# How to create a custom document

**URL:** <https://discuss.elastic.co/t/how-to-create-a-custom-document/206820>\
**Category:** Logstash\
**Created:** [November 6, 2019, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820 "2019-11-06T15:30:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 6, 2019, 3:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/1 "2019-11-06T15:30:11Z")

</div>

Hello  
I was able to configure the following:  
From the json document I have this:

"MyValue": "Key value based on a specific field",

"host": {  
"name": "hostname"  
},

"tags": [  
"beats\_input\_codec\_plain\_applied",  
],

... SNIP ...

I would like to create some similar instead of having key:value like this

"MyValue" : {  
"name": "content from the specific field"  
}

Or something like this:

"MyTags": [  
"product\_tag",  
"another\_custom\_tag",,  
],

Did I myself clear? is that possible to do with logstash?  
Thanks  
Regards

---

<div class="post-metadata">

**Author:** ![ben.west](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben.west/32/55244_2.png) [@ben.west](https://discuss.elastic.co/u/ben.west)\
**Post date:** [November 7, 2019, 2:05pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/2 "2019-11-07T14:05:18Z")

</div>

You can use the `add_field` and `add_tag` common options inside any filters (and most if not all of the input and output plugins if I recall correctly). With these you can construct any shape of hash you wish at the "output" side of logstash.

If you want a little more detail, it would be helpful if you share some of your input data and your logstash configuration. We could then possibly offer other ways to achieve your end goal.

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 7, 2019, 6:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/3 "2019-11-07T18:06:04Z")

</div>

@ben.west Hello, thanks for your help  
I have a log which contains something like this:

20191030102428 ,XX,CONDITION\_COLOR,SYSTEM~JAVA~hostname\_SYSTEMID\_00,Errors message

First column is a time stamp, XX can be an alert condition , condition\_color can be RED, GREEN or something, the rest of the columns are descriptions about the system triggering the alert, so far  
so good with that.

Then I have this filter to rename default name column names.

```
filter {
	csv { autodetect_column_names => false }
		mutate {
		 rename => { "column4" => "Description" }
		 rename => { "column2" => "Severity" }
		 rename => { "column3" => "Status" }
		 rename => { "column5" => "Alert_Description" }
		 rename => { "column1" => "Alert_TimeStamp" }
		 
	  }
}

```

With that configuration I get for example, on the document root:  
Status: GREEN

But I would like to have something like this:

Status": [  
"GREEN"  
],  
Or

"Status\_Tag": {  
"name": "GREEN""  
},

Thanks  
Regards

---

<div class="post-metadata">

**Author:** ![ben.west](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben.west/32/55244_2.png) [@ben.west](https://discuss.elastic.co/u/ben.west)\
**Post date:** [November 11, 2019, 11:08am UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/4 "2019-11-11T11:08:03Z")

</div>

Hi @Kernel_Panic,

You can use the nested notation to create/rename columns as you wish like this:  
`rename => { "column3" => "[status_tag][name]" }`

Which will create a hash in the output object:

```auto
{
             "@version" => "1",
                 "path" => "/tmp/test.csv",
              "message" => "20191030102428 ,XX,CONDITION_COLOR,SYSTEM~JAVA~hostname_SYSTEMID_00,Errors message",
             "Severity" => "XX",
          "Description" => "SYSTEM~JAVA~hostname_SYSTEMID_00",
    "Alert_Description" => "Errors message",
      "Alert_TimeStamp" => "20191030102428 ",
                 "host" => "d506bfbd5ab6",
           "@timestamp" => 2019-11-11T11:01:02.357Z,
           "status_tag" => {
        "name" => "CONDITION_COLOR"
    }
}

```

[The config reference for events](https://www.elastic.co/guide/en/logstash/7.3/event-dependent-configuration.html) is a great place to get started using and understanding nested fields.

Thanks,  
Ben

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [November 11, 2019, 12:26pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/5 "2019-11-11T12:26:09Z")

</div>

@ben.west thank you very much.!!  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2019, 12:26pm UTC](https://discuss.elastic.co/t/how-to-create-a-custom-document/206820/6 "2019-12-09T12:26:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.