# How to get field value in logstash?
**URL:** https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757
**Category:** Logstash
**Created:** [April 29, 2016, 2:42am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757 "2016-04-29T02:42:30Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [April 29, 2016, 2:42am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/1 "2016-04-29T02:42:30Z")
from my output as below,
> "message" =\>"\<....... ",
> "@version" =\> "1",
> "@timestamp" =\> "2016-04-29T02:33:34.586Z",
> "timestamp" =\> "Apr 29 10:30:37",
> "syslog\_severity\_code" =\> 5,
> "syslog\_facility\_code" =\> 1,
> "syslog\_facility" =\> "user-level",
> "syslog\_severity" =\> "notice"
> i try to get the field value
```
filter
{
mutate {
add_field => {"newfield"=> "timestamp"}
}
```
but still cann't get the timestamp value to newfield it's will get
```
"newfield" => "newfield",
```
Is anyone is having the same problem or find a solution?
Any help is welcome to resolve this
---
### Author:  [@MrLee](https://discuss.elastic.co/u/MrLee)
#### Post date: [April 29, 2016, 3:52am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/2 "2016-04-29T03:52:33Z")
Maybe you should read the logstash reference first:
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 29, 2016, 5:31am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/3 "2016-04-29T05:31:17Z")
> ```
> add_field => {"newfield"=> "timestamp"}
>
> ```
To copy the _contents_ of the `timestamp` field to `newfield` you need this:
```
add_field => {"newfield"=> "%{timestamp}"}
```
---
### Author:  [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [April 29, 2016, 9:05am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/4 "2016-04-29T09:05:14Z")
i have tried the cmd
```
add_field => {"newfield"=> "%{timestamp}"}
```
but It's strange , it's still can't get the timestamp value.
get results as follow,
```
newfield => %{timestamp}
```
Is anyone is having the same problem or find a solution?
Any help is welcome to resolve this
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 30, 2016, 2:50pm UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/5 "2016-04-30T14:50:22Z")
If `newfield` ends up containing "%{timestamp}" then there was to `timestamp` field in the event. If you show us a complete example of your configuration, the input messages, what you actually get, and what you'd like to get it'll be easier to help out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/how-to-get-field-value-in-logstash/48757/6 "2017-07-06T04:59:55Z")