# How to use Logstash and ElasticSearch to Index 'transactionID' from 'message' while keeping original 'message' intact

**URL:** <https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503>\
**Category:** Logstash\
**Created:** [June 17, 2020, 4:04pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503 "2020-06-17T16:04:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jibitgeorge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jibitgeorge/32/45922_2.png) [@jibitgeorge](https://discuss.elastic.co/u/jibitgeorge)\
**Post date:** [June 17, 2020, 4:04pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503/1 "2020-06-17T16:04:29Z")

</div>

I already have ELK setup for my Java application and I'm able to see the logs in Kibana.

I have a field called 'message' in which I have a string called transactionID and a value assoicated with it (eg: transactionID:73782983848748937947). Now I would like to see transactionID as a seperate field in kibana. At the same time I want to see the original message also.

Please see below screenshot.

 ![ELK Snapshot](https://us1.discourse-cdn.com/elastic/original/3X/5/6/5623910b10f97801edd9eac646722390a2b117e3.png)

In this I want transactionID also to be listed just like 'fields.app','fields.container', 'fields.environment' etc. And I want the 'message' to be retained as it is.

Please provide your suggestions about the right approach to achieve this using logstash and ElasticSearch

All my ElasticStack components are 7.6.2 version

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 17, 2020, 4:43pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503/2 "2020-06-17T16:43:29Z")

</div>

A [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) with the pattern `\[transactionId=%{NUMBER:transactionId}\]` could create that field for you.

---

<div class="post-metadata">

**Author:** ![jibitgeorge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jibitgeorge/32/45922_2.png) [@jibitgeorge](https://discuss.elastic.co/u/jibitgeorge)\
**Post date:** [June 18, 2020, 5:03am UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503/3 "2020-06-18T05:03:25Z")

</div>

Thanks for the reply @Jenni. let me try that and get back to you.

---

<div class="post-metadata">

**Author:** ![jibitgeorge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jibitgeorge/32/45922_2.png) [@jibitgeorge](https://discuss.elastic.co/u/jibitgeorge)\
**Post date:** [June 24, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503/4 "2020-06-24T15:27:00Z")

</div>

@Jenni The suggestion worked for me. Thanks for your input

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2020, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-and-elasticsearch-to-index-transactionid-from-message-while-keeping-original-message-intact/237503/5 "2020-07-22T15:27:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.