# How to create a new field combining values of other field values
**URL:** https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087
**Category:** Logstash
**Created:** [June 22, 2020, 12:46pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087 "2020-06-22T12:46:42Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 12:46pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/1 "2020-06-22T12:46:42Z")
Hi All,
I am using elk version 7.2
I have two keywords
1- result
2 - service
using the values of these keywords i want to create another field which will met the condition and keep the data according to the condition in the new field.
My logstash condition for this is
```
if [result] == "Accepted" and "Rejected" and [service] == "merged"
{
mutate {
add_field => ["result1"]
}
}
```
but i am getting this errors while starting the logstash after writing this condition.
```
[2020-06-22T14:27:19,361][ERROR][logstash.filters.mutate] Invalid setting for mutate filter plugin:
filter {
mutate {
# This setting must be a hash
# This field must contain an even number of items, got 1
add_field => ["result1"]
...
}
}
```
Can anyone please help me out to resolve these issues
Thanks in advance
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 22, 2020, 1:04pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/2 "2020-06-22T13:04:49Z")
To add a field you have to configure the key and the value. Therefore it has to be a hash. An array with one value is not enough.
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-add\_field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-add_field)
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/3 "2020-06-22T13:29:32Z")
Hi Jenni,
Thanks for the response , I have read this link when googled the error but not able to understand correctly.
Can you do the changes in my code to give me the example
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 22, 2020, 1:33pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/4 "2020-06-22T13:33:16Z")
The link shows you the exact structure of that setting. But to say it even more clearly:
```
mutate {
add_field => { "This is your key/field name" => "This is your value/data/content of the field" }
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2020, 1:37pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/5 "2020-06-22T13:37:31Z")
> [@Matish\_Bhuyan](#):
>
> `if [result] == "Accepted" and "Rejected" and [service] == "merged"`
It is unclear what you want to test here, but I very much doubt that is testing what you want.
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 2:18pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/6 "2020-06-22T14:18:15Z")
I have two values "Accepted" and "Rejected" in the [result] keyword.
And one value "merged" in the [service] keyword.
Adding these 3 values from these 2 keywords , I want to create a new field along with the data those values hold
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 2:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/7 "2020-06-22T14:34:44Z")
Hi,
I understood the field name part,now my doubt is in content of the field
after assigning the field name i thought the values from the keywords will also get copied to the newly created field
which isn't happening here
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 22, 2020, 2:48pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/8 "2020-06-22T14:48:02Z")
Logstash can't read your mind and you never told it to copy any values from one field to another. Do you want to build an array with the content `["Accepted", "Rejected", "merged"]` ? I still don't understand what your goal is. Maybe you could post the original event data and what you expect the output to look like.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/9 "2020-06-22T15:04:22Z")
if [result] == "Accepted" and "Rejected" and [service] == "merged"
This tests whether three things are true
1. [result] == "Accepted" -- This is a string equality test of the value of the result field
2. "Rejected" -- I believe this will always be true
3. [service] == "merged" -- This is a string equality test of the value of the service field
If you want to test whether [result] is either "Accepted" or "Rejected" then you can use an array membership test
```
if [result] in ["Accepted", "Rejected"] and [service] == "merged"
```
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 3:15pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/10 "2020-06-22T15:15:37Z")
Here as you can see under the **result.keyword** ,I have
**identity accepted and identity rejected**
whether in **service.keyword** i have **identity merged**
But as per my requirement i need all 3 values within a single keyword
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 22, 2020, 5:12pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/11 "2020-06-22T17:12:50Z")
@Jenni are you able to figure out my requirement from the last post?
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [June 23, 2020, 7:35am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/12 "2020-06-23T07:35:48Z")
If the value is actually "Identity Accepted" your conditions wouldn't work anyway because you are querying an exact match with the string "Accepted". You'd need a regex like `/Accepted$/` (and are there even any other values than these two for the result?)
You could just post the original event and the result you'd wish to achieve in json format. Then everything would be clear. Will that new field have the values `["Identity Accepted", "Identity merged"]` or `["Identity Rejected", "Identity merged"]` or did you want to concenate the strings? Either way the "3 values" will always only be two of them (the two combinations I mentioned earlier), right?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 23, 2020, 12:20pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/13 "2020-06-23T12:20:26Z")
well the new field should contain all the 3 strings
"Identity Accepted " , "Identity merged" and "Identity Rejected".
apologies for my previous query where i mentioned the query with "OR" operation which is actually "AND" operator
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 23, 2020, 6:07pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/14 "2020-06-23T18:07:53Z")
Any help for the above issue?
---
### Author:  [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [June 27, 2020, 12:01am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/15 "2020-06-27T00:01:07Z")
You should follow advice from the last response fron Jenni and post the exact input event(s) and the output you expect. Redact whatever you must to, but keep the original structure for `result` and `service` and your expected output field.
I presume it will be the only unambiguous way to know, both for the input and output, whether you work with concatenated strings, objects, arrays, etc.
