# Error while creating new Fields in Elastic Search

**URL:** <https://discuss.elastic.co/t/error-while-creating-new-fields-in-elastic-search/340064>\
**Category:** Elasticsearch\
**Created:** [August 3, 2023, 3:35pm UTC](https://discuss.elastic.co/t/error-while-creating-new-fields-in-elastic-search/340064 "2023-08-03T15:35:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jennifer\_Coley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jennifer_coley/32/122429_2.png) [@Jennifer\_Coley](https://discuss.elastic.co/u/Jennifer_Coley)\
**Post date:** [August 3, 2023, 3:35pm UTC](https://discuss.elastic.co/t/error-while-creating-new-fields-in-elastic-search/340064/1 "2023-08-03T15:35:55Z")

</div>

hello ,

Can anyone help, I'm new to elasticsearch Kibana but learnt in recent days to understand the usage.  
I have a Index name "logstash-\*" which receives logs constantly, my task is to filter from all logs in field "message" which contains "Incoming Message" and save those results in another(new field) should display those results.

my try's was:  
1)create a field name "incoming messages"  
2)enabled set value ,  
if(doc.containsKey('Incoming Message:.')) {  
emit(doc['message.keyword']);  
}  
3)Result is NULL(blank) in the field.

I understood my script is somewhere wrong, my expectation is checking "message" field if it contains "Incoming Message:" word then those should print in my new field. so if i select new field can able to view filtered data apart from querying everytime.

thanks a lot,  
Jenny

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2023, 3:36pm UTC](https://discuss.elastic.co/t/error-while-creating-new-fields-in-elastic-search/340064/2 "2023-08-31T15:36:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.