# How to refer to subfield in logstash
**URL:** https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474
**Category:** Logstash
**Created:** [March 21, 2017, 5:05pm UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474 "2017-03-21T17:05:40Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@scutdk](https://discuss.elastic.co/u/scutdk)
#### Post date: [March 21, 2017, 5:05pm UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474/1 "2017-03-21T17:05:40Z")
I have following logstash conf snippet, but it doesn't work. I got the idea of subfield from this [stackoverflow thread](http://stackoverflow.com/questions/32345874/logstash-checking-existence-of-parsing-sub-field). How can I make it to work? I am trying to split the http\_refer field in my access log. Thanks.
```
filter {
kv {
source => "@message[http_referer]"
field_split => "&?"
value_split => "="
add_tag => "splited"
}
```
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 21, 2017, 8:32pm UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474/2 "2017-03-21T20:32:52Z")
Does [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references) help?
---
### Author:  [@scutdk](https://discuss.elastic.co/u/scutdk)
#### Post date: [March 22, 2017, 6:07am UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474/3 "2017-03-22T06:07:27Z")
Yeah, great resource. I should have finished all the docs first just no so enough time...
A short answer for someone who didn't find on stackoverflow or come from Google, you can reference to a field name by [field\_name].
You can omit the [] if it's top level field.
In nested situation/ sub field, use [level1][level2] syntax to reference.
If you want to refer to the value inside a string, use the "%{[level1][level2]}" syntax.
Can be a little confused it you are not used to the syntax.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2017, 6:08am UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474/4 "2017-04-19T06:08:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.