# Logstash filter to create a subfield based on specific text in a log message
**URL:** https://discuss.elastic.co/t/logstash-filter-to-create-a-subfield-based-on-specific-text-in-a-log-message/347978
**Category:** Logstash
**Created:** [November 25, 2023, 7:54pm UTC](https://discuss.elastic.co/t/logstash-filter-to-create-a-subfield-based-on-specific-text-in-a-log-message/347978 "2023-11-25T19:54:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Dokh\_Ahmed](https://discuss.elastic.co/u/Dokh_Ahmed)
#### Post date: [November 25, 2023, 7:54pm UTC](https://discuss.elastic.co/t/logstash-filter-to-create-a-subfield-based-on-specific-text-in-a-log-message/347978/1 "2023-11-25T19:54:40Z")
I've been working on a Logstash configuration where I'm trying to create a subfield within the 'message1' field based on a specific text pattern ('Started'). Here's a snippet of my current Logstash filter:
```auto
filter {
grok {
pattern_definitions => {
"Extract_log_line" => "%{TIMESTAMP_ISO8601:timestamp} \| %{LOGLEVEL:log_level} \| \[%{DATA:thread}\] --- %{NUMBER:process_id} \| %{DATA:class} \| \| %{GREEDYDATA:message1}(\\r|\\n)?"
"Extract_routes_started" => ".*Started %{DATA:routes_started} .*"
}
match => {
"message" => [
"%{Extract_log_line}"
]
}
add_field => {
"[message1][routes_started]" => "%{routes_started}"
}
}
mutate {
remove_field => ["@timestamp", "@version"]
}
}
```
Unfortunately, this doesn't seem to be working as expected "\_grokparsefailure" I'm trying to detect the text 'Started' within the 'message1' field and create a subfield 'routes\_started' based on the text that follows it. Could anyone assist in identifying what might be incorrect in my Logstash configuration or suggest a better approach to achieve this?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 26, 2023, 7:39pm UTC](https://discuss.elastic.co/t/logstash-filter-to-create-a-subfield-based-on-specific-text-in-a-log-message/347978/2 "2023-11-26T19:39:20Z")
You never reference the Extract\_routes\_started pattern that you defined, so [routes\_started] will never exist. I can't say why the Extract\_log\_line pattern does not match without seeing a sample of [message].
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2023, 7:40pm UTC](https://discuss.elastic.co/t/logstash-filter-to-create-a-subfield-based-on-specific-text-in-a-log-message/347978/3 "2023-12-24T19:40:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.