# How do I add a field in my logs?

**URL:** <https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149>\
**Category:** Logstash\
**Created:** [March 8, 2018, 10:16pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149 "2018-03-08T22:16:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Murat89](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Murat89](https://discuss.elastic.co/u/Murat89)\
**Post date:** [March 8, 2018, 10:16pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149/1 "2018-03-08T22:16:03Z")

</div>

Hi,

im new in elastic stack and want to try out something. I have Pexip Logs below, my issue is that the duration is not recognized as a Field (in Kibana), I would like to have the duration value so i can calculate the average duration of the video calls and visualize it. Please help me. I got told that I need to ask here and that it has to do with the grok filter, what filter would I need for my logs?

Thanks in advance.

Logsample:  
message:\<134\>Feb 27 21:58:03.439 newnode01 2018-02-27 21:58:03,439 Level="INFO" Name="administrator.conference" Message="Conference has been stopped." Conference="New VMR" Service-tag="" Service-type="conference" Duration="10.400" host:11.111.111.111 @timestamp:February 27th 2018, 22:58:03.440 @version:1 type:syslog \_id:X9BF2WEBxgyqZgr-xOFI \_type:mylogs \_index:myindex \_score: -

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [March 8, 2018, 10:32pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149/2 "2018-03-08T22:32:33Z")

</div>

In order to use the Duration field as a number you need to create a mapping for your index which set the field to float. While you're at you can set the host field to type ip.

Not sure which version you are using but here is the [doc:](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html)

---

<div class="post-metadata">

**Author:** ![Murat89](https://avatars.discourse-cdn.com/v4/letter/m/ecb155/32.png) [@Murat89](https://discuss.elastic.co/u/Murat89)\
**Post date:** [March 9, 2018, 8:48pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149/3 "2018-03-09T20:48:28Z")

</div>

Can you give me a put command for mapping my logs above, where do I set the command, in Kibana, DevTools?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 11, 2018, 9:27pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149/4 "2018-03-11T21:27:55Z")

</div>

> Can you give me a put command for mapping my logs above, where do I set the command, in Kibana, DevTools?

Since you probably have daily or monthly indexes you'll want to set this via an index template.

As for how to parse the log in the first place, use a grok filter to extract timestamp, hostname etc, then use a kv filter to process the message part with the key="value" pairs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2018, 9:28pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-field-in-my-logs/123149/5 "2018-04-08T21:28:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.