# Grok add\_field from another field

**URL:** https://discuss.elastic.co/t/grok-add-field-from-another-field/141705
**Category:** Logstash
**Created:** [July 26, 2018, 7:14am UTC](https://discuss.elastic.co/t/grok-add-field-from-another-field/141705 "2018-07-26T07:14:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![igemon](https://avatars.discourse-cdn.com/v4/letter/i/a8b319/32.png) [@igemon](https://discuss.elastic.co/u/igemon)
#### Post date: [July 26, 2018, 7:14am UTC](https://discuss.elastic.co/t/grok-add-field-from-another-field/141705/1 "2018-07-26T07:14:53Z")

</div>

I have a field "host" that looks like this:  
"[aaa-b1.site.com](http://aaa-b1.site.com)"  
I want to add a new field "env" containing only "b1". My filter:

```
grok {
match => {
"message" => "url:%{DATA:host}"
}
add_field => { "env" => ".*%{DATA:env}\.site\.com" }

```

How can I get a new field out of an existing field?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 26, 2018, 12:46pm UTC](https://discuss.elastic.co/t/grok-add-field-from-another-field/141705/2 "2018-07-26T12:46:44Z")

</div>

To extract the "b1" from host you could use

```
grok { match => { "host" => "%{WORD}-%{WORD:env}.site.com" } }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2018, 12:46pm UTC](https://discuss.elastic.co/t/grok-add-field-from-another-field/141705/3 "2018-08-23T12:46:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.