# How to create a new field using value from another field?

**URL:** <https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885>\
**Category:** Logstash\
**Created:** [April 8, 2019, 4:26pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885 "2019-04-08T16:26:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kagerou](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kagerou](https://discuss.elastic.co/u/Kagerou)\
**Post date:** [April 8, 2019, 4:26pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/1 "2019-04-08T16:26:26Z")

</div>

I have json data that I'm using the Json filter on to turn into fields. I want to use the elapsed filter so I need the value of one of the fields to act as the start and end tag. Is there any filter that allows you to turn the value of a field into its own field so it can be used as a tag? ie.

> "field" : "value"  
> "field1" : "value1"  
> "status" : "started"

I would like to become

> "field" : "value"  
> "field1" : "value1"  
> "status" : "started"  
> started

If there is a way to use the elapsed filter without having to do this I'm all for it.

---

<div class="post-metadata">

**Author:** ![BKG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bkg/32/43591_2.png) [@BKG](https://discuss.elastic.co/u/BKG)\
**Post date:** [April 8, 2019, 4:45pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/2 "2019-04-08T16:45:09Z")

</div>

You can use [`add_field`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-add_field).

example:

```
mutate {
     add_field => { "my_new_field" => "%{my_field}" }
}

```

Edit: changed my example as I think you need add\_field, not add\_tag.

---

<div class="post-metadata">

**Author:** ![Kagerou](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kagerou](https://discuss.elastic.co/u/Kagerou)\
**Post date:** [April 8, 2019, 4:57pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/3 "2019-04-08T16:57:41Z")

</div>

Thank you for the response. I was looking for a way to name the new field after the value of another field so it can be used with the Elapsed filter. Do you know if this is possible? Or if it's possible to use the Elapsed filter and have the start and end tags be the values in certain fields?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 8, 2019, 6:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/4 "2019-04-08T18:30:53Z")

</div>

In an elapsed filter you need tags. If you want the start and end tags to depend on the value of the field status you can use

```
mutate { add_tag => ["%{status}"] }
```

---

<div class="post-metadata">

**Author:** ![Kagerou](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kagerou](https://discuss.elastic.co/u/Kagerou)\
**Post date:** [April 8, 2019, 8:10pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/5 "2019-04-08T20:10:08Z")

</div>

It works perfectly! Thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2019, 8:11pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-field-using-value-from-another-field/175885/6 "2019-05-06T20:11:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.