# Additional field for winlogbeat **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [July 27, 2017, 6:26am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750 "2017-07-27T06:26:12Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 27, 2017, 6:26am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/1 "2017-07-27T06:26:12Z")
Is there a way that I can append data or field in winlog? Let's say I have a csv file which consists of 5 data. Can I append this everytime windows logs are sent thru beats? TIA ---
**Author:** ![Oozza](https://avatars.discourse-cdn.com/v4/letter/o/76d3ee/32.png) [@Oozza](https://discuss.elastic.co/u/Oozza)\ **Post date:** [July 27, 2017, 6:34am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/2 "2017-07-27T06:34:47Z")
It is possible to add tags or a new field. [Docs here.](https://www.elastic.co/guide/en/beats/winlogbeat/5.5/configuration-general.html#libbeat-configuration-fields) ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 27, 2017, 6:58am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/3 "2017-07-27T06:58:11Z")
Thank you for your response @Oozza. Yes, I already saw this but how can I get data from the external file like text file or csv? Seems that I really need to pre-configure the field. hmmm. Let's say I want to include the computername, the some user details and some info which you can find in csv. How can i able to include this info on winlogevents? ---
**Author:** ![Oozza](https://avatars.discourse-cdn.com/v4/letter/o/76d3ee/32.png) [@Oozza](https://discuss.elastic.co/u/Oozza)\ **Post date:** [July 27, 2017, 7:25am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/4 "2017-07-27T07:25:27Z")
I think winlogbeat won't do it for you. You will probably need to find some workaround or make a new beat. ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 27, 2017, 10:47am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/5 "2017-07-27T10:47:19Z")
Yes, probably i need to find another log forwarder of windows events. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 27, 2017, 2:56pm UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/6 "2017-07-27T14:56:42Z")
You can reference environment variables from the config, but you would need some way to inject the data from the file into environment variable of the service which doesn't seem simple. If you are able to do some development you could create a custom [processor](https://www.elastic.co/guide/en/beats/winlogbeat/6.0/defining-processors.html) to enrich events with data from a file. We have some similar processors that enrich events with metadata coming from other sources [like docker](https://github.com/elastic/beats/blob/master/libbeat/processors/add_docker_metadata/add_docker_metadata.go). You could create one that reads a JSON file and adds those fields to outgoing events. Something like ```auto processors: - add_json_metadata: file: 'C:/host_metadata.json' target: beat.meta ``` ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 28, 2017, 2:13am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/7 "2017-07-28T02:13:25Z")
Thank you for your reply @andrewkroh. I'll gonna try that ๐Ÿ™‚ ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 28, 2017, 1:24pm UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/8 "2017-07-28T13:24:36Z")
And BTW you don't need to fork beats to implement this. You can build your own winlogbeat binary by having a minimalistic main package that registers your custom processor. ```auto package main import ( "os" "github.com/elastic/beats/winlogbeat/cmd" // Register custom processors. _ "github.com/jogoinar/beats-json-metadata" ) func main() { if err := cmd.RootCmd.Execute(); err != nil { os.Exit(1) } } ``` ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [July 29, 2017, 7:28pm UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/9 "2017-07-29T19:28:31Z")
hmmm.. thanks for your input @andrewkroh.. but I'm new to beats and i don't know where to put this? I'll include this on the config file? Is this how to make a custom processor? Thanks again. ๐Ÿ‘ ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 1, 2017, 1:02am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/10 "2017-08-01T01:02:02Z")
> [@jogoinar10](#): > > Iโ€™m new to beats and i donโ€™t know where to put this? This task of adding a custom processor to read data from a JSON file requires some software development work. It requires you to build a customized version of Winlogbeat. The [developer guide](https://www.elastic.co/guide/en/beats/libbeat/current/new-beat.html) is helpful to show how to build a beat, but it doesn't go into processors (for that use the existing ones as a guide). > [@andrewkroh](#): > > If you are able to do some development you could create a custom processor If you aren't up for development then please open an enhancement request for a new "add\_json\_metadata" processor in the project's repo on Github. ---
**Author:** ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Post date:** [August 1, 2017, 1:33am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/11 "2017-08-01T01:33:25Z")
Thank you @andrewkroh. I'll check this one ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2017, 1:33am UTC](https://discuss.elastic.co/t/additional-field-for-winlogbeat/94750/12 "2017-08-29T01:33:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.