# Beat.name not populated with logstash output **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [May 19, 2017, 12:30pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419 "2017-05-19T12:30:31Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![christiaanvanaken](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christiaanvanaken/32/18359_2.png) [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Post date:** [May 19, 2017, 12:30pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/1 "2017-05-19T12:30:32Z")
Data from Metricbeat is send to my central Logstash server and from there the output goes to Elasticsearch. If I do this, the field [beat.name](http://beat.name) is always empty. If I change the Metricbeat configuration to send it to Elasticsearch directly, the field [beat.name](http://beat.name) is correctly filled in with the hostname. I followed the manual for installing and configuring Metricbeat. Please help! ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 19, 2017, 12:56pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/2 "2017-05-19T12:56:46Z")
Please share your beat version, beat config, LS config, LS version. ---
**Author:** ![christiaanvanaken](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christiaanvanaken/32/18359_2.png) [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Post date:** [May 19, 2017, 1:17pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/3 "2017-05-19T13:17:41Z")
metricbeat version 5.4.0 logstash 5.4.0 **file /etc/metricbeat/metricbeat.yml:** #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts hosts: ["monserver:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate\_authorities: ["/etc/metricbeat/certificate.crt"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" **file /etc/logstash/conf.d/02-metricbeat.conf:** input { beats { port =\> 5044 codec =\> "json\_lines" ssl =\> true ssl\_certificate =\> "/etc/logstash/certificate.crt" ssl\_key =\> "/etc/logstash/certificate.key" } } output { elasticsearch { hosts =\> "localhost:9200" manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 22, 2017, 10:34am UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/4 "2017-05-22T10:34:33Z")
Why do you use the json codec? ---
**Author:** ![christiaanvanaken](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christiaanvanaken/32/18359_2.png) [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Post date:** [May 22, 2017, 7:00pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/5 "2017-05-22T19:00:52Z")
Well it does not matter if I put it in there or not. Either way it does give me the [beat.name](http://beat.name). ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 23, 2017, 1:10pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/6 "2017-05-23T13:10:28Z")
Can you enable the ruby debug output on LS to see if the events you receive that the [beat.name](http://beat.name) set in it? ---
**Author:** ![christiaanvanaken](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christiaanvanaken/32/18359_2.png) [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Post date:** [May 24, 2017, 12:46pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/7 "2017-05-24T12:46:08Z")
output received {"event"=\>{"@timestamp"=\>2017-05-24T12:48:18.417Z, "system"=\>{"process"=\>{"memory"=\>{"rss"=\>{"pct"=\>0.0009, "bytes"=\>3497984}, "size"=\>224391168, "share"=\>2859008}, "cmdline"=\>"/usr/local/psa/admin/bin/modules/watchdog/monit -Ic /usr/local/psa/etc/modules/watchdog/monitrc", "pgid"=\>824, "name"=\>"monit", "cpu"=\>{"start\_time"=\>"2017-05-02T22:03:36.000Z", "total"=\>{"pct"=\>0.0}}, "pid"=\>824, "state"=\>"sleeping", "fd"=\>{"limit"=\>{"hard"=\>4096, "soft"=\>1024}, "open"=\>5}, "ppid"=\>1, "username"=\>"root"}}, "host"=\>"", "metricset"=\>{"rtt"=\>55135, "module"=\>"system", "name"=\>"process"}, "GeoLocation"=\>{}}} I suppressed the real hostname, but it looks like the beat stuff is not coming to LS. ---
**Author:** ![christiaanvanaken](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christiaanvanaken/32/18359_2.png) [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Post date:** [May 24, 2017, 7:47pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/8 "2017-05-24T19:47:02Z")
Problem solved, my mistake. I have more then one inpuf defined so I needed to add some tags to make sure the right filters and outputs are used. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 21, 2017, 7:47pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419/9 "2017-06-21T19:47:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.