# Extract message to additional fields
**URL:** https://discuss.elastic.co/t/extract-message-to-additional-fields/236198
**Category:** Beats
**Tags:** filebeat
**Created:** [June 8, 2020, 3:20pm UTC](https://discuss.elastic.co/t/extract-message-to-additional-fields/236198 "2020-06-08T15:20:53Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Sivakumar\_K](https://discuss.elastic.co/u/Sivakumar_K)
#### Post date: [June 8, 2020, 3:20pm UTC](https://discuss.elastic.co/t/extract-message-to-additional-fields/236198/1 "2020-06-08T15:20:53Z")
Hi All,
I am looking for some help, I have configured filebeat to collect the CISCO syslogs and push to elasticsearch, it's working fine.
I am looking for extracting the data from **log.original** and **messages** to addition fields (Username, IP, Group)
> **log.original :** %ASA-5-713119: Group = RA-VPN, Username = user-1, IP = , PHASE 1 COMPLETED
>
> **message:** Group = RA-VPN, Username = user-1, IP = , PHASE 1 COMPLETED
Can someone help understand how this can achieve this?
Do I have to do some changes in Filebeat level? Elastic search query itself
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [June 8, 2020, 6:35pm UTC](https://discuss.elastic.co/t/extract-message-to-additional-fields/236198/2 "2020-06-08T18:35:36Z")
What version of Elasticsearch are you running?
Starting version 7.5.0, Elasticsearch has a index-level setting called [`index.final_pipeline`](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/index-modules.html). You could create a [higher-order index template](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html#multiple-templates) for `filebeat-*` that defines this setting to a custom [ingest node](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) pipeline you create.
This pipeline could make the additional modifications you are looking to make to your data, before it get's indexed into Elasticsearch. Note that this pipeline would operate on any documents being indexed into `filebeat-*`, so you'll want to make sure to add conditional logic to process only documents for data being indexed by the `cisco` module.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2020, 8:35pm UTC](https://discuss.elastic.co/t/extract-message-to-additional-fields/236198/3 "2020-07-06T20:35:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.