# Logstash -Connect strings after filter
**URL:** https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859
**Category:** Logstash
**Created:** [April 20, 2016, 5:40am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859 "2016-04-20T05:40:54Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)
#### Post date: [April 20, 2016, 5:40am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/1 "2016-04-20T05:40:54Z")
I am trying to add a new field to concatenate strings from my log as follow,
`"message" => "#@enterprise=[1.3.6.1.4.1.9.9.187], @timestamp=#@value=2612151602>, @varbind_list=..., @specific_trap=7, @source_ip=\"1.2.3.4\", @agent_addr=#@value=\"\xC0\xA8\v\e\">, @generic_trap=6>"`
i want to retrive @enterprise value and @specific\_trap value , and add a new field for the value
for the log event , after filter it's will be looks like
result =\> 1.3.6.1.4.1.9.9.187.0.7
If anyone knows how to do with it , please help. Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 5:52am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/2 "2016-04-20T05:52:40Z")
```auto
filter {
mutate {
add_field => {
"result" => "%{[@enterprise_value}][0]}.0%{@specific_trap}"
}
}
}
```
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 6:03am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/4 "2016-04-20T06:03:32Z")
Oh, right. Forgot about that part. You should be able to use the kv filter but grok also works. Remember that square brackets need to be escaped in regular expressions.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 9:27am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/6 "2016-04-20T09:27:01Z")
No... you're misunderstanding the point of the kv filter and your use of `add_field` above doesn't make sense. The kv filter accepts a string on the form
```
a=b c=d
```
and turns it into the following fields:
```auto
a => b
c => d
```
You may have to tweak its settings a bit to work with your input.
---
### Author:  [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)
#### Post date: [April 20, 2016, 12:03pm UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/8 "2016-04-20T12:03:01Z")
As you said , use mutate to connect string , but how to filter the log to get that i want ?
Are you mean the settings of KV filter in order to defined the values to mutate ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 12:22pm UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/9 "2016-04-20T12:22:54Z")
Yes. The kv filter can split the string into keys and values as in my previous example. Then you can combine some of those values using a mutate filter. I don't know how else to explain this. How about you try it out?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 20, 2016, 2:33pm UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/11 "2016-04-20T14:33:57Z")
Wouldn't ", " (a comma and a space) be a better field splitter?
Next time please include the whole event and not just the `result` field.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 21, 2016, 5:30am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/13 "2016-04-21T05:30:21Z")
Try excluding the `@timestamp` field using the [`exclude_keys` option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-exclude_keys). Alternatively, inverse the logic by using [`include_keys`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-exclude_keys) to choose which keys that _should_ be extracted.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/logstash-connect-strings-after-filter/47859/14 "2017-07-06T05:01:20Z")