# Allocate a type in filebeat

**URL:** <https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 14, 2018, 7:16am UTC](https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853 "2018-12-14T07:16:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [December 14, 2018, 7:16am UTC](https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853/1 "2018-12-14T07:16:50Z")

</div>

I am facing a issue my filebeat config is

filebeat.prospectors:

- input\_type: log  
paths:
  - /home/rdave/Desktop/ELK/\*  
fields:  
document\_type: test  
multiline:  
pattern: '^{"+\w[a-z]'  
negate: true  
match: before  
output.logstash:  
hosts: ['localhost:5044']

I have defined a type to the logs but in kibana I am getting a field which is

fields.document\_type test

I only want document\_type not fields.documents\_type.

A help would be really appreciated

Regards

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [December 17, 2018, 3:57pm UTC](https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853/2 "2018-12-17T15:57:06Z")

</div>

Hello @shrikantgulia, You actually want to use the `fields` option with `fields_under_root`, see our [doc](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-fields)

It would something like this:

```auto
filebeat.inputs:
- type: log
  . . .
  fields:
    document_type: test
  fields_under_root: true 

```

---

<div class="post-metadata">

**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Post date:** [December 18, 2018, 5:04am UTC](https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853/3 "2018-12-18T05:04:13Z")

</div>

@pierhugues Thankyou for the response

I am facing this issue after adding the line  
"fields\_under\_root": true

[root@localhost filebeat-6.2.4-linux-x86\_64]# sudo ./filebeat  
Exiting: error loading config file: config file ("filebeat.yml") must be owned by the beat user (uid=0) or root

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2019, 5:04am UTC](https://discuss.elastic.co/t/allocate-a-type-in-filebeat/160853/4 "2019-01-15T05:04:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.