# Logstash mutate add\_field into all logs/data

**URL:** <https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918>\
**Category:** Logstash\
**Created:** [March 17, 2022, 6:28am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918 "2022-03-17T06:28:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![travlest](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@travlest](https://discuss.elastic.co/u/travlest)\
**Post date:** [March 17, 2022, 6:28am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918/1 "2022-03-17T06:28:43Z")

</div>

Hi, I have a question regarding logstash.. Right now, I have a few different CSV files that are being shipped into logstash. The CSV file example is below.

`THE example`

`File 1`  
`url.com` `,192.xxx.xxx.xxx,product-A`  
`urlA.com` `,192.xxx.xxx.xxx,product-B`  
`urlB.com` `,192.xxx.xxx.xxx,product-C`  
`urlC.com` `,192.xxx.xxx.xxx,product-D`

`File 2`  
`mix.com` `,192.xxx.xxx.xxx,mix-A`  
`mixA.com` `,192.xxx.xxx.xxx,mix-B`  
`mixB.com` `,192.xxx.xxx.xxx,mix-C`  
`mixC.com` `,192.xxx.xxx.xxx,mix-D`

`File 3`  
`post.com` `,192.xxx.xxx.xxx,post-A`  
`postA.com` `,192.xxx.xxx.xxx,post-B`  
`postB.com` `,192.xxx.xxx.xxx,post-C`  
`postC.com` `,192.xxx.xxx.xxx,post-D`

the question is, how can I add a new\_field for all data with the same text? does this mutate correct?

```auto
  if "url.com" in [domain] {
   mutate {
    add_field => { "original" => "url.comg" }
  }
 }

```

`THE result`  
`File 1`  
`url.com` `,192.xxx.xxx.xxx,product-A,` `url.com`  
`urlA.com` `,192.xxx.xxx.xxx,product-B,` `url.com`  
`urlB.com` `,192.xxx.xxx.xxx,product-C,` `url.com`  
`urlC.com` `,192.xxx.xxx.xxx,product-D,` `url.com`

`File 2`  
`mix.com` `,192.xxx.xxx.xxx,mix-A,` `mix.com`  
`mixA.com` `,192.xxx.xxx.xxx,mix-B,` `mix.com`  
`mixB.com` `,192.xxx.xxx.xxx,mix-C,` `mix.com`  
`mixC.com` `,192.xxx.xxx.xxx,mix-D,` `mix.com`

`File 3`  
`post.com` `,192.xxx.xxx.xxx,post-A,` `post.com`  
`postA.com` `,192.xxx.xxx.xxx,post-B,` `post.com`  
`postB.com` `,192.xxx.xxx.xxx,post-C,` `post.com`  
`postC.com` `,192.xxx.xxx.xxx,post-D,` `post.com`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 14, 2022, 6:29am UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-into-all-logs-data/299918/2 "2022-04-14T06:29:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.