# Conflict between Filebeat and Packetbeat fields

**URL:** <https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453>\
**Category:** Beats\
**Created:** [August 9, 2017, 2:16pm UTC](https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453 "2017-08-09T14:16:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bobby](https://avatars.discourse-cdn.com/v4/letter/b/df788c/32.png) [@Bobby](https://discuss.elastic.co/u/Bobby)\
**Post date:** [August 9, 2017, 2:16pm UTC](https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453/1 "2017-08-09T14:16:56Z")

</div>

Filebeat logs have a **string** field called "source" which is the filepath to the file that the filebeat log is coming from.

Packetbeat logs of type "flow" have an **object** field called"source" which has the properties ip, port, stats, and mac.

I ran into a situation where both of these beats were writing to the same elasticsearch instance. When I tried to look up logs in Kibana, I couldn't find filebeat logs, but found log entries with an "indexed-failed-reason": that reads as follows:

"type":"illegal\_argument\_exception","reason":"[source] is defined as a field in mapping [log] but this name is already used for an object in other types"

I feel like the default fields for all the beats shouldn't conflict with each other. Would it be possible to change either of the field names here?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 9, 2017, 10:14pm UTC](https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453/2 "2017-08-09T22:14:28Z")

</div>

By default packetbeat data goes to a daily index following the pattern of packetbeat-YYYY.MM.DD and filebeat goes to filebeat-YYYY.MM.DD. There should never be mapping conflicts between data stored in two different indices. Did you customize the index patterns in your config?

---

<div class="post-metadata">

**Author:** ![Bobby](https://avatars.discourse-cdn.com/v4/letter/b/df788c/32.png) [@Bobby](https://discuss.elastic.co/u/Bobby)\
**Post date:** [August 10, 2017, 2:15pm UTC](https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453/3 "2017-08-10T14:15:33Z")

</div>

I am using the ELK stack through a third party that provides it as a service. (So they manage logstash, elasticsearch, kibana, etc, and I have beats installed on my machines that send the logs to their servers)

Your hunch is correct, their setup uses a single index per account, which is why this conflict occurred. Thank you for this insight!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2017, 2:17pm UTC](https://discuss.elastic.co/t/conflict-between-filebeat-and-packetbeat-fields/96453/4 "2017-08-30T14:17:28Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.