---
### Author:  [@chitreshg](https://discuss.elastic.co/u/chitreshg)
#### Post date: [June 29, 2020, 12:21pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/16 "2020-06-29T12:21:07Z")
if I'm not wrong your result field contains one of "Accepted" or "Rejected"
if it is the case then your condition should be like this
> ```
> if [result] == "Identity Accepted" or [result] == "Identity Rejected" and [service] == "Identity merged" {
> mutate {
> add_field => {"result1" => "%{result}, %{service}"}
> }
> }
>
> ```
and if you want the values in array format then you can use mutate-split filter
> mutate {
> split =\> {"result1" =\> ", "}
> }
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 30, 2020, 11:26am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/17 "2020-06-30T11:26:20Z")
Hi @chitreshg thanks a lot for the reply but the filter wasn't working as expected
It only picks the "if [result] == "Identity Accepted" and the correspondent value's service keyword in the newly created field "result1".
this is how the result1 field looks in kibana visulization
| result1.keyword: Descending | Count |
| --- | --- |
| Identity Accepted, FIRST\_REQUEST | |
where first request is the service keyword value for the identity accepted value
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 30, 2020, 8:17pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/18 "2020-06-30T20:17:46Z")
@chitreshg if you found any solution to this issue please update
thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 30, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/19 "2020-06-30T20:44:22Z")
You would be much more likely to get a solution if you would show us what your data looks like (either JSON or rubydebug), and what you want the result to look like.
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 30, 2020, 9:14pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/20 "2020-06-30T21:14:43Z")
Hi @Badger here is the json data of each value --- Identity Accepted , Identity merged and Identity Rejected
> ```
> {
>
> ```
>
> "\_index": "icp2-2020.06.03",
> "\_type": "\_doc",
> "\_id": "acbb85b3b45400961be54c2b6362b59844351f3b4dcfed95a038cb2d5979a176",
> "\_version": 1,
> "\_score": 4.018989,
> "\_source": {
> "ENTITLEMENT\_TYPE": "value\_100",
> "AT\_VAL6": "",
> "AT\_VAL4": "",
> "internalId": "1806",
> "AT\_CUSTO\_S5": "",
> "result": "Identity Accepted",
> "AT\_VAL2": "",
> "service": "FIRST\_REQUEST",
> "host": "",
> "AT\_CUSTO\_S1": "",
> "USER\_TYPE": "value\_90",
> "LOG\_QUALIFIER": "USER\_TASK\_RESULT",
> "@timestamp": "2020-06-03T11:45:01.893Z",
> "AT\_EXTENDEDINFO": "",
> "logCategory": "BUSINESS",
> "owner": "anonymous",
> "REQUEST\_TYPE": "value\_60",
> "@version": "1",
> "headers": {
> "accept\_encoding": "gzip,deflate",
> "request\_method": "PUT",
> "http\_accept": null,
> "connection": "Keep-Alive",
> "http\_host": ":9090",
> "request\_path": "/",
> "content\_length": "1041",
> "http\_user\_agent": "Apache-HttpClient/4.5.7 (Java/1.8.0\_102)",
> "content\_type": "application/json;charset=UTF-8",
> "http\_version": "HTTP/1.1"
> },
> "AT\_CUSTO\_S3": "309",
> "AT\_VAL3": "37",
> "originLogId": "afad5535-a58f-11ea-b158-d94038694644",
> "AT\_CUSTO\_S6": "",
> "duration": 150,
> "timeStamp": "2015-01-01T01:02:03.904Z",
> "origin": "MorphoIA",
> "AT\_OUTSTANDINGVAL": "",
> "businessId": "",
> "ER\_STATE": "value\_40",
> "ER\_ID": "value\_70",
> "AT\_CUSTO\_S9": "",
> "AT\_CUSTO\_S10": "",
> "ER\_STATUS": "value\_50",
> "AT\_VAL1": "SERVICE\_TASK\_RESULT",
> "AT\_CUSTO\_S7": "",
> "AT\_VAL5": "TECHNICAL",
> "station": "origin",
> "AT\_VAL10": "",
> "AR\_STATUS": "value\_30",
> "AT\_CUSTO\_S2": ""
> },
> "fields": {
> "timeStamp": [
> "2015-01-01T01:02:03.904Z"
> ],
> "@timestamp": [
> "2020-06-03T11:45:01.893Z"
> ]
> },
> "highlight": {
> "result": [
