# How should I modify logstash.conf to get the field I want?

**URL:** <https://discuss.elastic.co/t/how-should-i-modify-logstash-conf-to-get-the-field-i-want/157328>\
**Category:** Logstash\
**Created:** [November 19, 2018, 10:14am UTC](https://discuss.elastic.co/t/how-should-i-modify-logstash-conf-to-get-the-field-i-want/157328 "2018-11-19T10:14:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wangyu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wangyu/32/132303_2.png) [@wangyu](https://discuss.elastic.co/u/wangyu)\
**Post date:** [November 19, 2018, 10:14am UTC](https://discuss.elastic.co/t/how-should-i-modify-logstash-conf-to-get-the-field-i-want/157328/1 "2018-11-19T10:14:48Z")

</div>

I use the ELK + Filebeat , all version is 6.4.3 , the OS is windows 10

I add custom field in filebeat.yml , the key name is log\_type , the value of log\_type is nginx-access

The picture show part of filebeat.yml.

 ![%E5%9B%BE%E5%83%8F%2032](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f1e3c7724a4b2ffbde001f79d32c8f8c77191f53.png)

The content of logstash.conf is :

```
input {
    beats { 
       host => "0.0.0.0"
       port => "5544"
  } 
} 

filter {

mutate { 
  rename => { "[host][name]" => "host" } 
}	

if [fields][log_type] == "nginx-access" {
           grok {
                  match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{HTTPDATE:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\" \"%{DATA:[nginx][access][x_forwarded_for]}\" %{NUMBER:[nginx][access][request_time]}"] }
           }
	
mutate {
     copy => { "[nginx][access][request_time]" => "[nginx][access][requesttime]" }
  }
			
mutate {
    convert => {
      "[nginx][access][requesttime]" => "float"
    }
  }
}
}

output {
      stdout { 
      codec => rubydebug { metadata => true }
      }
  
      elasticsearch { 
	    hosts => ["localhost:9200"] 
      } 
    }

```

When I use the command :

```
logstash.bat -f logstash.conf

```

The output is :

 ![request-time](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0ed2f22cb58ef677da8b13241b1f9792a8617b22.png)

Question 1：

The field in the red box above is "requesttime" and "request\_time" , what I want the field is nginx.access.requesttime and nginx.access.request\_time，not requesttime and request\_time 。 How should I modify logstash.conf to achieve my goal?

Question 2:

When I use the above logstash.conf , the field of the kibana management interface is only "request\_time" field .

The picture show this :

![%E5%9B%BE%E5%83%8F%2030](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a8973f04c55550bc2cdb818873851af5ec9ceead.png)

If I want the "requesttime" field to also appear in the fields of the Kibana management interface, how should I modify the logstash.conf ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2018, 10:17am UTC](https://discuss.elastic.co/t/how-should-i-modify-logstash-conf-to-get-the-field-i-want/157328/2 "2018-12-17T10:17:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.