# Useruuid,tracingId and correlationId field is not comming in logstash **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-monitoring, docker\ **Created:** [January 22, 2024, 12:03pm UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537 "2024-01-22T12:03:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vikascateina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikascateina/32/123762_2.png) [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Post date:** [January 22, 2024, 12:03pm UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/1 "2024-01-22T12:03:20Z")
Not able to see Useruuid,tracingId and correlationId field in logs in logstash which is comming from mule but it is comming in message field in logstash.Below is my logstash.conf file and I have attached the screenshot also. input { tcp { port =\> 4560 codec =\> json } } filter { date { match =\> ["timeMillis", "UNIX\_MS"] } } output { elasticsearch { hosts =\> ["elasticsearch-url"] index =\> "%{[application\_id]}-%{[environment]}-%{+YYYY.MM.dd}" user =\> "xxx" password =\> "xxxxx" } } ![Screenshot from 2024-01-22 17-15-12](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aedc8ee1bb3f9e2a297bcb3a8caf86ae7c0eb108.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 22, 2024, 6:59pm UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/2 "2024-01-22T18:59:02Z")
In addition to your json codec, you have a [message] field which is JSON, so you should parse that using a json filter. ---
**Author:** ![vikascateina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikascateina/32/123762_2.png) [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Post date:** [February 12, 2024, 1:12pm UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/3 "2024-02-12T13:12:49Z")
input { tcp { port =\> 4560 codec =\> json } } filter { date { match =\> ["timeMillis", "UNIX\_MS"] } json { source =\> "message" target =\> "correlationId" } } output { elasticsearch { hosts =\> ["xxx"] index =\> "%{[application\_id]}-%{[environment]}-%{+YYYY.MM.dd}" user =\> "xxx" password =\> "xxx" } } The above is logstash.conf .I got correlationId.correlationId field but I only want correlationId then I have added json { source =\> "message" target =\> "correlationId" } mutate { add\_field =\> { "correlationId" =\> "%{[correlationId][correlationId]}" } } mutate { remove\_field =\> ["correlationId"] } } but then also it doesnt work it was not giving value of correlationId Id.In value it is giving %{[correlationId][correlationId]} ![Screenshot from 2024-02-12 18-21-53](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a3478df0b1c7dffe12c9bc9c3a9a25219984398a.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 12, 2024, 3:10pm UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/4 "2024-02-12T15:10:09Z")
These filters are confusing: ```auto json { source => "message" target => "correlationId" } mutate { add_field => { "correlationId" => "%{[correlationId][correlationId]}" } } mutate { remove_field => ["correlationId"] } } ``` First you re parsing the `message` field using the `correlationId` field as the target, so the json document in the `message` field will be nested under the `correlationId`. Then you are adding a field named `correlationId`, which already exists as this is the target of your json filter, with the value `%{[correlationId][correlationId]}`, and after that you are removing the entire `correlationId` field. If those filters work, you will not have any field named `correlationId` in your document because you are removing it. Can you share a sample of your message so the pipeline can be replicated? ---
**Author:** ![vikascateina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikascateina/32/123762_2.png) [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Post date:** [February 13, 2024, 5:32am UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/5 "2024-02-13T05:32:15Z")
{ "correlationId" : "xxxx", "tracePoint" : "OUTBOUND\_REQUEST\_SCOPE\_AFTER", "priority" : "INFO", "elapsed" : 111, "scopeElapsed" : 16, "locationInfo" : { "lineInFile" : "1757", "component" : "json-logger:logger-scope", "fileName" : "xx", "rootContainer" : "xx" }, "timestamp" : "2024-02-12T12:47:51.550Z", "applicationName" : "xxx", "applicationVersion" : "1.0.3", "environment" : "dev", "threadName" : "xxx" } The above is my message which I am getting in elasticsearch but all the fields I wanted as a seperate field which I am getting correlationId.correlationId as know but I only wanted correlationId.Can you tell me what configurations should I change in logstash.conf to get this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 12, 2024, 5:33am UTC](https://discuss.elastic.co/t/useruuid-tracingid-and-correlationid-field-is-not-comming-in-logstash/351537/6 "2024-03-12T05:33:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.