> "@kibana-highlighted-field@Identity@/kibana-highlighted-field@ @kibana-highlighted-field@Accepted@/kibana-highlighted-field@"
> ],
> "result.keyword": [
> "@kibana-highlighted-field@Identity Accepted@/kibana-highlighted-field@"
> ]
> }
> }
>
> {
> "\_index": "icp2-2020.06.03",
> "\_type": "\_doc",
> "\_id": "10f76a8d5b991f7523c55c43bb8e330116b07ad99716610aa70cb427a008761d",
> "\_version": 1,
> "\_score": 3.9113598,
> "\_source": {
> "ENTITLEMENT\_TYPE": "value\_100",
> "AT\_VAL6": "",
> "AT\_VAL4": "",
> "internalId": "1810",
> "AT\_CUSTO\_S5": "",
> "result": "QUEUED",
> "AT\_VAL2": "",
> "service": "Identity merged",
> "host": "",
> "AT\_CUSTO\_S1": "",
> "USER\_TYPE": "value\_90",
> "LOG\_QUALIFIER": "USER\_TASK\_RESULT",
> "@timestamp": "2020-06-03T11:45:03.588Z",
> "AT\_EXTENDEDINFO": "",
> "AT\_VAL7": "STARTED",
> "activity": "CreateApplicantRequest",
> "REQUEST\_TYPE": "value\_60",
> "@version": "1",
> "headers": {
> "accept\_encoding": "gzip,deflate",
> "request\_method": "PUT",
> "http\_accept": null,
> "connection": "Keep-Alive",
> "http\_host": "",
> "request\_path": "/",
> "content\_length": "1012",
> "http\_user\_agent": "Apache-HttpClient/4.5.7 (Java/1.8.0\_102)",
> "content\_type": "application/json;charset=UTF-8",
> "http\_version": "HTTP/1.1"
> },
> "AT\_CUSTO\_S3": "309",
> "AT\_VAL3": "37",
> "originLogId": "b0af0dc9-a58f-11ea-b158-d94038694644",
> "AT\_CUSTO\_S6": "",
> "duration": 150,
> "timeStamp": "2015-01-01T01:02:03.904Z",
> "origin": "MorphoIA",
> "AT\_OUTSTANDINGVAL": "",
> "businessId": "",
> "ER\_STATE": "value\_40",
> "ER\_ID": "value\_70",
> "AT\_CUSTO\_S9": "",
> "AT\_CUSTO\_S7": "",
>
> },
> "fields": {
> "timeStamp": [
> "2015-01-01T01:02:03.904Z"
> ],
> "@timestamp": [
> "2020-06-03T11:45:03.588Z"
> ]
> },
> "highlight": {
> "service": [
> "@kibana-highlighted-field@Identity@/kibana-highlighted-field@ @kibana-highlighted-field@merged@/kibana-highlighted-field@"
> ],
> "service.keyword": [
> "@kibana-highlighted-field@Identity merged@/kibana-highlighted-field@"
> ]
> }
> }
>
> {
> "\_index": "icp2-2020.06.01",
> "\_type": "\_doc",
> "\_id": "a87b87052896c5c6a123186d6da9575f97391a7d3fa9b767eec2c251f6f80d60",
> "\_version": 1,
> "\_score": 3.585218,
> "\_source": {
> "ENTITLEMENT\_TYPE": "value\_100",
> "AT\_VAL6": "",
> "AT\_VAL4": "",
> "internalId": "1801",
> "AT\_CUSTO\_S5": "",
> "result": "Identity Rejected",
> "AT\_VAL2": "Male",
> "service": "FIRST\_REQUEST",
> "host": "50.50.1.13",
> "AT\_CUSTO\_S1": "",
> "USER\_TYPE": "value\_90",
> "LOG\_QUALIFIER": "USER\_TASK\_RESULT",
> "@timestamp": "2020-06-01T11:23:43.735Z",
> "AT\_EXTENDEDINFO": "",
> "logCategory": "BUSINESS",
> "@version": "1",
> "headers": {
> "accept\_encoding": "gzip,deflate",
> "request\_method": "PUT",
> "http\_accept": null,
> "connection": "Keep-Alive",
> "http\_host": "",
> "request\_path": "/",
> "content\_length": "1038",
> "http\_user\_agent": "Apache-HttpClient/4.5.7 (Java/1.8.0\_102)",
> "content\_type": "application/json;charset=UTF-8",
> "http\_version": "HTTP/1.1"
> },
> "originLogId": "60505416-a3fa-11ea-b158-d94038694644",
> "AT\_CUSTO\_S6": "",
> "duration": 150,
> "timeStamp": "2015-01-01T01:02:03.904Z",
> "origin": "MorphoIA",
> "AT\_OUTSTANDINGVAL": "",
> "businessId": "",
> "ER\_STATE": "value\_40",
> "ER\_ID": "value\_70",
> "AT\_CUSTO\_S9": "",
> "AT\_CUSTO\_S10": "",
>
> },
> "fields": {
> "timeStamp": [
> "2015-01-01T01:02:03.904Z"
> ],
> "@timestamp": [
> "2020-06-01T11:23:43.735Z"
> ]
> },
> "highlight": {
> "result": [
> "@kibana-highlighted-field@Identity@/kibana-highlighted-field@ @kibana-highlighted-field@Rejected@/kibana-highlighted-field@"
> ],
> "result.keyword": [
> "@kibana-highlighted-field@Identity Rejected@/kibana-highlighted-field@"
> ]
> }
> }
[Next page](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087.md?page=2)