# Cannot see parsed fields in kibana dashboard
**URL:** https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624
**Category:** Kibana
**Created:** [September 24, 2018, 6:42am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624 "2018-09-24T06:42:09Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@pramodchoudhari](https://discuss.elastic.co/u/pramodchoudhari)
#### Post date: [September 24, 2018, 6:42am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/1 "2018-09-24T06:42:10Z")
**This is my logstash.conf file:-**
input {
beats {
port =\> 5044
}
}
filter {
if [log\_type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
if ("\_grokparsefailure" in [tags]) { drop {} }
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
sniffing =\> true
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
**This is my Filebeat.yml file:-**
filebeat:
prospectors:
-
paths:
- /var/log/auth.log
- /var/log/syslog
# - /var/log/\*.log
```
input_type: log
fields:
log_type: syslog
```
registry\_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["107.109.101.20:5044"]
bulk\_max\_size: 1024
I cannot see syslog\_timestamp, syslog\_hostname , syslog\_program, syslog\_pid , syslog\_message in the fields column in kibana.All I could see is the message as it is in the dashboard
I have gone through many topics discussed on your website but i'm stuck please help!
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 24, 2018, 6:45am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/2 "2018-09-24T06:45:14Z")
If you look at the event in Kibana, you can see that this field is really named `fields.log_type` and not just `log_type`. You therefore need to change your conditional as follows:
```auto
if [fields][log_type] == "syslog" {
```
---
### Author:  [@pramodchoudhari](https://discuss.elastic.co/u/pramodchoudhari)
#### Post date: [September 24, 2018, 6:52am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/3 "2018-09-24T06:52:55Z")
It worked thank you very much @Christian_Dahlqvist
---
### Author:  [@pramodchoudhari](https://discuss.elastic.co/u/pramodchoudhari)
#### Post date: [September 24, 2018, 6:58am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/4 "2018-09-24T06:58:09Z")
Also @Christian_Dahlqvist can you please tell me what is the use of this section of code in logstash.conf file?
```
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 24, 2018, 7:02am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/5 "2018-09-24T07:02:16Z")
It parses the `syslog_timestamp` field based on the specified patterns and populates the `@timestamp` field.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2018, 7:02am UTC](https://discuss.elastic.co/t/cannot-see-parsed-fields-in-kibana-dashboard/149624/6 "2018-10-22T07:02:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.