# Parsing custom field with logstash
**URL:** https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634
**Category:** Logstash
**Created:** [February 27, 2017, 2:17pm UTC](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634 "2017-02-27T14:17:28Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mohsin106](https://discuss.elastic.co/u/mohsin106)
#### Post date: [February 27, 2017, 2:17pm UTC](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634/1 "2017-02-27T14:17:28Z")
Hi,
I have a log file that I need to parse. I'm forwarding the log from a remote server using FileBeat. My log file content looks like this:
ip address, data (characters and numbers).
My logstash conf file looks like this:
input {
beats {
port =\> "5043"
}
}
filter {
geoip {
source =\> "message"
}
}
output {
elasticsearch {
hosts =\> ["10.10.10.10:9200"]
index =\> "test"
}
}
I can see my log data using Kibana under the "test" index. My log content is inside the message field. I'm familiar with REGEX but what is the syntax that I need to add to my logstash conf file that will allow me to create custom fields for IP or anything else? I'd like to be able to see an IP field when looking in Kibana as I see the message field.
Thanks,
Mo
---
### Author:  [@mohsin106](https://discuss.elastic.co/u/mohsin106)
#### Post date: [February 27, 2017, 5:31pm UTC](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634/2 "2017-02-27T17:31:41Z")
Just kidding, its working! 😄
I was looking at the wrong index 😕
Works much better if you look at the right index in Kibana! 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2017, 5:31pm UTC](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634/3 "2017-03-27T17:31:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.