I have to concatenate below two fields

%{URIPATH:url}%{DATA:[status]}
I am using this but not success add_field => ["%{DATA:actual-url}", "%{URIPATH:url} %{DATA:[status]}"]

If you have use a grok pattern to create two fields called url and status then you would combine them using

mutate { add_field => { "actual_url" => "%{url}%{status}" } }

Thanks @Badger now its working fine :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.