# Logstash add\_field not working
**URL:** https://discuss.elastic.co/t/logstash-add-field-not-working/104510
**Category:** Logstash
**Created:** [October 19, 2017, 7:47am UTC](https://discuss.elastic.co/t/logstash-add-field-not-working/104510 "2017-10-19T07:47:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)
#### Post date: [October 19, 2017, 7:47am UTC](https://discuss.elastic.co/t/logstash-add-field-not-working/104510/1 "2017-10-19T07:47:41Z")
I add a field named `request` using following filter, however it doesn't use `url_path` and 'query\_string' values, I tried to change logstash config as
```auto
"request" => "%{[uri_path]}%{[query_string]}"
```
why the add\_field doesn't work as expected?
Logstash output
```auto
{
"request" => "%{uri_path}%{query_string}",
"auth" => "-",
"body_bytes" => 2955,
"upstream_addr" => "\"127.0.0.1:9002\"",
"source" => "/Data/logs/app.example.com.access.log",
"type" => "access_log",
"upstream_status" => 200,
"uri_path" => "/api/trades/gettradeslist",
"request_time" => 0.109,
"@version" => "1",
"beat" => {
"name" => "iZ94muvix60Z",
"hostname" => "iZ94muvix60Z",
"version" => "5.6.3"
},
"host" => "iZ94muvix60Z",
"timestamp" => "2017-10-19T14:41:28+08:00",
"offset" => 1250584231,
"tsyuuid" => "bbc15fdc-7a5f-44e7-b3e9-ef3cdde7bccb",
"input_type" => "log",
"verb" => "GET",
"gzip_ratio" => 4.43,
"message" => "- - - [2017-10-19T14:41:28+08:00] bbc15fdc-7a5f-44e7-b3e9-ef3cdde7bccb \"GET /api/trades/gettradeslist?AppToken=U2FsdGVkX1%2FolXAOBAtI6GD4XVlOGU%2FtCUWS%2Bg7QnMqFPj8jMPVqJYj%2Bd4gd1Z9eltC%2BOTkRGYFGMcO%2F%2FRGMBP9rsAdsrMRd8qmMGLtOqPI%3D&mk=866258034114402&versionCode=217&mt=Android&channel=Channel_Default&pageSize=10&system=&isbindemail=2&verifyCode=83f8bde61d613462b2f4204c8ef62ff6a52526ce&isbindmobile=2&is_video=&client=&gameid=5551&minPrice=&sort_type=1&pageNum=0&deal_type=1&is_pic=&s_area=&maxPrice=&isbindcertificate=2 HTTP/1.1\" 200 2955 \"-\" \"App/android_2.1.7\" \"4.43\" 0.109 3233 861 \"127.0.0.1:9002\" 200 0.109",
"bytes_sent" => 3233,
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_geoip_lookup_failure"
],
"referrer" => "\"-\"",
"@timestamp" => 2017-10-19T07:26:15.463Z,
"request_length" => 861,
"httpversion" => "1.1",
"upstream_response_time" => 0.109,
"fields" => {
"app_host" => "app.example.com"
},
"query_string" => "?AppToken=U2FsdGVkX1%2FolXAOBAtI6GD4XVlOGU%2FtCUWS%2Bg7QnMqFPj8jMPVqJYj%2Bd4gd1Z9eltC%2BOTkRGYFGMcO%2F%2FRGMBP9rsAdsrMRd8qmMGLtOqPI%3D&mk=866258034114402&versionCode=217&mt=Android&channel=Channel_Default&pageSize=10&system=&isbindemail=2&verifyCode=83f8bde61d613462b2f4204c8ef62ff6a52526ce&isbindmobile=2&is_video=&client=&gameid=5551&minPrice=&sort_type=1&pageNum=0&deal_type=1&is_pic=&s_area=&maxPrice=&isbindcertificate=2",
"status" => 200
}
```
Logstash config
```auto
if [source] =~ "access" {
mutate { replace => { "type" => "access_log" } }
mutate {
add_field => {
"request" => "%{uri_path}%{query_string}"
}
}
grok {
patterns_dir => ["../patterns"]
match => { "message" => "%{NGINXACCESS}"}
}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2017, 9:53am UTC](https://discuss.elastic.co/t/logstash-add-field-not-working/104510/2 "2017-10-19T09:53:41Z")
Filters are run in the order listed in the config file. At the time your mutate filters are run the grok filter hasn't run so the fields don't exist.
---
### Author:  [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)
#### Post date: [October 20, 2017, 3:23am UTC](https://discuss.elastic.co/t/logstash-add-field-not-working/104510/3 "2017-10-20T03:23:45Z")
@magnusbaeck, you are right , thanks a lot
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2017, 3:23am UTC](https://discuss.elastic.co/t/logstash-add-field-not-working/104510/4 "2017-11-17T03:23:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.