title: From a given field, depending on the content, mofify it and store it in different new fields
body: <p>I have created this new topic to avoid confusion but it is related to the following topic, which was resolved:</p>
  
  <p><a href="https://stackoverflow.com/questions/41958787/modify-the-content-of-a-field-using-logstash">Modify the content of a field using logstash</a></p>
  
  <p>Let's say that in field called <code>code</code> the content are also words, like: <code>notification</code> or <code>mountain</code> and I would like to create another field called <code>code_word</code> to store those words.</p>
  
  <p>So from the field called <code>code</code> in the database, depending on its content it would create <code>code_short</code>, and <code>code_word</code>.</p>
  
  <p>I was trying something like this:</p>
  
  <pre><code>grok {
    match =&gt; { "code" =&gt; "(?&lt;prefix&gt;[a-zA-Z]+)000000%{INT:suffix} %{WORD:word}" }
    add_field =&gt; { "code_short" =&gt; "%{prefix}%{suffix}"}
    add_field =&gt; { "code_word" =&gt; "%{word}"}
  }
  </code></pre>
  
  <p>but clearly is not working: _grokparsefailure.</p>
  
  <p>I am not sure how to do it, I am wondering if it could be done using a conditional like an "if".</p>
  
  <p>This is the output:</p>
  
  <pre><code>    {
     "took": 5,
     "timed_out": false,
     "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
     },
     "hits": {
        "total": 43,
        "max_score": 1,
        "hits": [
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg75",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.360Z",
                 "code": "molfix-oat",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg77",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.365Z",
                 "code": "PO0000002221",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8C",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.372Z",
                 "code": "ST0000003302",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8K",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.382Z",
                 "code": "notifications-set",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8M",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.384Z",
                 "code": "PO0000001111",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8N",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.385Z",
                 "code": "PO0000000808",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8R",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.388Z",
                 "code": "TT0000000009",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8U",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.391Z",
                 "code": "ST0000001113",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8c",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.398Z",
                 "code": "test/bin/UT0",
                 "@version": "1",
                 "tags": []
              }
           },
           {
              "_index": "test1",
              "_type": "data",
              "_id": "AVo3yno0PoyZlwFEpg8g",
              "_score": 1,
              "_source": {
                 "@timestamp": "2017-02-13T14:05:00.400Z",
                 "code": "PO0000001203",
                 "@version": "1",
                 "tags": []
              }
           }
        ]
     }
  }
  </code></pre>