# How to do conditional indexing - extracting fields?

**URL:** <https://discuss.elastic.co/t/how-to-do-conditional-indexing-extracting-fields/89587>\
**Category:** Elasticsearch\
**Created:** [June 15, 2017, 3:56pm UTC](https://discuss.elastic.co/t/how-to-do-conditional-indexing-extracting-fields/89587 "2017-06-15T15:56:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TexasJJJJJ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/texasjjjjj/32/19172_2.png) [@TexasJJJJJ](https://discuss.elastic.co/u/TexasJJJJJ)\
**Post date:** [June 15, 2017, 3:56pm UTC](https://discuss.elastic.co/t/how-to-do-conditional-indexing-extracting-fields/89587/1 "2017-06-15T15:56:57Z")

</div>

Been reading lots of docs and looking at examples. I expect I just don't understand enough terminology yet. But, here's is what I want to do.

I am exporting a JBoss log through logstash.  
ES gets the body of the JBoss message in "message" field.  
I would like to break that message field down into smaller fields in different ways depending on the contents of the JBoss message.

If the JBoss log has the word "Fred" in it, the extract a, b, and c  
If the JBoss log has the word "Barney" in it, extract x, y, and z

What is the general approach for doing this sort of thing?  
What are the "magic" searchable words I should use to find info on this topic?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2017, 3:57pm UTC](https://discuss.elastic.co/t/how-to-do-conditional-indexing-extracting-fields/89587/2 "2017-07-13T15:57:03Z")

</div>

Closed on July 13, 2017, 3:57pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.