# How to add a new field mapping in my web access log

**URL:** <https://discuss.elastic.co/t/how-to-add-a-new-field-mapping-in-my-web-access-log/357198>\
**Category:** Kibana\
**Created:** [April 11, 2024, 10:23am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-mapping-in-my-web-access-log/357198 "2024-04-11T10:23:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hi\_hi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hi_hi/32/133439_2.png) [@hi\_hi](https://discuss.elastic.co/u/hi_hi)\
**Post date:** [April 11, 2024, 10:23am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-mapping-in-my-web-access-log/357198/1 "2024-04-11T10:23:26Z")

</div>

```auto
The first entry in the web access log file: 
112.181.246.27 12.12.181.2 - - [03/Apr/2024:16:46:22 +0800] "GET /icr/?mac_address=005044567570&network_type=4G&time=16:46:22.190 HTTP/1.1" 200 679 31248 "CX1UUCGAA01V.ixxx.pcsx.us:9765" -

After I import the log, there is a tag source_address with value "12.12.181.2"
But the source address should be in the first field , may i know to to change the field mapping or add a new field for the source ip 

```

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [April 11, 2024, 3:44pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-mapping-in-my-web-access-log/357198/2 "2024-04-11T15:44:42Z")

</div>

> [@hi\_hi](#):
>
> ```auto
> The first entry in the web access log file: 
> 112.181.246.27 12.12.181.2 - - [03/Apr/2024:16:46:22 +0800] "GET /icr/?mac_address=005044567570&network_type=4G&time=16:46:22.190 HTTP/1.1" 200 679 31248 "CX1UUCGAA01V.ixxx.pcsx.us:9765" -
> 
> After I import the log, there is a tag source_address with value "12.12.181.2"
> But the source address should be in the first field , may i know to to change the field mapping or add a new field for the source ip 
> 
> ```

Hi,  
you would need to modify the ingest pipeline that is processing your logs.

You can create a new ingest pipeline that includes a grok processor to parse the log line and extract the source IP into a new field. The grok pattern would look something like this: "%{IP:source\_ip} %{IP:source\_address} ...".

Regards

---

<div class="post-metadata">

**Author:** ![hi\_hi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hi_hi/32/133439_2.png) [@hi\_hi](https://discuss.elastic.co/u/hi_hi)\
**Post date:** [April 12, 2024, 10:11am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-mapping-in-my-web-access-log/357198/3 "2024-04-12T10:11:28Z")

</div>

Thanks. I have created the new ingest pipeline, can you tell me how to use it to import the file.