# Global field

**URL:** <https://discuss.elastic.co/t/global-field/126545>\
**Category:** Logstash\
**Created:** [April 3, 2018, 10:14am UTC](https://discuss.elastic.co/t/global-field/126545 "2018-04-03T10:14:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Invictus](https://avatars.discourse-cdn.com/v4/letter/i/bc79bd/32.png) [@Invictus](https://discuss.elastic.co/u/Invictus)\
**Post date:** [April 3, 2018, 10:14am UTC](https://discuss.elastic.co/t/global-field/126545/1 "2018-04-03T10:14:43Z")

</div>

Hi,

I have two different logfiles.

Construction of the **first** one:

```
19.03.18-13:56:06 
TabellenName -A 12 -D 323  
TabellenName -A 329 -D 323  
TabellenName -A 12 -D 12,3
TabellenName -A 12 -D 323  
19.03.18-13:57:44 

```

Construction of the **second** one:

```
Message Successfully 
03/19/18 15:45:23

```

logstash.conf has the following structure for the **first** file:

```
  if [fields][LogEvent] == "Tabelle" {
           mutate {gsub => ["message", "[,]", ""]}
           grok {
                   match => {"message" => "%{GREEDYDATA:Tabelle} -A%{NUMBER:KorrespondezA}: \s* %{GREEDYDATA:DatensaetzeA:int} -D%{NUMBER:KorrespondezD}: \s* %{GREEDYDATA:DatensaetzeD:int}"}
                   remove_field => ["message"]
           }
           grok {
                   match => {"message" => "%{DATE:Datum}-%{TIME:Uhrzeit}"}
                   add_field => {"timestamp" => "%{Datum} %{Uhrzeit}"}
                   remove_field => ["Datum", "Uhrzeit", "message"}
           }
           date {
                   match => ["timestamp", "dd.MM.yy HH:mm:ss"]
                   target => ["@timestamp"]
                   remove_field => ["timestamp"]
           }
           mutate {gsub => ["Tabelle", "[.]", ""]}
           if "_grokparsefailure" in [tags] {
                   drop {}
           }
   }

```

The logstash.conf has the following structure for the **second** file:

```
    if [fields][LogEvent] == "delete_create" {
            if "Creation Time" in [message] {
                    grok {
                            match => {"message" => "%{DATE:Datum} %{TIME:Uhrzeit}"}
                            add_field => {"timestamp" => "%{Datum} %{Uhrzeit}"}
                            remove_field => ["Datum", "Uhrzeit", "message"]
                    }
                   date {
                           match => ["timestamp", "MM/dd/yy HH:mm:ss"]
                           target => ["@timestamp"]
                           remove_field => ["timestamp"]
                   }
            }
            if "Successfully" in [message] {
                    grok {
                            match => {"message" => "%{WORD:Status}"}
                            remove_field => ["message"]
                    }
            }
            mutate {add_field => {"newmessage" => "%{timestamp} %{Status}"}}

```

So the problem I have is to write the timestamp before the Message.  
Example for the second file:

```
03/19/18 15:45:23 Successfully

```

After that I want a grok filter to parse the newmessage field. So that the message line in the Logfile will be set to the timestamp where the logfile had been created and not "today/now" where it has been read into the ELK-Stack.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 10:15am UTC](https://discuss.elastic.co/t/global-field/126545/2 "2018-05-01T10:15:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.