I have 2 fields with one field carrying date value and another field carrying time value. I would like to have a single field with both date and time values concatenated. Could you please suggest?

You need to add the pipeline to the Elasticsearch output section of filebeat.yml. this will execute the pipeline and create the new field at ingest time. This will add the field to the documents / index at ingest time, then the field will be available in kibana. You should also create a mapping fo…

Please provide samples so we can help. What does the date part look like? What does the time part look like? What Kind of fields are they in? What do you want as a result? Do you want a date field or just a string? If you want us to help, you need to provide a bit more information.

Okay sure @stephenb I have the below html code where I used dissect processor to decode the value <..!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" http:// xxx.dtd > <..html> <..head> <..title>Date<../title> <../head> <..body> Date: <..span id="date">05/06/2022<../span><..span…

Are you using filebeat processor or ingest pipeline / processor ?

I am using filebeat processor @stephenb

In that case I think you would use the script processor and hand code the appending, I am not an expert on that. Perhaps you should take a look at doing these types of parsing in the Ingest Pipeline. I think there are several advantages. With the ingest pipeline the Logic / parsing is in a cent…

Okay, got you @stephenb . If I would like to use append processor in the ingest pipeline, could you please suggest how that can append the values by providing me an example?

@Anagha_nambiar Ohh Darn!! You would not use the append processor that is for array apologies I did not read closely that is for arrays... let me recheck and get back. It is probably just a set processor let me look and provide and example! :slight_smile:

@Anagha_nambiar Here you go PUT _ingest/pipeline/discuss-append { "processors": [ { "set": { "field": "test.full_date", "value": "{{{test.date}}} {{{test.time}}}" } } ] } POST _ingest/pipeline/discuss-append/_simulate { "docs": [ { "_source": { …

Sure, thank you for this! I will check executing the same and get back to you.

Discuss the Elastic Stack

How to concatenate two fields using add fields processor in filebeat

Elastic Stack Beats

Topic		Replies	Views
Use filebeat processor to concatenate string Beats filebeat	2	53	January 26, 2026
How to make the changes in filebeat effective Beats filebeat	22	1262	February 2, 2021
Adding A New Field in Elasticsearch Ingest Pipeline Elasticsearch ingest-pipeline	1	639	March 1, 2021
Combine two fields into one via add_fields Beats filebeat	3	2092	March 6, 2021
Setting @timestamp in filebeat Beats filebeat	3	17080	July 18, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to concatenate two fields using add fields processor in filebeat

Related topics