# Can't Send @metadata to elasticsearch

**URL:** https://discuss.elastic.co/t/cant-send-metadata-to-elasticsearch/123066
**Category:** Logstash
**Created:** [March 8, 2018, 12:46pm UTC](https://discuss.elastic.co/t/cant-send-metadata-to-elasticsearch/123066 "2018-03-08T12:46:33Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![manya12](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@manya12](https://discuss.elastic.co/u/manya12)
#### Post date: [March 8, 2018, 12:46pm UTC](https://discuss.elastic.co/t/cant-send-metadata-to-elasticsearch/123066/1 "2018-03-08T12:46:33Z")

</div>

Hi Team,  
I want to include @metadata field contents in my elasticsearch output.  
This is the output when i am using stdout in my output filter-  
{  
"@timestamp" =\> 2018-03-08T08:17:42.059Z,  
"thread\_name" =\> "SimpleAsyncTaskExecutor-2",  
"@metadata" =\> {  
"dead\_letter\_queue" =\> {  
"entry\_time" =\> 2018-03-08T08:17:50.082Z,  
"reason" =\> "Could not index event to Elasticsearch. status: 400, action: ["index", {:\_id=\>nil, :\_index=\>"applog-2018.03.08", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x3ab79ab5], response: {"index"=\>{"\_index"=\>"applog-2018.03.08", "\_type"=\>"doc", "\_id"=\>"POuwBGIB0PJDPQOoDy1Q", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [message]", "caused\_by"=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Can't get text on a START\_OBJECT at 1:223"}}}}",  
"plugin\_type" =\> "elasticsearch",  
"plugin\_id" =\> "7ee60ceccc2ef7c933cf5aa718d42f24a65b489e12a1e1c7b67ce82e04ef0d37"  
}  
},  
"@version" =\> "1",  
"beat" =\> {  
"name" =\> "filebeat-kwjn6",  
"version" =\> "6.0.0"  
},  
"dateOffset" =\> 408697,  
"source" =\> "/var/log/applogs/spring-cloud-dataflow/Log.log",  
"logger\_name" =\> "decurtis.dxp.deamon.JobConfiguration",  
"message" =\> {  
"timeStamp" =\> "2018-01-30",  
"severity" =\> "ERROR",  
"hostname" =\> "",  
"commonUtility" =\> {},  
"offset" =\> "Etc/UTC",  
"messageCode" =\> "L\_9001",  
"correlationId" =\> "ea5b13c3-d395-4fa5-8124-19902e400316",  
"componentName" =\> "dxp-deamon-refdata-country",  
"componentVersion" =\> "1",  
"message" =\> "Unhandled exceptions",  
},  
"tags" =\> [  
[0] "webapp-log",  
[1] "beats\_input\_codec\_plain\_applied",  
[2] "\_jsonparsefailure"  
]  
}

I want my @metadata field in elasticsearch output.  
Below is my conf file:  
input {  
dead\_letter\_queue {  
path =\> "/usr/share/logstash/data/dead\_letter\_queue"  
commit\_offsets =\> true  
pipeline\_id =\> "main"  
}  
}  
filter {  
json {  
source =\> "message"  
}  
mutate {  
rename =\> { "[@metadata][dead\_letter\_queue][reason]" =\> "reason" }  
}  
}

output {  
elasticsearch {  
hosts =\> "elasticsearch"  
manage\_template =\> false  
index =\> "deadletterlog-%{+YYYY.MM.dd}"  
}  
}  
Now in my output there is a field called "reason" but without any content. Is there something i am missing.  
I got idea to rename that field from [Sending @metadata from logstash to elastic search](https://discuss.elastic.co/t/sending-metadata-from-logstash-to-elastic-search/92890) . @magnusbaeck Can you please help me with this? Is there something i am missing.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 5, 2018, 12:46pm UTC](https://discuss.elastic.co/t/cant-send-metadata-to-elasticsearch/123066/2 "2018-04-05T12:46:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
