# Using a regex in the custom field of Filebeat

**URL:** <https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252>\
**Category:** Beats\
**Created:** [March 30, 2018, 3:44pm UTC](https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252 "2018-03-30T15:44:36Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [March 30, 2018, 3:58pm UTC](https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252/2 "2018-03-30T15:58:10Z")

</div>

hello @gvdm90, Currently, it's not possible to dynamically extract that information from an event and reuse it as a field with Filebeat, but we plan to add something in beats that will work like the [dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) in Logstash.

But you can solve your problem by either one of the following options:

1. Use the [ingest node](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) feature to do the processing, you can extract the `app_name` part using a `grok processor` and do more filtering after.

2. Use [Logstash](https://www.elastic.co/products/logstash) with the beats inputs and the grok filter and send your events to Logstash instead of sending it directly to Elasticsearch.

What kind of filtering are you doing?

---

_[View the full topic](https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252)._