# Logstash New Field is not added
**URL:** https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912
**Category:** Logstash
**Created:** [July 4, 2019, 12:30pm UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912 "2019-07-04T12:30:16Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 4, 2019, 12:30pm UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912/1 "2019-07-04T12:30:16Z")
I am trying to add new field in my config file there is already a field message in my csv file i am trying to add test field . In this add field i want to copy of message data into test field for testing file my config file is
input
{
file
{
path =\> "C:/Users/Ubaid/Desktop/testmcb"
start\_position =\> "beginning"
sincedb\_path =\> "NUL"
}
}
filter {
csv {
separator =\> ","
columns =\> ["Insert\_time","Mobile","Telco","Mask","Message","Test"]
}
date {
match =\> ["Insert\_time","dd-MM-YYYY HH:mm"]
target =\> "Insert\_time"
}
mutate {
add\_field =\> {"Test", "%{[Message]}"}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "mcbdata-%{+dd.MM.YYYY}"
}
stdout {codec =\> json\_lines }
}
After running this config file logstash start and service is stop can someone help whats wrong in my config file
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2019, 1:59pm UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912/2 "2019-07-04T13:59:50Z")
What does the logstash log file show?
---
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 5, 2019, 4:24am UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912/3 "2019-07-05T04:24:31Z")
D:\ELK\Logstash\logstash-7.1.1\bin\>logstash -f logstash\_testmcb.conf
Sending Logstash logs to D:/ELK/Logstash/logstash-7.1.1/logs which is now configured via log4j2.properties
[2019-07-05T09:23:59,544][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-07-05T09:23:59,593][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.1"}
[2019-07-05T09:24:02,021][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 22, column 21 (byte 380) after filter { \r\n csv { \r\n separator =\> "," \r\n columns =\> ["Insert\_time","Mobile","Telco","Mask","Message","Test"] \r\n }\r\n\r\ndate { \r\nmatch =\> ["Insert\_time","dd-MM-YYYY HH:mm"] \r\n target =\> "Insert\_time" \r\n} \r\n\r\nmutate {\r\nadd\_field =\> {"Test"", :backtrace=\>["D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/java_pipeline.rb:23:in`initialize'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "D:/ELK/Logstash/logstash-7.1.1/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]}
[2019-07-05T09:24:02,712][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
[2019-07-05T09:24:07,472][INFO][logstash.runner] Logstash shut down.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 5, 2019, 2:43pm UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912/4 "2019-07-05T14:43:41Z")
> [@Syed.Ubaid](#):
>
> mutate {
> add\_field =\> {"Test", "%{[Message]}"}
> }
That should be
```
mutate {
add_field => { "Test" => "%{[Message]}" }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2019, 2:43pm UTC](https://discuss.elastic.co/t/logstash-new-field-is-not-added/188912/5 "2019-08-02T14:43:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.