# Insert to one field "One Of" two fields ot tokens **URL:** \ **Category:** Logstash\ **Created:** [July 13, 2016, 5:48am UTC](https://discuss.elastic.co/t/insert-to-one-field-one-of-two-fields-ot-tokens/55371 "2016-07-13T05:48:51Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![shaigb](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@shaigb](https://discuss.elastic.co/u/shaigb)\ **Post date:** [July 13, 2016, 5:48am UTC](https://discuss.elastic.co/t/insert-to-one-field-one-of-two-fields-ot-tokens/55371/1 "2016-07-13T05:48:51Z")
Hi I'm trying to populate a certain field (lets call it ioc) with one of 2 values: in 1 log it will be an IP Address and in another it will be a Domain. Is there a way to tell logstash to take the field that exists? when log1 will be processed there will be an IP Address in the ioc field, and when log2 will be processed a domain name will be in the ioc field? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 13, 2016, 6:03am UTC](https://discuss.elastic.co/t/insert-to-one-field-one-of-two-fields-ot-tokens/55371/2 "2016-07-13T06:03:07Z")
Sure, that's possible but we can't give specific advice without details on your setup and your events. It might however not be wise to do so since ES has a data type for IP addresses (supporting IP address range queries) that you might want to use for your IP addresses, but that data type can't store hostnames. That would be a reason for using multiple fields. ---
**Author:** ![shaigb](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@shaigb](https://discuss.elastic.co/u/shaigb)\ **Post date:** [July 13, 2016, 7:27am UTC](https://discuss.elastic.co/t/insert-to-one-field-one-of-two-fields-ot-tokens/55371/3 "2016-07-13T07:27:11Z")
Hi Magnus, i know that i'll need data type IP Address, and i want to add that data ALSO to another field - which is the one i'm talking about. For examle i have an IP Address OR a Domain, when there is an IP it will be inserted to IP Field and in the log there will be no domain so that's not a problem. when there is a domain it will be inserted into a domain field and in the log there will be no IP. I want to insert every time one of them into a 3rd field, so every time i'll have the one that was in the log. Shai ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/insert-to-one-field-one-of-two-fields-ot-tokens/55371/4 "2017-07-06T04:48:17Z")
Closed on July 6, 2017, 4:48am UTC