# Sending Extracted Fields to Kibana

**URL:** <https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136>\
**Category:** Logstash\
**Created:** [July 8, 2015, 10:48am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136 "2015-07-08T10:48:03Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\
**Post date:** [July 8, 2015, 10:48am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/1 "2015-07-08T10:48:03Z")

</div>

Hi,

i have modified the logstash configuration file to extract some fields. The extracted fields are dispalying in logstash.stdout file but are not showing in kibana.

my configuration file is like this:

filter {  
if [type] == "cloudera" {  
grok {

```
  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => ["received_at", "%{@timestamp}"]
  add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
  match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}

```

output {  
elasticsearch { host =\> localhost }  
stdout { codec =\> rubydebug }  
}  
how to send these extracted fields from logstash to kibana?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2015, 10:51am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/2 "2015-07-08T10:51:43Z")

</div>

Which fields in particular?

---

<div class="post-metadata">

**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\
**Post date:** [July 8, 2015, 10:53am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/3 "2015-07-08T10:53:14Z")

</div>

Thanks for the reply.  
I want to display the fields received\_at and received\_from in kibana.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2015, 10:55am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/4 "2015-07-08T10:55:44Z")

</div>

`@timestamp` is only generated when the doc is sent to Elasticsearch, so that add line won't work..

Are you seeing the `received_from` field in stdout?

---

<div class="post-metadata">

**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\
**Post date:** [July 8, 2015, 10:59am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/5 "2015-07-08T10:59:25Z")

</div>

yes, i'm seeing received\_from in stdout

here is my ouput:

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2015, 11:09am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/6 "2015-07-08T11:09:58Z")

</div>

Then it'll be uploaded to ES and visible via KB.

Can you not see this in the documents under the Discover tab?

---

<div class="post-metadata">

**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\
**Post date:** [July 8, 2015, 11:13am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/7 "2015-07-08T11:13:06Z")

</div>

No,these fileds are not displaying under Discover tab.

Do i need to do any other changes to send these fields to kibana?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 8, 2015, 11:13am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/8 "2015-07-08T11:13:53Z")

</div>

Try refreshing your fields under the index settings?

---

<div class="post-metadata">

**Author:** ![sushmithak](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sushmithak](https://discuss.elastic.co/u/sushmithak)\
**Post date:** [July 8, 2015, 12:51pm UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/9 "2015-07-08T12:51:21Z")

</div>

Thanks Mark Walkom,

Now,I'm getting extracted fields in Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136/10 "2017-07-06T05:35:17Z")

</div>