# Filebeat add field based on line content

**URL:** <https://discuss.elastic.co/t/filebeat-add-field-based-on-line-content/217741>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 4, 2020, 8:25am UTC](https://discuss.elastic.co/t/filebeat-add-field-based-on-line-content/217741 "2020-02-04T08:25:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohammad\_Mousavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohammad_mousavi/32/56508_2.png) [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\
**Post date:** [February 4, 2020, 8:25am UTC](https://discuss.elastic.co/t/filebeat-add-field-based-on-line-content/217741/1 "2020-02-04T08:25:31Z")

</div>

Hi. I have an access.log that holds multiple vod applications log.  
I wanna have different grok filter for each application log. I thought maybe I can add some field in filebeat to trigger groks in logstash based on them. something like this: (which is wrong)

> ```
> processors:
> - add_fields:
> when:
> regexp:
> message: "App1"
> target: myfield
> fields:
> name: {app_type: app1}
> when:
> regexp:
> message: "App2"
> target: myfield
> fields:
> name: {app_type: app2}
> 
> ```

then in logstash:

> filter {  
> if [myfield][app\_type] == 'App1' {  
> grok { ... }  
> if [myfield][app\_type] == 'App2' {  
> grok { ... }  
> }

any idea on this ?  
Thanx a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2020, 8:25am UTC](https://discuss.elastic.co/t/filebeat-add-field-based-on-line-content/217741/2 "2020-03-03T08:25:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.