# Logstash Grok unable to create new fields for apache-access log

**URL:** <https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371>\
**Category:** Logstash\
**Created:** [October 30, 2016, 12:40pm UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371 "2016-10-30T12:40:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kishorramanan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorramanan/32/12823_2.png) [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\
**Post date:** [October 30, 2016, 12:40pm UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371/1 "2016-10-30T12:40:51Z")

</div>

Hi, New to ELK.  
I am trying to build a simple dashboard for apache access log.  
I need to extract the second IP from the log  
Sample log

```auto
127.0.0.1 172.0.0.10, 123.56.98.356 - - [date] "GET /loca/lib/images.img HTTP/1.1" 200 3840
127.0.0.1 165.87.57.77 - - [date] "POST /loca/lib/images.img HTTP/1.1" 200 3840

```

I tried using the **COMBINEDAPACHELOG** getting everything as a single message.

Added **GROK ADD\_FILTER** but it did not work out.  
Sample log-stash config

```auto
filter {
    if [type] == "apache-access" {
        grok {
           add_field => { "uri" => "%{URIHOST}" }
           break_on_match => false
           add_field => { "clinetip" => "%{IP:client_ip} %{IP:client_ip2}" }
           break_on_match => false
           match => { "message" => "%{COMBINEDAPACHELOG}" }
        }
        date {
            locale => "en"
            match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
        }
    }

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2016, 2:15pm UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371/2 "2016-10-30T14:15:02Z")

</div>

Those log entries aren't in the combined format to COMBINEDAPACHELOG won't work. You'll have to define your own pattern(s). It's _almost_ a combined log so if you start with the COMBINEDAPACHELOG pattern (below) it shouldn't be hard to construct a working pattern.

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/v2.0.5/patterns/grok-patterns#L93-L94>

---

<div class="post-metadata">

**Author:** ![kishorramanan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorramanan/32/12823_2.png) [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\
**Post date:** [October 30, 2016, 4:32pm UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371/3 "2016-10-30T16:32:07Z")

</div>

Awesome, thanks for the info.  
But still new field is not added through **grok add\_field**

```auto
 grok {
           add_field => { "uri" => "%{URIHOST}" }

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2016, 7:07pm UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371/4 "2016-10-30T19:07:54Z")

</div>

Do your events have a `URIHOST` field? Please show your current filter configuration and an example of a resulting event (output from a `stdout { codec => rubydebug }` output is preferable).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/logstash-grok-unable-to-create-new-fields-for-apache-access-log/64371/5 "2017-07-06T04:31:59Z")

</div>