# Logstash add subfield to elasticsearch index
**URL:** https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870
**Category:** Logstash
**Created:** [April 12, 2023, 8:28pm UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870 "2023-04-12T20:28:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Utibeabasi\_Umanah](https://discuss.elastic.co/u/Utibeabasi_Umanah)
#### Post date: [April 12, 2023, 8:28pm UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870/1 "2023-04-12T20:28:22Z")
Hi, i want to add a sub field called prefix to a text field called title using a logstash filter plugin. how do i go about this? i need this because the sub fields are required in app search. here is my logstash config so far
```auto
input {
jdbc {
jdbc_driver_library => "/usr/share/logstash/logstash-core/lib/jars/postgresql-jdbc.jar"
jdbc_driver_class => "org.postgresql.Driver"
jdbc_connection_string =>"jdbc:postgresql://${DB_HOST}:${DB_PORT}/${DB_NAME}"
jdbc_user => "${DB_USER}"
jdbc_password => "${DB_PASSWORD}"
schedule => "*/2 * * * *"
statement => "SELECT * from search"
}
}
filter {
mutate {
rename => {"title" => "[title]"}
add_field => {"[title][prefix]" => "${[title]}"}
}
}
output {
# used to output the values in the terminal (DEBUGGING)
# once everything is working, comment out this line
stdout { codec => "json" }
# used to output the values into elasticsearch
elasticsearch {
hosts => ["${ELASTICSEARCH_HOSTS}"]
index => "search"
document_id => "%{id}"
user => "${ELASTICSEARCH_USERNAME}"
password => "${ELASTICSEARCH_PASSWORD}"
ssl => true
cacert => "/usr/share/logstash/certs/ca.crt"
doc_as_upsert => true # upserts documents (e.g. if the document does not exist, creates a new record)
}
}
```
basically i want the title field to have a subfield called prefix (title.prefix)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 12, 2023, 10:36pm UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870/2 "2023-04-12T22:36:33Z")
> [@Utibeabasi\_Umanah](#):
>
> `rename => {"title" => "[title]"}`
That is a no-op. Can you show, using JSON, the before and after structures you want?
---
### Author:  [@Utibeabasi\_Umanah](https://discuss.elastic.co/u/Utibeabasi_Umanah)
#### Post date: [April 13, 2023, 6:44am UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870/3 "2023-04-13T06:44:40Z")
i want to add these subfields to my text field called `title`
> **[Elasticsearch engines precision tuning - text field conventions | App Search...](https://www.elastic.co/guide/en/app-search/current/elasticsearch-engines-text-subfields-support-conventions.html)**
specifically the `field.prefix` subfield
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 13, 2023, 5:59pm UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870/4 "2023-04-13T17:59:00Z")
> [@Utibeabasi\_Umanah](#):
>
> `add_field => {"[title][prefix]" => "%{[title]}"}`
You could try that. I would expect that to result in a mapping exception, but then I didn't know elasticsearch could support those subfields.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2023, 5:59pm UTC](https://discuss.elastic.co/t/logstash-add-subfield-to-elasticsearch-index/329870/5 "2023-05-11T17:59:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.