# How can i add a field to visualize a specific value and to calculate with it?

**URL:** <https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097>\
**Category:** Kibana\
**Created:** [March 8, 2018, 2:32pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097 "2018-03-08T14:32:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Murat89](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Murat89](https://discuss.elastic.co/u/Murat89)\
**Post date:** [March 8, 2018, 2:32pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/1 "2018-03-08T14:32:43Z")

</div>

Hi,

im new in elastic stack and want to try out Kibana. I have Pexip Logs below, my issue is that the duration is not recognized as a Field, I would like to have the duration value so i can calculate the average duration of video calls and visualize it. Please help me.

Thanks in advance.

Logsample:  
message:\<134\>Feb 27 21:58:03.439 newnode01 2018-02-27 21:58:03,439 Level="INFO" Name="administrator.conference" Message="Conference has been stopped." Conference="New VMR" Service-tag="" Service-type="conference" Duration="10.400" host:11.111.111.111 @timestamp:February 27th 2018, 22:58:03.440 @version:1 type:syslog \_id:X9BF2WEBxgyqZgr-xOFI \_type:mylogs \_index:myindex \_score: -

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 8, 2018, 8:33pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/2 "2018-03-08T20:33:50Z")

</div>

Hello, what are you using to ingest the log in ES? If you are using Logstash, take a look at the Grok input filter where you can set any part of the log line as a field in ES ( and in Kibana, of course).  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)

---

<div class="post-metadata">

**Author:** ![Murat89](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Murat89](https://discuss.elastic.co/u/Murat89)\
**Post date:** [March 8, 2018, 9:02pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/3 "2018-03-08T21:02:46Z")

</div>

Hi, im using Logstash, my grok filter doesn't seem to work, if you look at my sample log, how would you do the filter?

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 8, 2018, 9:14pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/4 "2018-03-08T21:14:14Z")

</div>

I'm really not good with Grok filters, sorry. The people in the Logstash forums will be more familiar with them. You can try posting the question about parsing your log line there.

---

<div class="post-metadata">

**Author:** ![Murat89](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Murat89](https://discuss.elastic.co/u/Murat89)\
**Post date:** [March 8, 2018, 10:10pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/5 "2018-03-08T22:10:55Z")

</div>

thank you, I will do that

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2018, 10:11pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-field-to-visualize-a-specific-value-and-to-calculate-with-it/123097/6 "2018-04-05T22:11:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
