# Beats input w/ json codec

**URL:** <https://discuss.elastic.co/t/beats-input-w-json-codec/120060>\
**Category:** Logstash\
**Created:** [February 15, 2018, 7:22pm UTC](https://discuss.elastic.co/t/beats-input-w-json-codec/120060 "2018-02-15T19:22:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshday](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@joshday](https://discuss.elastic.co/u/joshday)\
**Post date:** [February 15, 2018, 7:22pm UTC](https://discuss.elastic.co/t/beats-input-w-json-codec/120060/1 "2018-02-15T19:22:10Z")

</div>

So I know events coming from filebeat into logstash have a "source" field related to the full path of the file. The problem is my json file that I am sending will occasionally also have a 'source' field, which seems to behave in inconsistent ways. Previously (version 6.1 I think) I could rename 'source' field from JSON to keep that (dropping filebeat file path 'source') but now in 6.2 I can only get the filebeat 'source' field and cannot access JSON 'source' field. Any ideas?

For reference, I'm ingesting JSON bro logs (files.log)

---

<div class="post-metadata">

**Author:** ![joshday](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@joshday](https://discuss.elastic.co/u/joshday)\
**Post date:** [February 20, 2018, 9:57pm UTC](https://discuss.elastic.co/t/beats-input-w-json-codec/120060/2 "2018-02-20T21:57:53Z")

</div>

I'll just add that for some fields with collisions I get behavior that makes sense (I keep the field values from JSON input) but other times I keep the filebeat fields instead. For example, when `host` is present in JSON and from filebeat I get to keep JSON value but when `source` is present in both I get to keep the filebeat value.

---

<div class="post-metadata">

**Author:** ![joshday](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@joshday](https://discuss.elastic.co/u/joshday)\
**Post date:** [February 26, 2018, 1:50pm UTC](https://discuss.elastic.co/t/beats-input-w-json-codec/120060/3 "2018-02-26T13:50:05Z")

</div>

Fixed this problem by writing a bro script to add an additional field in files.log that is a copy of 'source' field. Source below if anyone's interested.

```auto
export {
	redef record Files::Info += {
		file_source: string &optional &log;
	};
}
event file_state_remove(f: fa_file) &priority=3
{
  # add 'file_source' if 'source' exists
  if ( f$info?$source )
  	f$info$file_source = f$info$source;
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2018, 1:50pm UTC](https://discuss.elastic.co/t/beats-input-w-json-codec/120060/4 "2018-03-26T13:50:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.