# How to create a new field combining values of other field values
**URL:** https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087
**Category:** Logstash
**Created:** [June 22, 2020, 12:46pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087 "2020-06-22T12:46:42Z")
**Posts on this page:** 18
**Page:** 2
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 30, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/21 "2020-06-30T21:30:19Z")
OK, so in elasticsearch you have three documents, which means in logstash you will have three separate events. What ties them together? Is it originLogId?
Do you want a fourth document that contains the three strings in a single field?
```
["Identity merged", "Identity Accepted", "Identity Rejected"]
```
This can be done using an aggregate filter.
If you want all three documents updated with that then I am unsure whether that can be done.
Also, "Identity merged" comes from the [service] field, not the [result] field. How should logstash know which field to look in? Should it just test both and use whichever one starts with Identity?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [June 30, 2020, 9:38pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/22 "2020-06-30T21:38:28Z")
well yes i want all those three strings in a single field.
that's why i want to use the add\_field of mutate after using this filter
`if [service] == "Identity merged" and [result] == "Identity Rejected" or [result] == "Identity Accepted"`
well will the above condition isn't enough for logstash to look into the `service` field and compare the complete string `"Identity merged"`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 30, 2020, 10:15pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/23 "2020-06-30T22:15:26Z")
You are not answering my questions. These are separate events. What fields should be tested to determine whether two different events should be combined?
Do you want a fourth document created?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 1, 2020, 4:01am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/24 "2020-07-01T04:01:24Z")
yes a fourth document needs to be created.
`result` and the `service` field would be tested to determine the combination of the events.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 1, 2020, 2:45pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/25 "2020-07-01T14:45:50Z")
How many documents exist in total? Are there only three? Or are there multiple sets of three?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 1, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/26 "2020-07-01T15:05:59Z")
there are multiple sets of these 3 documents
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 1, 2020, 3:09pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/27 "2020-07-01T15:09:05Z")
Which fields can be examined to determine that those three document are part of the same set?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 1, 2020, 3:18pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/28 "2020-07-01T15:18:05Z")
result and service field
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 1, 2020, 3:34pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/29 "2020-07-01T15:34:56Z")
Are you able to do a search in kibaba/elasticsearch that pulls out that particular set of three documents, as opposed to some other set of three? If so, what is the search?
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 1, 2020, 3:50pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/30 "2020-07-01T15:50:27Z")
yes i can able to search in Kibana/elasticsearch to pull out the particular set of documents
here is the search value and the results in kibana
---
### Author:  [@chitreshg](https://discuss.elastic.co/u/chitreshg)
#### Post date: [July 2, 2020, 4:57am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/31 "2020-07-02T04:57:10Z")
if you want all those three strings in a single field that in you have to put data statically
> if [result] == "Identity Accepted" or [result] == "Identity Rejected" and [service] == "Identity merged" {
> mutate {
> add\_field =\> {"result1" =\> "Identity Accepted, Identity Rejected, %{service}"}
> }
> }
after this you can split the data to form an array.
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 2, 2020, 7:23am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/32 "2020-07-02T07:23:39Z")
hi @chitreshg
after the add field why you used `%{service}`?
Instead of if we take` Identity merge` will it be wrong ?
Just Asking the reason ?
---
### Author:  [@chitreshg](https://discuss.elastic.co/u/chitreshg)
#### Post date: [July 2, 2020, 7:53am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/33 "2020-07-02T07:53:51Z")
you can use any of these, if service field contains the multiple values then then you can use %{service} otherwise for single value you can hard-code that value.
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 2, 2020, 8:09am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/34 "2020-07-02T08:09:55Z")
yes i want to use the service value as `Identity merge` only.
As when the` result` keyword is checked their respective `%service` value also comes in kibana visualization.
Let me implement these conditions and share you all the results
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 7, 2020, 9:31am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/35 "2020-07-07T09:31:47Z")
hi @chitreshg if i use %service then the respective services of `Identity accepted` and` Idenetity Rejected` also comes along in the result .
I achieved my result by doing this which works perfectly for me now
this is my query syntax
```
if [service] == "IDENTITY_MERGE"
{
mutate {
update => { "result" => "Identity Merged" }
}
}
```
so now the result is coming as expected
---
### Author:  [@chitreshg](https://discuss.elastic.co/u/chitreshg)
#### Post date: [July 10, 2020, 4:24am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/36 "2020-07-10T04:24:56Z")
@Matish_Bhuyan if you got your solution then mark that as answer, so the topic will close.
---
### Author:  [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)
#### Post date: [July 10, 2020, 5:32am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/37 "2020-07-10T05:32:08Z")
sorry forgot to add that.it's done now
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 7, 2020, 5:32am UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087/38 "2020-08-07T05:32:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
[Previous page](https://discuss.elastic.co/t/how-to-create-a-new-field-combining-values-of-other-field-values/238087.md?page=1)