# ElasticSearch and Logstash : Transform message

**URL:** https://forums.suse.com/t/elasticsearch-and-logstash-transform-message/2520
**Category:** Rancher 1.x
**Created:** [April 19, 2016, 2:55pm UTC](https://forums.suse.com/t/elasticsearch-and-logstash-transform-message/2520 "2016-04-19T14:55:13Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![throrin19](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/throrin19/32/1226_2.png) [@throrin19](https://forums.suse.com/u/throrin19)
#### Post date: [April 19, 2016, 2:55pm UTC](https://forums.suse.com/t/elasticsearch-and-logstash-transform-message/2520/1 "2016-04-19T14:55:13Z")

</div>

Hello,  
I try to use ElasticSearch with logstash and Kibana. It wors fine but I want to parse specific fields to retrieve another fields.  
After research, I found that it was necessary to install specifics plugins in ElasticSearch **BUT** I can’t find how to install plugins with the ElasticSearch installed from the catalog.

Thanks

---

<div class="post-metadata">

### Author: ![throrin19](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/throrin19/32/1226_2.png) [@throrin19](https://forums.suse.com/u/throrin19)
#### Post date: [April 20, 2016, 8:53am UTC](https://forums.suse.com/t/elasticsearch-and-logstash-transform-message/2520/2 "2016-04-20T08:53:04Z")

</div>

Ok, Sorry I have misunderstand this part. After research, the parsing of my field to create another field is set in the `filter` part of **logstash** with **grok**.

I try this in my config :

```auto
grok {
  match => {
    "message" => "\[32m%{LOGLEVEL:loglevel}\[39m: memory: %{NOTSPACE:memory}, uptime \(seconds\): %{NUMBER:uptime}, load: %{NUMBER:load1},%{NUMBER:load5},%{NUMBER:load15}"
  }
}
mutate {
  rename => { "docker.id" => "container_id" }
  rename => { "docker.name" => "container_name" }
  rename => { "docker.image" => "docker_image" }
  rename => { "docker.hostname" => "docker_hostname" }
}

```

To transform this type of message :

```auto
e[32minfoe[39m: memory: 76Mb, uptime (seconds): 5529.927, load: 0.05322265625,0.1298828125,0.19384765625

```

To this variables :

load15 0.19384765625  
uptime 5529.927  
load1 0.05322265625  
load5 0.1298828125  
memory 76Mb  
loglevel info

I test the pattern in [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match) and my matches work fine. But, In Kibana I can’t retrieve this fields.

Thanks