I have to concatenate below two fields


#1

%{URIPATH:url}%{DATA:[status]}
I am using this but not success add_field => ["%{DATA:actual-url}", "%{URIPATH:url} %{DATA:[status]}"]


#2

If you have use a grok pattern to create two fields called url and status then you would combine them using

mutate { add_field => { "actual_url" => "%{url}%{status}" } }

#3

Thanks @Badger now its working fine :slight_smile: