# Grok filter add\_field
**URL:** https://discuss.elastic.co/t/grok-filter-add-field/226902
**Category:** Logstash
**Created:** [April 7, 2020, 1:21pm UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902 "2020-04-07T13:21:12Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)
#### Post date: [April 7, 2020, 1:21pm UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/1 "2020-04-07T13:21:13Z")
Hi,
I've tried using a add\_field in the grok filter.
I want to extract the domain name from the log files I have.
I've added those in my Apache logs and see them, but I'm not sure how to extract them.
What I have so far is this:
input {
beats {
port =\> 5044
host =\> "5.61.254.238"
}
}
filter {
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }
add\_field =\> ["host" =\> "%{host}"]
}
date {
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
elasticsearch { hosts =\> ["localhost:9200"] }
stdout { codec =\> rubydebug }
}
I'm not sure if it's even correct.
I've restarted everything, but don't see it in Kibana.
An example of a line from the log file:
84.241.204.141 - - [07/Apr/2020:14:58:17 +0200] "GET /images/betaalmethodeimages/paynl/mastercard.png HTTP/1.1" 200 3436 "[https://www.celchi.com/geuren/bners-geuren/yes-r-unlimited-violet-damesparfum](https://www.celchi.com/geuren/bners-geuren/yes-r-unlimited-violet-damesparfum)" "Mozilla/5.0 (Linux; Android 10; ELE-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36" [www.celchi.com](http://www.celchi.com)
I hope you guys can help me out!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 7, 2020, 2:42pm UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/2 "2020-04-07T14:42:19Z")
> [@Jeffreyshoptrader](#):
>
> add\_field =\> ["host" =\> "%{host}"]
That would set the [host] field to the existing value of the [host] field, which doesn't make a lot of sense. What are you trying to do?
---
### Author:  [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)
#### Post date: [April 9, 2020, 7:22am UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/4 "2020-04-09T07:22:04Z")
Hi @Badger,
What I'm trying to do is filter out the domain name for later use.
Right now we have about 1000 different domain names which we want to use.
Unfortunately right now I can't get the information out of the log.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2020, 2:41pm UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/5 "2020-04-09T14:41:39Z")
Are you saying you want to parse the domain name from a fully qualified host name?
---
### Author:  [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)
#### Post date: [April 10, 2020, 5:43am UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/6 "2020-04-10T05:43:49Z")
@Badger I want to filter out the domain name from my log files.
Each line has the domain name written in it.
That way I can use those domain names in Kibana as a filter.
---
### Author:  [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)
#### Post date: [April 21, 2020, 6:01am UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/7 "2020-04-21T06:01:52Z")
Can anyone help me with this?
I'm still stuck.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 19, 2020, 6:01am UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902/8 "2020-05-19T06:01:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.