# Adding custom fields doesn't work in Winlogbeat

**URL:** <https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 18, 2018, 4:19pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588 "2018-07-18T16:19:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [July 18, 2018, 4:19pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588/1 "2018-07-18T16:19:15Z")

</div>

Hi,

I am trying to add custom fields and I don't see field added to the event. Winlogbeat logs show following logs

`WARN EventLog[CustomLog] Open() error. No events will be read from this source. The specified channel could not be found. Check channel configuration.`

Here is what I am using,

```
winlogbeat.event_logs:
  - name: Application
    level: error
  
  - name: CustomLog
    fields:
      test_field: webserver

```

Can someone please say what the issue might be

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 18, 2018, 9:41pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588/2 "2018-07-18T21:41:12Z")

</div>

It looks like `CustomLog` is not a valid event log. You can run `Get-EventLog *` in PowerShell to get a list of valid event logs. Have you read through [Configuring Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-configuration.html#winlogbeat-configuration)? It contains detailed information on this topic.

If your goal was to add fields to `Application` logs, you may want to simply try adding your `fields` declaration to the `Application` config block, like so:

```auto
winlogbeat.event_logs:
  - name: Application
    level: error
    fields:
      test_field: webserver

```

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [July 23, 2018, 3:33pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588/3 "2018-07-23T15:33:09Z")

</div>

Thanks Andrew. Will try it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 3:33pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588/4 "2018-08-20T15:33:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.