# Problem when adding fields to logstash
**URL:** https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744
**Category:** Logstash
**Created:** [December 5, 2020, 6:02pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744 "2020-12-05T18:02:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)
#### Post date: [December 5, 2020, 6:02pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/1 "2020-12-05T18:02:39Z")
Hi guys! There was a problem adding the _add\_field_ via the mutate filter plugin. I do this:
```
filter {
if [type] == "syslog" {
mutate {
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
}
}
}
```
But fields not added to events. Where is my mistake?
All config:
```
input {
beats {
port => 5044
type => "beats"
}
udp {
port => 6514
type => "syslog"
}
tcp {
port => 6514
type => "syslog"
}
}
filter {
if [type] == "syslog" {
mutate {
add_field => { "received_at" => "%{@timestamp}" }
}
}
}
output {
if [type] == "beats" {
udp {
#codec => plain { format => "%{message}"}
codec => "json"
host => "192.168.0.56"
port => "6514"
}
}
else if [type] == "syslog" {
udp {
codec => plain { format => "%{message}"}
# codec => "json"
# type => "syslog"
host => "192.168.0.56"
port => "514"
}
}
}
```
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 5, 2020, 6:11pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/2 "2020-12-05T18:11:33Z")
What is the correct config you are using? On the first one your `add_field` is wrong, you are passing an array instead of a hash, but in your second config that you pasted it is right, you are passing a hash.
The correct format for `add_field` is this:
```auto
mutate {
add_field => { "received_at" => "%{@timestamp}" }
}
```
Not this:
```auto
mutate {
add_field => ["received_at", "%{@timestamp}"]
}
```
Which one are you using?
Can you share an example of the output of an event?
---
### Author:  [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)
#### Post date: [December 5, 2020, 6:16pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/3 "2020-12-05T18:16:14Z")
> [@leandrojmp](#):
>
> Which one are you using?
I use
```
mutate {
add_field => { "received_at" => "%{@timestamp}" }
}
```
> [@leandrojmp](#):
>
> Can you share an example of the output of an event?
Sure:
`<86>Dec 5 10:10:56 ubuntu pkexec: pam_unix(polkit-1:session): session opened for user root by (uid=1000)`
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 5, 2020, 6:42pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/4 "2020-12-05T18:42:26Z")
Looking into your full config, your output for when the field `type` has the value `syslog` is the one below.
```auto
udp {
codec => plain { format => "%{message}"}
host => "192.168.0.56"
port => "514"
}
```
The line below is making you output only the original message in the field `message`, anything else will be ignored.
```auto
codec => plain { format => "%{message}"}
```
If you want to ouput the fields that you added, `received_at` and `received_from` you will need to add then to the `format` option.
```auto
codec => plain { format => "%{message} %{received_at} %{received_from"}
```
---
### Author:  [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)
#### Post date: [December 5, 2020, 7:39pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/5 "2020-12-05T19:39:11Z")
> [@leandrojmp](#):
>
> `codec => plain { format => "%{message} %{received_at} %{received_from"}`
Does not work 😰
Config:
```
input {
beats {
port => 5044
type => "beats"
}
udp {
port => 8514
type => "syslog"
}
tcp {
port => 8514
type => "syslog"
}
}
filter {
if [type] == "syslog" {
mutate {
add_field => { "received_at" => "%{@timestamp}" }
}
}
}
output{
if [type] == "beats" {
udp {
#codec => plain { format => "%{message}"}
codec => "json"
host => "192.168.0.56"
port => "8514"
}
}
else if [type] == "syslog" {
udp {
codec => plain { format => "%{message} %{received_at}" }
# codec => "json"
# type => "syslog"
host => "192.168.0.56"
port => "514"
}
}
}
```
Output of an event:
\<14\>Dec 5 11:37:18 ubuntu NetworkManager[742]: [1607197038.8065] connectivity: (ens33) timed out
---
### Author:  [@Gigazo1d](https://discuss.elastic.co/u/Gigazo1d)
#### Post date: [December 5, 2020, 7:57pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/6 "2020-12-05T19:57:35Z")
Sorry, it works. if you write in output codec: json, then the following fields are automatically added: timestump, host, version. How do I remove them? Use remove in filter?
UPD: problem solved, just needed some sleep =))
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2021, 7:57pm UTC](https://discuss.elastic.co/t/problem-when-adding-fields-to-logstash/257744/7 "2021-01-02T19:57:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.