# Extract a string from a field and create a new field with that string

**URL:** https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051
**Category:** Logstash
**Created:** [February 6, 2017, 11:51am UTC](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051 "2017-02-06T11:51:32Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)
#### Post date: [February 6, 2017, 11:51am UTC](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051/1 "2017-02-06T11:51:32Z")

</div>

Hi EveryBody,

I'm working with logstash grok to extract a string from a field.  
Here is an example of the

```
"myfield":" stringToExtract-instance 2017-02-06 05:48:25 INFO XXXXXXXX"

```

I want to extract the stringToExtract from the field myfield.

I have given a try with

```
grok {
  match => [
    "myfield",
    " <ValueOfNewField>[^-instance]"
  ]
]

```

For the custom field

```
filter {
  mutate {
    add_field => { "newField" => "ValueOfNewField" }
  }
}

```

Well the first part is no working. But I pretty sure that the second will work if the first part works.

Any help for configuring the first part will be appreciated.  
Thanks.

---

<div class="post-metadata">

### Author: ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)
#### Post date: [February 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051/2 "2017-02-06T14:41:46Z")

</div>

My bad after reading [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) and experimenting on [http://grokconstructor.appspot.com/do/match?example=1](http://grokconstructor.appspot.com/do/match?example=1)

I came out with the following config

```
filter {
  grok {
     match => [
        "message",
        "^\ (?<newField>[^\]+)\-instance"
     ]
  }
}

```

This even works out of the box, it extract and create a new field of name **newField**. That something like the following is added to the event.

```
"newField" : "stringToExtract",

```

Hope this helps someone.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2017, 2:42pm UTC](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051/3 "2017-03-06T14:42:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.