# How to concatenate two fields using add fields processor in filebeat
**URL:** https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488
**Category:** Beats
**Tags:** filebeat, heartbeat
**Created:** [June 6, 2022, 6:33pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488 "2022-06-06T18:33:01Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 6, 2022, 6:33pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/1 "2022-06-06T18:33:01Z")
I have 2 fields with one field carrying date value and another field carrying time value.
I would like to have a single field with both date and time values concatenated.
Could you please suggest?
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 6, 2022, 6:54pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/2 "2022-06-06T18:54:51Z")
Any help on this please?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 7, 2022, 1:48am UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/3 "2022-06-07T01:48:27Z")
Please provide samples so we can help.
What does the date part look like? What does the time part look like?
What Kind of fields are they in?
What do you want as a result?
Do you want a date field or just a string?
If you want us to help, you need to provide a bit more information.
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 7, 2022, 4:40am UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/4 "2022-06-07T04:40:14Z")
Okay sure @stephenb
I have the below html code where I used dissect processor to decode the value
\<..!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" http:// xxx.dtd\>
\<..html\>
\<..head\>
\<..title\>Date\<../title\>
\<../head\>
\<..body\>
Date:
\<..span id="date"\>05/06/2022\<../span\>\<..span id="time"\> 12:03:43\<../span\>
\<../body\>
\<../html\>
After using the dissect processor , I have the target field value as "test" where dissected '05/06/2022" to date and "12:03:43" to time field. So now I have the fields like below:
test.date= "05/06/2022"
test.time="12:03:43"
Now my concern is I would like to have a single field like below:
test.timestamp= "05/06/2022 12:03:43"
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 7, 2022, 6:03am UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/5 "2022-06-07T06:03:48Z")
Are you using [filebeat processor](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) or [ingest pipeline / processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)?
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 7, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/6 "2022-06-07T12:31:42Z")
I am using filebeat processor @stephenb
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 7, 2022, 2:35pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/7 "2022-06-07T14:35:04Z")
In that case I think you would use the [script processor](https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html) and hand code the appending, I am not an expert on that.
Perhaps you should take a look at doing these types of parsing in the Ingest Pipeline. I think there are several advantages.
1. With the ingest pipeline the Logic / parsing is in a central place in Elasticsearch and can be changed as needed without redploying changes to the filebeat.ymls, and changes take effect immediately whether you have 1 filebeat or 1000
2. There are a richer set of processors available for example there is an [append processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/append-processor.html) that would make this easy.
3. I also think the ingest pipelines are a bit easier to "code" in once you get used to it... just a thought.
You could also just leave the dissect in filebeat and do the appending in an ingest pipeline if you wanted.
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 7, 2022, 3:47pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/8 "2022-06-07T15:47:22Z")
Okay, got you @stephenb .
If I would like to use append processor in the ingest pipeline, could you please suggest how that can append the values by providing me an example?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 7, 2022, 3:53pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/9 "2022-06-07T15:53:07Z")
@Anagha_nambiar
**Ohh Darn!! Y** ou would not use the append processor that is for array apologies I did not read closely that is for arrays... let me recheck and get back.
It is probably just a set processor let me look and provide and example! 🙂
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 7, 2022, 4:04pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/10 "2022-06-07T16:04:00Z")
@Anagha_nambiar
Here you go
```auto
PUT _ingest/pipeline/discuss-append
{
"processors": [
{
"set": {
"field": "test.full_date",
"value": "{{{test.date}}} {{{test.time}}}"
}
}
]
}
POST _ingest/pipeline/discuss-append/_simulate
{
"docs": [
{
"_source": {
"test": {
"date": "05/06/2022",
"time": "12:03:43"
}
}
}
]
}
#result
{
"docs" : [
{
"doc" : {
"_index" : "_index",
"_id" : "_id",
"_source" : {
"test" : {
"date" : "05/06/2022",
"time" : "12:03:43",
"full_date" : "05/06/2022 12:03:43"
}
},
"_ingest" : {
"timestamp" : "2022-06-07T16:03:09.612510643Z"
}
}
}
]
}
```
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 8, 2022, 5:46am UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/11 "2022-06-08T05:46:48Z")
Sure, thank you for this! I will check executing the same and get back to you.
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 9, 2022, 8:19am UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/12 "2022-06-09T08:19:32Z")
I got the response @stephenb .
But how to search this newly created field "test.full\_date" for any index like filebeat, if I have to utilize this field in Kibana?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 9, 2022, 1:45pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/13 "2022-06-09T13:45:09Z")
You need to add the pipeline to the Elasticsearch output section of filebeat.yml. this will execute the pipeline and create the new field at ingest time.
This will add the field to the documents / index at ingest time, then the field will be available in kibana.
You should also create a mapping for this field if you want it to be of type `date`
> **[Configure the Elasticsearch output | Filebeat Reference \[8.2\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#pipeline-option-es)**
---
### Author:  [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)
#### Post date: [June 9, 2022, 4:16pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/14 "2022-06-09T16:16:45Z")
Thank you @stephenb
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2022, 6:16pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/15 "2022-07-07T18:16:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.