# Extract value from Nested message field - LogStash Kibana Grok Mutate
**URL:** https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368
**Category:** Logstash
**Created:** [April 6, 2021, 6:12pm UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368 "2021-04-06T18:12:56Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)
#### Post date: [April 6, 2021, 6:12pm UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/1 "2021-04-06T18:12:56Z")
I've configured a FileBeat service to send logs to Kibana via LogStash. FileBeat and LogStash are in different servers while Kibana is inside an AWS ElasticSearch domain. The logs are visible in the Kibana dashboard. In each record, there's a field called **message** which consists of 10 sub-fields (nested field). What I need to do is, extract values from those sub-fields and present them as separate fields.
I have tried both GROK and MUTATE to achieve this but no progress.
Let's consider one of the sub-field, named **conName**.
Using MUTATE : Tried putting field name and sub-field name in square brackets, like explained in one of previous answers. I got `%{[message][conName]}` as the output.
```auto
mutate {
add_field => {
"custom_field1" => "%{[message][conName]}"
}
}
```
Using MUTATE with split: Following [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html), I tried using split to first split the message field into independent 10 fields, did not work either.
```auto
mutate {
split => { "message" => "," }
add_field => { "message1" => "%{message[0]}" }
}
```
Using GROK
```auto
grok {
match => { "message" => "%{STRING:conName}" }
}
```
At least tell me which one should I use: MUTATE or GROK?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 6, 2021, 9:22pm UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/2 "2021-04-06T21:22:13Z")
> [@Sandun\_Akalanka](#):
>
> `"%{message[0]}"`
That would have to be `"%{[message][0]}"` in any version of logstash from the last couple of years.
What does the original [message] field look like?
---
### Author:  [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)
#### Post date: [April 7, 2021, 5:55am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/3 "2021-04-07T05:55:08Z")
I changed the syntax like you said, now it's showing the whole message field.
Example record of the message field :
```auto
2021-04-05 13:32:03.746+0000 | INFO | BRAINWAVE_API | DEV | | | 22460 | [scheduling-1] | c.h.w.a.bwService | Fetching results for orgI : 81ge0-de12ff-59jla0 orgN : Cactus Corp
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 7, 2021, 4:41pm UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/4 "2021-04-07T16:41:01Z")
You are splitting the message field using ",", but it is separated with "|". Try
```
mutate { split => { "message" => "|" } }
```
---
### Author:  [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)
#### Post date: [April 15, 2021, 11:39am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/5 "2021-04-15T11:39:58Z")
Thank you very much. Replacing the "," with "|" solved the issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2021, 11:40am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368/6 "2021-05-13T11:40:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.