# How to extract custom field value from first line and add it into later lines with Filebeat

**URL:** <https://discuss.elastic.co/t/how-to-extract-custom-field-value-from-first-line-and-add-it-into-later-lines-with-filebeat/333140>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 11, 2023, 1:21am UTC](https://discuss.elastic.co/t/how-to-extract-custom-field-value-from-first-line-and-add-it-into-later-lines-with-filebeat/333140 "2023-05-11T01:21:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lma\_yb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lma_yb/32/120898_2.png) [@lma\_yb](https://discuss.elastic.co/u/lma_yb)\
**Post date:** [May 11, 2023, 1:21am UTC](https://discuss.elastic.co/t/how-to-extract-custom-field-value-from-first-line-and-add-it-into-later-lines-with-filebeat/333140/1 "2023-05-11T01:21:27Z")

</div>

I am using filebeat to import log file which has some meta data in the first few lines into ELK.

The log file format looks like this:

```auto
Hostname: xxx
Created: <time>
Format: XXX
----Actual logs---

```

I want to extract the hostname information from the first line and add it as a custom field to all `actual log` lines.  
The reason is that I have many files from different hosts (but not from their original server, instead they are all placed in the same jumphost).  
Is this possible with filebeat/ELK? If so how can this be done?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2023, 3:22am UTC](https://discuss.elastic.co/t/how-to-extract-custom-field-value-from-first-line-and-add-it-into-later-lines-with-filebeat/333140/2 "2023-06-08T03:22:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.