# Add fields do not work Winlogbeat

**URL:** <https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 9, 2022, 9:48am UTC](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232 "2022-05-09T09:48:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CemG](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@CemG](https://discuss.elastic.co/u/CemG)\
**Post date:** [May 9, 2022, 9:48am UTC](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232/1 "2022-05-09T09:48:05Z")

</div>

Hello,

I would like to add fields in **\_source** by using **fields** config, and also I tested with pocessors.  
But I don't even see the fields that I wanted to add

**Processors config**

```auto
processors:
  - add_fields:
      target: _source
      fields:
        env: staging
        agent:
          type: agent.type
          version: agent.version
          ephemeral_id: agent.ephemeral_id
          id: agent.id
          name: agent.name

```

**Fields config**

```auto
fields_under_root: true #I also tried with false
fields:
  env: staging
  agent:
    type: agent.type
    version: agent.version
    ephemeral_id: agent.ephemeral_id
    id: agent.id
    name: agent.name

```

And here is a screenshot of the result in Kibana

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/8/98a153883c09be984b0fe96e94d17a2fc26262de.png)  
Thank you for your help, I really need this, it's been 4 days I am on it

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2022, 1:46am UTC](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232/2 "2022-05-10T01:46:27Z")

</div>

`_source` is an Elasticsearch concept and doesn't apply for Beats at that level of ingest.

I would try adding it to `message` instead, as it will then show up in `_source` when it gets to Elasticsearch,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2022, 3:46am UTC](https://discuss.elastic.co/t/add-fields-do-not-work-winlogbeat/304232/3 "2022-06-07T03:46:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.