# Dynamic value of the add\_field processor

**URL:** <https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 28, 2020, 11:43am UTC](https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827 "2020-01-28T11:43:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nahiko2000](https://avatars.discourse-cdn.com/v4/letter/n/bc8723/32.png) [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\
**Post date:** [January 28, 2020, 11:43am UTC](https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827/1 "2020-01-28T11:43:40Z")

</div>

Hi!  
In a Filebeat input I have a processor in Filebeat like this:

processors:

```
- add_fields:
    when:
      regexp:
        message: '[0-9]{8}\-?[a-zA-Z]'
      fileds:
        newfield: XXX

```

So, when a new line gets to this processor it tests agains that regex and if it matches, it adds a new field called 'newfield' to the event.

However, I would not need it to add 'XXX' as value I would need it to add the same value as the part of the message that matched, for example, for this input:

> The quick brown fox whose id number was FX54J jumped over the lazy dog!

the event would **not** have any 'newfield' field, BUT for this input:

> The quick brown fox whose id number was 12345678a jumped over the lazy dog!

it would have the value '12345678a' in the field 'newfield', and for this other input:

> The quick brown fox whose id number was 55555555L jumped over the lazy dog!

the value of the 'newfield' would be '55555555L'

Can that be done? Or the value of the new field **MUST ALWAYS** be the same

Thanks a lot in advance!

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [January 28, 2020, 12:57pm UTC](https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827/2 "2020-01-28T12:57:52Z")

</div>

Hi!

I would suggest to go with [processor-script](https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html) so as to programmatically identify and replace the field.

C.

---

<div class="post-metadata">

**Author:** ![nahiko2000](https://avatars.discourse-cdn.com/v4/letter/n/bc8723/32.png) [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\
**Post date:** [January 29, 2020, 3:56pm UTC](https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827/3 "2020-01-29T15:56:25Z")

</div>

Wow!! Thank you sooooo much, I did not know about the processor-script.

I have tried some scripts and yes, it can do the job

Thanks again!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2020, 3:56pm UTC](https://discuss.elastic.co/t/dynamic-value-of-the-add-field-processor/216827/4 "2020-02-26T15:56:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.