# Dotted fieldnames, how to create?

**URL:** https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018
**Category:** Logstash
**Created:** [April 27, 2020, 7:30pm UTC](https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018 "2020-04-27T19:30:52Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![WimDH](https://avatars.discourse-cdn.com/v4/letter/w/74df32/32.png) [@WimDH](https://discuss.elastic.co/u/WimDH)
#### Post date: [April 27, 2020, 7:30pm UTC](https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018/1 "2020-04-27T19:30:53Z")

</div>

Hi all,

Not sure if this is the right place to ask...  
I'm new to ElasticStack, and I'm trying to find documentation on how fieldnames are built.  
When I look at Kibana Discover, I see fieldnames like `host.name` and `system.auth.program`.  
I was able to successfuly add my custom logfile `mylog.log`, and my fieldnames defined in a grok filter are `field1`, `field2`.  
I'm looking on how I can create a field like `mylog.field1` and mylog.field2`

I'm not sure on what to search (and I'm ok reading documentation).  
Can someone please point me to the right docs?

Thanks a lot!

---

<div class="post-metadata">

### Author: ![KoettingSimon](https://avatars.discourse-cdn.com/v4/letter/k/ba9def/32.png) [@KoettingSimon](https://discuss.elastic.co/u/KoettingSimon)
#### Post date: [April 27, 2020, 7:49pm UTC](https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018/2 "2020-04-27T19:49:15Z")

</div>

Hi WimDH,  
the term you looking for is nested fields.  
It should work with putting a [mylog] in front of your fields in the GrokPattern.  
Like

```auto
%{GREEDYDATA:[mylog]field1}

```

Regards,  
Simon

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 27, 2020, 9:16pm UTC](https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018/3 "2020-04-27T21:16:29Z")

</div>

> [@KoettingSimon](#):
>
> %{GREEDYDATA:[mylog]field1}

That may work in a grok filter, but in a sprintf reference that would get an ambiguous field reference error. It would be better to use [mylog][field1].

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2020, 9:16pm UTC](https://discuss.elastic.co/t/dotted-fieldnames-how-to-create/230018/4 "2020-05-25T21:16:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.