# Logstash grok for change field value

**URL:** <https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069>\
**Category:** Logstash\
**Created:** [February 5, 2019, 7:38am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069 "2019-02-05T07:38:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![lukatoni](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@lukatoni](https://discuss.elastic.co/u/lukatoni)\
**Post date:** [February 5, 2019, 7:38am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/1 "2019-02-05T07:38:31Z")

</div>

Hi,  
I just wanna change my field value like this:

I have a log json with field:  
**"source\_host": "dev-host-test.com.pl",**

and i need to remove only **.com.pl** leave the old field and create new field with value:  
**"new\_field":"dev-host-test"**

Is there a simple way to do it with grok or other logstash options ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 5, 2019, 8:13am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/2 "2019-02-05T08:13:53Z")

</div>

Try something like this:

```auto
dissect {
  mapping => {
    "source_host" => "%{new_field}.%{}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![lukatoni](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@lukatoni](https://discuss.elastic.co/u/lukatoni)\
**Post date:** [February 5, 2019, 8:35am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/3 "2019-02-05T08:35:52Z")

</div>

Yeah this solution work, but 🙂 i have mixing source\_host values like:

- dev-host-test
- dev-host-test2.com.pl  
etc

And i think this solution work only for message that have **.com.pl** , if message has correct value: only **dev-host-test** and i dont need to change anything i got an error:

```
[2019-02-05T09:29:14,315][WARN][org.logstash.dissect.Dissector] Dissector mapping, pattern not found {"field"=>"source_host", "pattern"=>"%{index_field}.%{}",
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 5, 2019, 8:37am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/4 "2019-02-05T08:37:35Z")

</div>

Then you might need a conditional as well to check if the field contains a dot.

---

<div class="post-metadata">

**Author:** ![lukatoni](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@lukatoni](https://discuss.elastic.co/u/lukatoni)\
**Post date:** [February 5, 2019, 9:42am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/5 "2019-02-05T09:42:45Z")

</div>

Simple if ? like:

```
if ("*." in [source_host]) {
dissect {
  mapping => {
    "source_host" => "%{source_host}.%{}"
  } 
 }
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 5, 2019, 9:54am UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/6 "2019-02-05T09:54:42Z")

</div>

Maybe something like this:

```auto
  if [source_host] =~ /\./ {
    dissect {
      mapping => {
        "source_host" => "%{new_field}.%{}"
      }
    }
  } else {
    mutate {
      copy => { "source_host" => "new_field" }
    }
  }

```

---

<div class="post-metadata">

**Author:** ![lukatoni](https://avatars.discourse-cdn.com/v4/letter/l/8c91f0/32.png) [@lukatoni](https://discuss.elastic.co/u/lukatoni)\
**Post date:** [February 5, 2019, 12:21pm UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/7 "2019-02-05T12:21:45Z")

</div>

Works perfectly \<3 ! Thanks so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2019, 12:21pm UTC](https://discuss.elastic.co/t/logstash-grok-for-change-field-value/167069/8 "2019-03-05T12:21:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.