# Problem with field mapping

**URL:** <https://discuss.elastic.co/t/problem-with-field-mapping/140902>\
**Category:** Logstash\
**Created:** [July 20, 2018, 1:32pm UTC](https://discuss.elastic.co/t/problem-with-field-mapping/140902 "2018-07-20T13:32:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eegor](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@eegor](https://discuss.elastic.co/u/eegor)\
**Post date:** [July 20, 2018, 1:32pm UTC](https://discuss.elastic.co/t/problem-with-field-mapping/140902/1 "2018-07-20T13:32:46Z")

</div>

Hi all

I use ruby web call inside a logstash filter in order to enrich log data. I call a URL with the content of an existing field and I would like to put the response into a new field. The code works and I can find the field with propper content, but the resulting field is not mapped according to Kibana. And yes, I did the reload. But the field is also not shown in Kibana - settings - index pattern -fields.

The field I'm talking about is called greycode\_verdict.

Here the relevant part of my logstash filter:

```
ruby {
  init => "
    require 'net/http'
  "
   code => "
    sha256hash = event.get('[sha256]')
    uri = URI.parse('http://greycode:42042/' + sha256hash) 
    response = Net::HTTP.get_response(uri)
    if response.code == '200'
      result = response.body
      event.set('[greycode_verdict]', result)
    else
      event.set('[greycode_verdict]', 'ERROR reaching greycode web service')
    end
  "
}

```

I tried to add the field in front of the ruby part with

```
add_field => {"greycode_verdict" => "no verdict yet"}

```

but I guess I'm misinterpreting the problem...

Thanks for your help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 20, 2018, 2:18pm UTC](https://discuss.elastic.co/t/problem-with-field-mapping/140902/2 "2018-07-20T14:18:04Z")

</div>

Do you have a template for the index in question?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2018, 2:18pm UTC](https://discuss.elastic.co/t/problem-with-field-mapping/140902/3 "2018-08-17T14:18:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.