# How to add a new field to all my log indices **URL:** \ **Category:** Kibana\ **Created:** [March 18, 2020, 4:13pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149 "2020-03-18T16:13:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Goishin](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Post date:** [March 18, 2020, 4:13pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/1 "2020-03-18T16:13:31Z")
I'm a new kibana user and you guys have been invaluable to me over the past two months while I get my feet under me. Now I've got a question about logging data. I upload my testpass logs to cloudwatch which then shuffles the logs over to my kibana cluster. Almost all of this was done using the AWS-provided tooling. I did not modify anything with regards to how the log stuff is setup. In the @message field that comes in, I have two fields that are prepended to each message. Now, I want to use those two fields to add those log messages to a dashboard. But Kibana doesn't know they're fields. They just show up in the @message field. How do I tell Kibana to use them as fields, and not just have them as part of the @message field? To make matters worse, I've ended up with a bunch of log streams, each log stream ended up as a separate index in kibana, and all the indexes are addressed as one, "cwl-\*". How do I add those two new fields to all the cloudwatch indices? ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [March 19, 2020, 10:46pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/2 "2020-03-19T22:46:36Z")
So you don't see the new fields in Kibana? Perhaps you need to refresh your index pattern. [https://www.elastic.co/guide/en/kibana/current/managing-fields.html#\_manage\_your\_index\_pattern](https://www.elastic.co/guide/en/kibana/current/managing-fields.html#_manage_your_index_pattern) ---
**Author:** ![Goishin](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Post date:** [March 20, 2020, 3:43pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/3 "2020-03-20T15:43:11Z")
Hey Nick! (that's my name too!) Thanks for the response. However, the index doesn't know that I've done anything yet. The way that I added the fields I'm interested in is I just modified the log event message string (the string you find in @message) to include my terms. Here's an example: Before: @message = "I'm a log statement!" After: @message = "[special.variable:13423-2342-23422-12132] [second special variable:123456] I'm a log statement!" How do I tell Kibana about my special variable and second special variable fields? Is this something I do in cloudwatch? Or in Kibana using a scripted field? ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [March 20, 2020, 4:40pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/4 "2020-03-20T16:40:02Z")
Hi Other Nick (🙂) It sounds like you will want to split the `@message` field into separate `special.variable` fields when ingesting them into Elasticsearch. I'm not familiar with your Cloudwatch setup, but maybe you can do this with an ingest processor like [grok](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html)? ---
**Author:** ![Goishin](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@Goishin](https://discuss.elastic.co/u/Goishin)\ **Post date:** [March 20, 2020, 4:42pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/5 "2020-03-20T16:42:47Z")
That's it! That's it!!!! Yes! That's how I do it. Ok, cool. Thanks a bunch, Nick 🙂 Let me run off and figure out how to get this doing what I want it to. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 30, 2020, 4:57pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-to-all-my-log-indices/224149/7 "2020-04-30T16:57:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.