Mutate to concatenate two filed

[richagautam (Richa)]

Hi Team,

I am using multiple grok filter to capture specific patterns from the log file.Now i want to concatenate one of the filed of first grok filter with one filed of second grok filter.

      mutate { 
add_field => ["field3", "%{field1} %{field2}"] 

}

My doubt is that :

1. While doing this do i have to put the check of Path as well, so that mutate should add filed of same file(Path).
2. Logstash excute all filters/configuration file wise file or it parse multiple files at a time?

Thanks

[guyboertje]

The filters are executed sequentially in the order laid out in the config. There is parallel execution with multiple workers, but once a worker thread takes a batch of events from the queue no other threads (workers) act on those events.