# Cannot mutate message in filebeat index created with index template

**URL:** <https://discuss.elastic.co/t/cannot-mutate-message-in-filebeat-index-created-with-index-template/232723>\
**Category:** Logstash\
**Created:** [May 14, 2020, 10:59pm UTC](https://discuss.elastic.co/t/cannot-mutate-message-in-filebeat-index-created-with-index-template/232723 "2020-05-14T22:59:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tihomir\_Ilchev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tihomir_ilchev/32/64988_2.png) [@Tihomir\_Ilchev](https://discuss.elastic.co/u/Tihomir_Ilchev)\
**Post date:** [May 14, 2020, 10:59pm UTC](https://discuss.elastic.co/t/cannot-mutate-message-in-filebeat-index-created-with-index-template/232723/1 "2020-05-14T22:59:03Z")

</div>

Hello,  
I cannot mutate a message and add a field if the index is created from a template, having a lifecycle policy.  
The pipeline that I am using is:

```auto
input {
        beats {
                client_inactivity_timeout => 3000
                port => 5044
                ssl => false
                type => "beats"
        }
}

## Add your filters / logstash plugins configuration here
filter {
        mutate {
          add_tag => ["INFO"]
          add_field => {"log.message.type" => "INFO"}
        }
    }

output {
        if [type] == "beats"{
	  elasticsearch {
		hosts => "localhost:9200"
	        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
	  }
        } 
}

```

The filebeat index, index template, and lifecycle policy are created by uncommenting the following lines in filebeat.yml file:

```auto
    #-------------------------- Elasticsearch output ------------------------------
    output.elasticsearch:
      # Array of hosts to connect to.
      hosts: ["localhost:9200"]

```

If I comment out the lines above and remove the template and the lifecycle policy, the fields are added successfully to the message.

Can you help me to understand what could be the reason?

Thanks!

---

<div class="post-metadata">

**Author:** ![Tihomir\_Ilchev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tihomir_ilchev/32/64988_2.png) [@Tihomir\_Ilchev](https://discuss.elastic.co/u/Tihomir_Ilchev)\
**Post date:** [May 14, 2020, 11:56pm UTC](https://discuss.elastic.co/t/cannot-mutate-message-in-filebeat-index-created-with-index-template/232723/2 "2020-05-14T23:56:07Z")

</div>

I tried with  
`add_field => {"[log][message][type]" => "INFO"}`  
But the result is the same

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2020, 11:56pm UTC](https://discuss.elastic.co/t/cannot-mutate-message-in-filebeat-index-created-with-index-template/232723/3 "2020-06-11T23:56:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.