": "eample-ls",
    "program": "sshd",
    "pid": "113222",
    "severity": 6,
    "facility": 10,
    "facility_label": "security/authorization",
    "severity_label": "Informational"
  }
}

```

What I want to do, is when a message matches:  
`^(pam_unix.*)(session opened for user )(\w+)(.*)`

I want to add a field called `sshd_user`, with the value of the 3rd capture group (the user name). So I can build a unique list of users logging in to various systems. I have recently been trying to wrap my head around using Analyzers and Tokenizers, but I am not sure what to do / or even if that is the correct approach. Should I be dealing with this on the logstash level? if this can be done using Analyzers, how?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 13, 2016, 5:58am UTC](https://discuss.elastic.co/t/creating-fields-on-special-case-log-messages/60309/2 "2016-09-13T05:58:09Z")

</div>

You might be able to do this with an analyzer but doing it upon ingestion (either with an ingest node or with Logstash) is the better option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:20pm UTC](https://discuss.elastic.co/t/creating-fields-on-special-case-log-messages/60309/3 "2017-07-05T22:20:53Z")

</div>

Closed on July 5, 2017, 10:20pm UTC