# Configuring dynamic facility with gelf output plugin **URL:** \ **Category:** Logstash\ **Created:** [August 25, 2015, 5:46pm UTC](https://discuss.elastic.co/t/configuring-dynamic-facility-with-gelf-output-plugin/28043 "2015-08-25T17:46:03Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![danieljamesscott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danieljamesscott/32/47151_2.png) [@danieljamesscott](https://discuss.elastic.co/u/danieljamesscott)\ **Post date:** [August 25, 2015, 5:46pm UTC](https://discuss.elastic.co/t/configuring-dynamic-facility-with-gelf-output-plugin/28043/1 "2015-08-25T17:46:03Z")
Hi, I'm forwarding logstash messages to graylog using the gelf output plugin. I would like to send the facility to graylog, which I have available as a field called 'application' in logstash. The documentation says that using the 'facility' field is deprecated and that it "Should now be sent as an underscored "additional field" (e.g. \_facility)". My question, is how do I configure logstash to send this 'additional' field? I can see references to 'additional field' in the gelf documentation, but not in logstash, so I'm not sure how to achieve this. Things I have tried: 1. Using the mutate filter, with 'add\_field =\> {"facility" =\> %{application}}'. 2. Using custom\_fields in the output plugin 'custom\_fields =\> {"facility": %{application}" I have also tried replacing facility with '\_facility', but graylog does not show the correct facility. For now, I'm still using the deprecated "facility =\> %{application}" method, but I'd like to know the correct way to do this going forward. Thanks, Dan ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/configuring-dynamic-facility-with-gelf-output-plugin/28043/2 "2017-07-06T05:30:56Z")
Closed on July 6, 2017, 5:30am UTC