# Extract and add field

**URL:** <https://discuss.elastic.co/t/extract-and-add-field/49617>\
**Category:** Logstash\
**Created:** [May 10, 2016, 7:56am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617 "2016-05-10T07:56:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![HugoBang](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@HugoBang](https://discuss.elastic.co/u/HugoBang)\
**Post date:** [May 10, 2016, 7:56am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/1 "2016-05-10T07:56:35Z")

</div>

Hello,

How can I extract a value from message field and add field with the extracted value?

For example, message field is as below.

"message": "This is a test.\n\nSubject:\n\tSecurity ID:\t\tT-E-S-T\n\tAccount Name:\t\tTEST$\n\tAccount Domain:\t\ttest\n\tLogon ID:\t\ttest\n\nService:\n\tServer:\tNT Test / Test\n\tService Name:\tTestProcess()\n\nProcess:\n\tProcess ID:\ttest\n\tProcess Name:\tC:\Windows\System32\test.exe\n\nService Request Information:\n\tPrivileges:\t\tTest"

I want to extract only "C:\Windows\System32\test.exe" from the message and add field.

How can I do that with filter of Logstash?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 8:44am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/2 "2016-05-10T08:44:39Z")

</div>

Have a look at the grok filter.

---

<div class="post-metadata">

**Author:** ![HugoBang](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@HugoBang](https://discuss.elastic.co/u/HugoBang)\
**Post date:** [May 10, 2016, 8:55am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/3 "2016-05-10T08:55:42Z")

</div>

I am trying with grok filter. Could you give me any guidance? The filter below is not working.

```
  grok {
     match => { "message" => "(?<process_name>C\:*.exe)" }
  }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 10:50am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/4 "2016-05-10T10:50:12Z")

</div>

You're on the right track but your regexp is wrong. This should at least be closer:

```
(?<process_name>C:\\\S\.exe)

```

Literal backslashes need to be escaped, \S matches all non-whitespace characters, and periods should be escaped too. You should probably Include "Process Name" too since there might an .exe filepath somewhere else in the message.

---

<div class="post-metadata">

**Author:** ![HugoBang](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@HugoBang](https://discuss.elastic.co/u/HugoBang)\
**Post date:** [May 11, 2016, 6:02am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/5 "2016-05-11T06:02:32Z")

</div>

Thank you for your feedback.

But it is not working. The process\_name field is not added. ☹

Also I can't find any error logs at the logstash logs.

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [May 11, 2016, 7:55am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/6 "2016-05-11T07:55:54Z")

</div>

Try this, this should work :  
`(?<process_name>C:\\.*\.exe)`

---

<div class="post-metadata">

**Author:** ![HugoBang](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@HugoBang](https://discuss.elastic.co/u/HugoBang)\
**Post date:** [May 12, 2016, 3:35am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/7 "2016-05-12T03:35:21Z")

</div>

It works.

Thank you a lot!!

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [May 12, 2016, 5:50am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/8 "2016-05-12T05:50:14Z")

</div>

You're welcome 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/extract-and-add-field/49617/9 "2017-07-06T04:57:57Z")

</div>