# Input Extractor: change field value based on \_another\_ field

**URL:** <https://community.graylog.org/t/input-extractor-change-field-value-based-on-another-field/8313>\
**Category:** Graylog Central (peer support)\
**Created:** [January 9, 2019, 5:35pm UTC](https://community.graylog.org/t/input-extractor-change-field-value-based-on-another-field/8313 "2019-01-09T17:35:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sfuerte](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sfuerte](https://community.graylog.org/u/sfuerte)\
**Post date:** [January 9, 2019, 5:35pm UTC](https://community.graylog.org/t/input-extractor-change-field-value-based-on-another-field/8313/1 "2019-01-09T17:35:44Z")

</div>

**Problem**  
Have some logs coming from Docker containers via GELF UDP.

Messages in question are:

> level: 6  
> message: .\* PHP Fatal error: .\*

I can process them by routing to a new stream and pipeline in it, but don’t think it’s the right way to do it. Moreover, I need them to be in already existing stream.

**Goal**  
how to set up an extractor, that by matching **message** field, would set a specific value to **level** field?

PS: and that’s completely another question why Dev’s didn’t catch and log those exception properly 🙂

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 10, 2019, 7:01am UTC](https://community.graylog.org/t/input-extractor-change-field-value-based-on-another-field/8313/2 "2019-01-10T07:01:53Z")

</div>

the processing pipeline is build to solve your problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 24, 2019, 7:02am UTC](https://community.graylog.org/t/input-extractor-change-field-value-based-on-another-field/8313/3 "2019-01-24T07:02:06Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
