# Unable to get the new field in Kibana, defined in logstash!

**URL:** https://discuss.elastic.co/t/unable-to-get-the-new-field-in-kibana-defined-in-logstash/161518
**Category:** Logstash
**Created:** [December 19, 2018, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-get-the-new-field-in-kibana-defined-in-logstash/161518 "2018-12-19T13:00:52Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![soumith](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@soumith](https://discuss.elastic.co/u/soumith)
#### Post date: [December 19, 2018, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-get-the-new-field-in-kibana-defined-in-logstash/161518/1 "2018-12-19T13:00:52Z")

</div>

Hello, I am new to ELK stack and working on basics like getting a log through filebeat and view that in the kibana dashboard. I want to get an extra field in kibana from the part of existing message field. To do so, I managed to edit the logstash filter part by using grok filter and adding add\_field.Then, when I refresh the fields of index pattern in kibana, I can not get the new field that I added in the logstash.conf. Is this the right way of working to get the new field on my kibana dashboard? Can anyone please guide me?

Here are my logstash conf files....  
**input.conf**  
input {  
beats {  
port =\> 5044  
}  
}

**filter.conf**  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGBASE}%{SPACE}%{GREEDYDATA}" }  
add\_field =\> { "error\_message" =\> "%{GREEDYDATA}" }  
}  
}  
}

**output.conf**  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

**event log**  
Dec 19 13:59:33 ctrl2 systemd[1]: systemd-journal-upload.service: Consumed 26ms CPU time

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2019, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-get-the-new-field-in-kibana-defined-in-logstash/161518/2 "2019-01-16T13:00:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.