# Add field for source - JSON file via filebeats

**URL:** <https://discuss.elastic.co/t/add-field-for-source-json-file-via-filebeats/58162>\
**Category:** Logstash\
**Created:** [August 16, 2016, 3:45pm UTC](https://discuss.elastic.co/t/add-field-for-source-json-file-via-filebeats/58162 "2016-08-16T15:45:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![norandom](https://avatars.discourse-cdn.com/v4/letter/n/d07c76/32.png) [@norandom](https://discuss.elastic.co/u/norandom)\
**Post date:** [August 16, 2016, 3:45pm UTC](https://discuss.elastic.co/t/add-field-for-source-json-file-via-filebeats/58162/1 "2016-08-16T15:45:43Z")

</div>

Hi,

I am receiving a JSON file with Logstash via the filebeats agents from multiple remote systems. hostabc, hostdef, and so on.

- I have had the problem that the received JSON file is escaped once Logstash has written it. Therefore I added the format after the line codec. I don't know how to do this in a better way and the CPU utilization is quite high for this. If someone knows a better way, please let me know 😉

- Apart from this I want to tag the source host, which sent the file. In order to do this I need to add a field to the line. Something like:

`hostabc - { json stuff }`  
`hostdef - { json stuff }`

Preferably I'd like this as an addional JSON field

`{ "source":"hostabc", rest of the json stuff }`

Here is how this looks:

```
input {
        beats {
                port => 5044
        }
}

output {
        file {
                path => "/var/log/suricata/eve-remote.json"
                codec => line { format => "%{message}"}
        }
}

```

The messages look like this:

`{"timestamp":"2016-08-16T14:43:16.908358+0000","flow_id":3753490846 ... }`

FluentD could do this. I am not sure if Logstash is that capable...

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 16, 2016, 5:06pm UTC](https://discuss.elastic.co/t/add-field-for-source-json-file-via-filebeats/58162/2 "2016-08-16T17:06:45Z")

</div>

What do you currently get in eve-remote.json? What would you like to get instead?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/add-field-for-source-json-file-via-filebeats/58162/3 "2017-07-06T04:43:14Z")

</div>