# Use filebeat processor to concatenate string

**URL:** https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725
**Category:** Beats
**Tags:** filebeat
**Created:** [January 23, 2026, 10:55pm UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725 "2026-01-23T22:55:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mistrhanky1](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)
#### Post date: [January 23, 2026, 10:55pm UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725/1 "2026-01-23T22:55:48Z")

</div>

I have a situation where a customer has a custom syslog file for the Citrix ADC Netscaler. I would like to use the fleet integration for this but it doesn’t support the header format they have. I would like to modify that header and rewrite it so it will ingest cleanly. I will need to use the filebeat processors through fleet do do this.

I have tried any number of add fields etc, but cannot get the concatenated string to work.

A simplified example would be a logline that looks like:

> source message: field1-field2-field3
> 
> target message: field3-field2-field1

I can easily dissect this into parts, but cannot get a processor to work that cats the string back together. Suggestions?

- 

> - dissect:  
> tokenizer: "%{f1}-$[f2}-%{f3}"  
> field: "message"  
> overwrite\_keys: true
> 
> - add\_fields:  
> target:’’  
> fields:  
> combined\_string: "{f3}-{f2}-{f1}"

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [January 24, 2026, 4:18am UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725/2 "2026-01-24T04:18:54Z")

</div>

Hello @mistrhanky1

You can try using script processor or ingest pipeline shared in this post :

[https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/15](https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/15)

```auto
processors:
      - dissect:
          tokenizer: "%{f1}-%{f2}-%{f3}"
          field: message
          target_prefix: ""
          overwrite_keys: true

      - script:
          lang: javascript
          source: >
            function process(event) {
              var f1 = event.Get("f1");
              var f2 = event.Get("f2");
              var f3 = event.Get("f3");

              if (f1 && f2 && f3) {
                event.Put("message", f3 + "-" + f2 + "-" + f1);
              }
            }

```

Thanks!!

---

<div class="post-metadata">

### Author: ![mistrhanky1](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)
#### Post date: [January 26, 2026, 3:15pm UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725/3 "2026-01-26T15:15:49Z")

</div>

This did the trick. Thank You!