# Logstash - adding new fields
**URL:** https://discuss.elastic.co/t/logstash-adding-new-fields/71276
**Category:** Logstash
**Created:** [January 11, 2017, 7:56pm UTC](https://discuss.elastic.co/t/logstash-adding-new-fields/71276 "2017-01-11T19:56:10Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@przecie](https://discuss.elastic.co/u/przecie)
#### Post date: [January 11, 2017, 7:56pm UTC](https://discuss.elastic.co/t/logstash-adding-new-fields/71276/1 "2017-01-11T19:56:10Z")
Hi,
I'm new in Elastic, so my question can be one of the 'stupid' one, but i hope it will help me to understand the connection between Logstash and Elastic search.
So... I followed the tutorial on this site: [https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)
at the end everything works fine, but ...I would like to add/change the fields matching
As I understand the part responsible for that is the filter part :
match =\> { "message" =\> "%{DATA:user} - %{UUID:uid} %{TIMESTAMP\_ISO8601:timestamp} [%{DATA:information}] %{LOGLEVEL:loglevel} (%{JAVACLASS:java}) %{GREEDYDATA:log\_message}" }
in my case is as above. My understanding of that is that the line "match =\> ..." will assingn all the grok templates (for example: UUID) to the values (uid). The whole decoded string is assigned to the value "message".
then I want to add another field using add\_field =\> ["test", "%{host}"] , but this field is not visible in the Kibana.
So my question is what do I miss? what should I look at ?
any hint and help will be appeciated
Thanks!
Przemek
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 12, 2017, 6:20pm UTC](https://discuss.elastic.co/t/logstash-adding-new-fields/71276/2 "2017-01-12T18:20:32Z")
> in my case is as above. My understanding of that is that the line "match =\> ..." will assingn all the grok templates (for example: UUID) to the values (uid).
Yes.
> The whole decoded string is assigned to the value "message".
The `message` field contains each line from the log file, yes.
> then I want to add another field using add\_field =\> ["test", "%{host}"] , but this field is not visible in the Kibana.
Are you sure the grok filter is successful? Your event doesn't have a `_grokparsefailure` tag?
I strongly suggest that you use a `stdout { codec => rubydebug }` output as a debugging aid instead of sending events to Elasticsearch and looking at the via Kibana. There are things that could go wrong along the way and as a beginner it'll be much harder to debug.
---
### Author:  [@przecie](https://discuss.elastic.co/u/przecie)
#### Post date: [January 14, 2017, 6:05pm UTC](https://discuss.elastic.co/t/logstash-adding-new-fields/71276/3 "2017-01-14T18:05:10Z")
Magnus, thank you very much for your hints.
Indeed I had a \_grokparsefailure tag. The stdout { codec =\> rubydebug } was very useful to unblock me.
Thanks a lot!
I hope my next problem will be much more sophisticated 🙂
Regards
Przemek
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 11, 2017, 6:05pm UTC](https://discuss.elastic.co/t/logstash-adding-new-fields/71276/4 "2017-02-11T18:05:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.