# Coexistence with logstash-forwarder

**URL:** https://discuss.elastic.co/t/coexistence-with-logstash-forwarder/33632
**Category:** Beats
**Tags:** filebeat
**Created:** [November 3, 2015, 1:22pm UTC](https://discuss.elastic.co/t/coexistence-with-logstash-forwarder/33632 "2015-11-03T13:22:18Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Cylindric](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cylindric/32/5660_2.png) [@Cylindric](https://discuss.elastic.co/u/Cylindric)
#### Post date: [November 3, 2015, 2:54pm UTC](https://discuss.elastic.co/t/coexistence-with-logstash-forwarder/33632/3 "2015-11-03T14:54:51Z")

</div>

Ah, okay that's easy then. That seems to be working, because I have a new index with that name. My next problem is the 'type' being set. If I hook up `stdout { codec => rubydebug}` I get two types defined, and I think my filter is looking at the _other_ one.

A sample from my debug log:

```
{
    "message" => "2015-11-03 14:43:14 W3SVC12 ca-web04 10.117.1.14 GET /test.jpg - 80 - 10.117.1.22 useragent - domain 200 0 0 9369 452 29 1.2.3.4 http",
    "@version" => "1",
    "@timestamp" => "2015-11-03T14:44:26.376Z",
    "count" => 1,
    "fields" => {
        "type" => "iis"
    },
    "fileinfo" => {},
    "input_type" => "",
    "line" => 4,
    "offset" => 1763763,
    "shipper" => "MarkDesktop",
    "source" => "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex151103_x.log",
    "type" => "log"
}

```

So it looks like my filebeat.yml is just adding a field that happens to be called type to the data, rather than setting the actual type (which defaults to "log")

```
# filebeat.yml
filebeat:
  prospectors:
    -
      paths:
        - "C:/inetpub/logs/LogFiles/W3SVC1/*.log"
      fields:
        type: iis

output:
  elasticsearch:
    enabled: false

  logstash:
    enabled: true
    hosts: ["logstash:5044"]

shipper:

```

Could I perhaps be having a related problem as this post: [Misleading type attribute in filebeat config](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/3)? Maybe I need to wait for RC1.

---

_[View the full topic](https://discuss.elastic.co/t/coexistence-with-logstash-forwarder/33632)._