# How to index a custom field that has been added to logstash.conf **URL:** \ **Category:** Logstash\ **Created:** [January 2, 2019, 9:46am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625 "2019-01-02T09:46:37Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\ **Post date:** [January 2, 2019, 9:46am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/1 "2019-01-02T09:46:37Z")
I've added a custom field to the logstash.conf , it is shown in kibana UI Console but the field "actual\_host\_is" is not indexed. how to index a custom field added to logstash.conf mutate{ add\_field =\> { "actual\_host\_is" =\> "${HOSTNAME}" } } ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [January 2, 2019, 10:30am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/2 "2019-01-02T10:30:30Z")
Can you elaborate your config and sample data a bit more? Are you sure that the new field is not indexed or could it be a kibana index pattern issue? ---
**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\ **Post date:** [January 2, 2019, 10:47am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/3 "2019-01-02T10:47:45Z")
Thank you Admlko for your response. Ya certainly I will describe the details more. =================================================== I am running nginx server in docker container redirecting to logstash as below docker run --log-driver=syslog --log-opt syslog-address=tcp://localhost:5000 --log-opt syslog-facility=daemon --name MyNginx -d -p 80:80 nginx:latest =================================================== below is logstash.conf for capturing nginx access log input { tcp { type =\> syslog port =\> 5000 add\_field =\> { "[@metadata][input]" =\> "tcp"} } } filter { grok { match =\> { "message" =\> "%{IPORHOST:remote\_ip} - %{DATA:user\_name} [%{HTTPDATE:access\_time}] "%{WORD:http\_method} %{DATA:url} HTTP/%{NUMBER:http\_version}" %{NUMBER:response\_code} %{NUMBER:body\_sent\_bytes} "%{DATA:referrer}" "%{DATA:agent}"" } } mutate{ add\_field =\> { "actual\_host\_is" =\> "${ACTUAL\_HOST}" } } } output { elasticsearch{ hosts=\>["elasticsearch:9200"] index =\> "logstash-%{+YYYY.MM.dd}" } } =================================================== below is kibana console output at [http://localhost:5601/](http://localhost:5601/) | @timestamp | | January 2nd 2019, 11:41:55.674 | | --- | --- | --- | | t @version | | 1 | | t \_id | | Y3InDmgBfuiwMFhB3rcy | | t \_index | | logstash-2019.01.02 | | # \_score | | - | | t \_type | | doc | | t access\_time | | 02/Jan/2019:10:41:54 +0000 | | ? actual\_host\_is | | kmaster | please see the last line, actual\_host\_is kmaster, I have got the hostname but the problem I am getting in kibana console is "UNindexed fields cannot be searched", other fields of nginx access logs are searchable. I want "actual\_host\_is" field indexed for searching which is not happening =================================================== ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [January 2, 2019, 10:55am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/4 "2019-01-02T10:55:38Z")
Please format your post correctly, I will take a look at it after formatting 🙂 ---
**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\ **Post date:** [January 2, 2019, 11:00am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/5 "2019-01-02T11:00:46Z")
Yeah, correct, it was because of = signs I used as separator between different config files, it was taken as bold, I used new lines before and after = signs to avoid bold big words, apologies for the mishap. please have a look hope it's fine now. thanks, Baidurjya ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [January 2, 2019, 11:05am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/6 "2019-01-02T11:05:46Z")
Please use block quotes and preformatted text also for configs. Where does the actual\_host\_is come from? I don't see it in the grok config... What do you mean by Kibana console output? The Discover page in Kibana, or Console page? ---
**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\ **Post date:** [January 2, 2019, 11:15am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/7 "2019-01-02T11:15:29Z")
thanks for your reply. I am running logstash with env variable as ACTUAL\_HOST=$(hostname) as below. docker run -h logstash --name logstash --network incowia\_default --link elasticsearch:elasticsearch -it --rm -p 5000:5000 -e ACTUAL\_HOST=$(hostname) -v "$PWD":/config-dir logstash:6.5.1 -f /config-dir/logstash.conf then I am capturing this ACTUAL\_HOST field from the previously given grok file of logstash.conf file. this hostname (kmaster in this case) is flowing to KIBANA DISCOVER page successfully, but not searchable, with error message "UNindexed fields cannot be searched" now I must tell you motivation of doing this, there are few VMs and each VM has one nginx docker instance and a logstash docker instance and (ELASTIC+KIBANA) is running in a central server. Logstash from each VM is capturing nginx log of that VM and redirecting to central Kibana server, so to understand which particular VM NGINX access log is generated, I have added this custom hostname field so that I can understand source VM yielding nginx access log. ---
**Author:** ![admlko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/admlko/32/21787_2.png) [@admlko](https://discuss.elastic.co/u/admlko)\ **Post date:** [January 2, 2019, 11:26am UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/8 "2019-01-02T11:26:12Z")
Thanks for clarifying, makes sense. I didn't realize that the actual\_host\_is comes fron an environment variable, but was under the impression that it comes from the log. This sounds like an index pattern issue, please try to refresh your index pattern from Kibana's Management app: [https://www.elastic.co/guide/en/kibana/current/index-patterns.html#reload-fields](https://www.elastic.co/guide/en/kibana/current/index-patterns.html#reload-fields) ---
**Author:** ![baidurjya](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@baidurjya](https://discuss.elastic.co/u/baidurjya)\ **Post date:** [January 2, 2019, 12:10pm UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/9 "2019-01-02T12:10:59Z")
Thanks very much Admlko, refreshing the index pattern made the custom field "actual\_host\_is" searchable. You saved my life. 🙂 many many thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 30, 2019, 12:11pm UTC](https://discuss.elastic.co/t/how-to-index-a-custom-field-that-has-been-added-to-logstash-conf/162625/10 "2019-01-30T12:11:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.