title: Create Field using fluentd
body: <p>I have logs that I am consuming with Fluentd and sending to Elasticsearch. I would like to create a new field if a string is found.</p>
  <p>Sample log:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;@timestamp&quot;: &quot;2021-01-29T08:05:38.613Z&quot;,
    &quot;@version&quot;: &quot;1&quot;,
    &quot;message&quot;: &quot;Started Application in 110.374 seconds (JVM running for 113.187)&quot;,
    &quot;level&quot;: &quot;INFO&quot;
  }
  </code></pre>
  <p>I would like to create a new field <strong>STARTIME</strong> and the value, in this case, would be <strong>113.187</strong></p>
  <p>What I have tried is, used the record_transformer and ruby split to get the value but it seems when it matches it remove the string I want from the log file.</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;filter**&gt;
    @type record_transformer
    enable_ruby true
    &lt;record&gt;
      STARTIME ${record[&quot;message&quot;].split(&quot;JVM running&quot;).last.split(&quot;)&quot;)}
    &lt;/record&gt;
  &lt;/filter&gt;
  </code></pre>
  <p>How can I create this new field with the desired value?</p>
  <p>I have now used the suggested option below:</p>
  <pre><code>&lt;filter**&gt;
    @type record_transformer
    enable_ruby true
    &lt;record&gt;
      STARTIME ${record[&quot;message&quot;].split(&quot;JVM running for &quot;).last.split(&quot;)&quot;)[0]}
    &lt;/record&gt;
  &lt;/filter&gt;
  </code></pre>
  <p>Which got me closer. What's happening now is the Field STARTIME is created and when the log entry matches it has the value of <strong>113.187</strong> which is correct however every other line that does not match this pattern just gets added to the new field.</p>
  <p><a href="https://i.stack.imgur.com/cxz7D.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cxz7D.png" alt="enter image description here" /></a></p>