# Adding fields containg a log-level?
**URL:** https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840
**Category:** Beats
**Tags:** filebeat
**Created:** [August 11, 2016, 4:59pm UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840 "2016-08-11T16:59:30Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@budm](https://discuss.elastic.co/u/budm)
#### Post date: [August 11, 2016, 4:59pm UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/1 "2016-08-11T16:59:30Z")
In our project we use logback with the following log-back pattern:
`%date{ISO8601} [%thread] %-5level %logger{25} - %message%n`
I.e. all log messages have a format like this:
`2013-03-10 10:14:16,458 [default-dispatcher-21] ERROR - __SOME_DETAILS__ `
or
`2015-11-04 15:15:26,458 [event-thread] INFO - __OTHER_DETAILS__ `
I'd like to provide some kind of filtering depending on the log-level . The obvious idea which first came to mind was to just add
```
fields:
level: debug # <--- How do I know that?
```
or something like this.
The problem is it's not clear how to extract the log level form the message. Is it ever possible? I can specify the `multilline:pattern:`, but how to extract level from it?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 11, 2016, 5:31pm UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/2 "2016-08-11T17:31:50Z")
Filebeat doesn't do this kind of parsing, but Logstash does. Even better is to configure Logback to emit JSON logs so that nobody has to do any parsing (although JSON support is only available in the upcoming Filebeat 5).
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 11, 2016, 9:56pm UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/3 "2016-08-11T21:56:15Z")
If you want to filter out 'early' in filebeat there is an `exclude/include_lines` option in filebeat. Potential pattern can be ' [.+] INFO - ' to capture INFO log-level messages. This is some pre-filtering support to reduce network usage. Logstash provides additional parsing + filtering capabilities.
---
### Author:  [@budm](https://discuss.elastic.co/u/budm)
#### Post date: [August 12, 2016, 8:29am UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/4 "2016-08-12T08:29:43Z")
This does not quite fit. I wanted to store an additional log-level field into elastic in order to facilitate indexing and filtering with logstash. This was the reason I wanted to do this parsing on filebeat's side.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 12, 2016, 8:35am UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/5 "2016-08-12T08:35:11Z")
Your flow is Filebeat -\> Elasticsearch -\> Logstash? That doesn't appear to make sense. What comes after Logstash?
---
### Author:  [@budm](https://discuss.elastic.co/u/budm)
#### Post date: [August 12, 2016, 8:39am UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/6 "2016-08-12T08:39:49Z")
Filebeat--\>Graylog--\>Elasticsearch, but as far as I understood graylog does pretty much the same as logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 12, 2016, 8:42am UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/7 "2016-08-12T08:42:03Z")
Okay. So what's the problem with parsing things in Graylog and sending the results to ES?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2016, 4:59pm UTC](https://discuss.elastic.co/t/adding-fields-containg-a-log-level/57840/8 "2016-09-01T16:59:43Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.