# Logstash extract first 3 chars of a field into another field
**URL:** https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658
**Category:** Logstash
**Created:** [October 21, 2015, 10:48am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658 "2015-10-21T10:48:27Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@samnik60](https://discuss.elastic.co/u/samnik60)
#### Post date: [October 21, 2015, 10:48am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658/1 "2015-10-21T10:48:27Z")
i tried using grok for this but not getting anywhere . anyone tried this before ??
grok {
add\_field =\> ["named\_raw\_message", "%{@field}[1..3]" ]
}
Thanks,
sam
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 21, 2015, 11:11am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658/2 "2015-10-21T11:11:59Z")
The `[1..3]` syntax isn't part of Logstash's standard configuration language, which is why I pointed you to the ruby filter.
Also, your `add_field` will never be used since its conditional upon the successful completion of the grok filter. Since you don't have any match expressions set up it will be never be deemed successful. Perhaps you meant to use a mutate filter instead?
---
### Author:  [@samnik60](https://discuss.elastic.co/u/samnik60)
#### Post date: [October 21, 2015, 11:14am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658/3 "2015-10-21T11:14:22Z")
I was just trying out grok for this use case, the documentation was not enough for me to implement this feature, may be i need to get familiar with languages like ruby to get the hang of these plugins
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658/4 "2017-07-06T05:25:55Z")