# Can't put http\_endpoint messages to root
**URL:** https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527
**Category:** Beats
**Tags:** filebeat
**Created:** [November 30, 2021, 8:55am UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527 "2021-11-30T08:55:19Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@uhfath](https://discuss.elastic.co/u/uhfath)
#### Post date: [November 30, 2021, 8:55am UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/1 "2021-11-30T08:55:19Z")
Here is my config:
```auto
filebeat.inputs:
- type: http_endpoint
enabled: true
listen_address: 127.0.0.1
listen_port: 20000
response_code: 204
response_body: null
prefix: null
fields:
app_name: "MedService.UI"
fields_under_root: true
processors:
- timestamp:
field: Timestamp
layouts:
- '2006-01-02T15:04:05.999999999Z07:00'
- drop_fields:
fields: [Timestamp]
setup.ilm:
enabled: false
rollover_alias: "filebeat"
pattern: "{now/M{yyyy.MM}}-000001"
policy_name: "filebeat"
setup.template:
type: index
name: "filebeat"
pattern: "filebeat-*"
logging.level: warning
```
I'm trying to transfer log messages from a filebeat's http endpoint to Elastic instance.
The messages transfers fine, except they are all prefixed with "json" which I wanted to avoid and place them at the root level.
This is how it works with `log` input:
```auto
- type: log
enabled: true
paths:
- logs\*.log
json:
keys_under_root: true
json.overwrite_keys: true
fields:
app_name: "MedService.API"
fields_under_root: true
```
Using this config my messages are all placed at the root level.
However, when using `http_endpoint` input there is no such parameter.
When setting `prefix` to "" or '' the messages just stop showing up in Kibana.
When changing `prefix` to something like "logs" the messages are correctly prefixed with "logs".
When setting `prefix` to something like `null` or just leave it empty, then default "json" appears in messages as a prefix.
Is it possible to place my logs at the root level using `http_endpoint` input?
---
### Author:  [@uhfath](https://discuss.elastic.co/u/uhfath)
#### Post date: [November 30, 2021, 9:19am UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/2 "2021-11-30T09:19:45Z")
Taking a wild guess here since I'm not a Golang expert in any way but could it be that [this](https://github.com/elastic/beats/blob/fd322dad6ceafec40c84df4d2a0694ea357d16cc/x-pack/filebeat/input/http_endpoint/handler.go#L66) is the source of the issue?
```auto
func (h *httpHandler) publishEvent(obj common.MapStr, headers common.MapStr) {
event := beat.Event{
Timestamp: time.Now().UTC(),
Fields: common.MapStr{
h.messageField: obj, // when setting `prefix` (aka `messageField`) to empty this might not work since the field will be empty, or does Go allow this?
},
}
if h.preserveOriginalEvent {
event.PutValue("event.original", obj.String())
}
if len(headers) > 0 {
event.PutValue("headers", headers)
}
h.publisher.Publish(event)
}
```
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [December 1, 2021, 5:37am UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/3 "2021-12-01T05:37:37Z")
Ur correct, see [beats/config.go at master · elastic/beats · GitHub](https://github.com/elastic/beats/blob/master/x-pack/filebeat/input/http_endpoint/config.go). if u don't set a field name it will default to `json`. It doesn't look like you'll be able to have the fields at the root unless you move each field individually using processors.
---
### Author:  [@uhfath](https://discuss.elastic.co/u/uhfath)
#### Post date: [December 8, 2021, 1:49pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/4 "2021-12-08T13:49:27Z")
Could it be a bug or just by design?
I think it would be logical to make all inputs with similar functionality to work, well, similarly.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [December 8, 2021, 2:09pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/5 "2021-12-08T14:09:10Z")
Its by design. All the other inputs put the message/data initially in the `message` field prior to being parsed. This is essentially the same thing. You can use Filebeat or Elasticsearch ingest processors to move the fields to where you want them.
---
### Author:  [@uhfath](https://discuss.elastic.co/u/uhfath)
#### Post date: [December 8, 2021, 2:38pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/6 "2021-12-08T14:38:41Z")
Thanks.
I guess "this is the way".
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2022, 4:39pm UTC](https://discuss.elastic.co/t/cant-put-http-endpoint-messages-to-root/290527/7 "2022-01-05T16:39:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.