# New fields are not added while grok seems fine

**URL:** <https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576>\
**Category:** Logstash\
**Created:** [November 6, 2018, 4:02pm UTC](https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576 "2018-11-06T16:02:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yonatan\_Brand](https://avatars.discourse-cdn.com/v4/letter/y/57b2e6/32.png) [@Yonatan\_Brand](https://discuss.elastic.co/u/Yonatan_Brand)\
**Post date:** [November 6, 2018, 4:02pm UTC](https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576/1 "2018-11-06T16:02:19Z")

</div>

Hi,

I am not able to see new fields I created with grok. I have tried to refresh the indexes, however, I am still not able to see them.

Below is my logstash configuration:

```
input {
  beats {
    port => 5044
    host => "0.0.0.0"
  }
}

filter {
    if [log_type] == "artifactory" {
            grok {
                    match => ["message", ["^%{TIMESTAMP_ISO8601:artifactory_timestamp} \[%{DATA:artifactory_thread_name}] \[%{LOGLEVEL:loglevel}%{SPACE}] \(%{DATA:artifactory_event_type}\) - %{GREEDYDATA:artifactory_message}"]]
            }
    }

    else if [log_type] == "request" {
            grok {
                    match => ["message", ["%{DATA:artifactory_timestamp}\|%{NUMBER:artifactory_request_time}\|%{DATA:artifactory_request_type}\|%{IP:artifactory_client_ip}\|%{DATA:artifactory_username}\|%{DATA:artifactory_request_method}\|%{DATA:artifactory_resource_path}\|%{DATA:artifactory_protocol_version}\|%{DATA:artifactory_response_code}\|%{GREEDYDATA:artifactory_request_content_length}"]]
            }
    }

mutate {
    copy => { "[fields][log_type]" => "log_type" }
    }
}

output {

    if [log_type] == "request"{
            elasticsearch {
                    hosts => "10.128.0.243:9200"
                    index => "request-%{+YYYY.MM.dd}"
            }
    }

    else if [log_type] == "artifactory"{
            elasticsearch {
                    hosts => "10.128.0.243:9200"
                    index => "artifactory-%{+YYYY.MM.dd}"
            }
    }
}

```

Below are two log examples to verify grok is ok:

1. Request  
20181106155947|17|REQUEST|10.128.0.207|admin|GET|/api/system/licenses|HTTP/1.1|200|0

2. Artifactory  
2018-11-06 15:40:41,091 [http-nio-8081-exec-9] [INFO] (o.a.s.ArtifactoryApplicationContext:495) - Artifactory application context set to READY by reload

Any assistance is much appriciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 6, 2018, 4:49pm UTC](https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576/2 "2018-11-06T16:49:08Z")

</div>

Filters are executed in order, and it looks to me like you are only creating the `log_type` field after you have tried to use it in conditionals. This means that your grok filters will never be run as the field does not exist at that point.

---

<div class="post-metadata">

**Author:** ![Yonatan\_Brand](https://avatars.discourse-cdn.com/v4/letter/y/57b2e6/32.png) [@Yonatan\_Brand](https://discuss.elastic.co/u/Yonatan_Brand)\
**Post date:** [November 6, 2018, 7:30pm UTC](https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576/3 "2018-11-06T19:30:21Z")

</div>

Hi Christian,

Thank you for your reply.

So foolish of me to miss it. Probably I was to tired 😫.

My issue is resolved.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2018, 7:30pm UTC](https://discuss.elastic.co/t/new-fields-are-not-added-while-grok-seems-fine/155576/4 "2018-12-04T19:30:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.