# How to extract fields from the hadoop logs using logstash

**URL:** <https://discuss.elastic.co/t/how-to-extract-fields-from-the-hadoop-logs-using-logstash/51649>\
**Category:** Logstash\
**Created:** [June 2, 2016, 6:59am UTC](https://discuss.elastic.co/t/how-to-extract-fields-from-the-hadoop-logs-using-logstash/51649 "2016-06-02T06:59:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohit\_prusty](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@rohit\_prusty](https://discuss.elastic.co/u/rohit_prusty)\
**Post date:** [June 2, 2016, 6:59am UTC](https://discuss.elastic.co/t/how-to-extract-fields-from-the-hadoop-logs-using-logstash/51649/1 "2016-06-02T06:59:12Z")

</div>

My requirement it to parse the hadoop hdfs-audit log file using logstash and extract the operation type and add this as an additional field along with the complete message before storing the event to the elasticsearch.

Please provide any working code snippet.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 3, 2016, 1:13am UTC](https://discuss.elastic.co/t/how-to-extract-fields-from-the-hadoop-logs-using-logstash/51649/2 "2016-06-03T01:13:33Z")

</div>

What have you tried?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/how-to-extract-fields-from-the-hadoop-logs-using-logstash/51649/3 "2017-07-06T04:54:40Z")

</div>

Closed on July 6, 2017, 4:54am UTC