# Create field in Filebeat as Logstash
**URL:** https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680
**Category:** Beats
**Tags:** filebeat
**Created:** [August 10, 2016, 9:54am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680 "2016-08-10T09:54:33Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@fdlprod](https://discuss.elastic.co/u/fdlprod)
#### Post date: [August 10, 2016, 9:54am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/1 "2016-08-10T09:54:33Z")
HI,
i have now logs read from filebeat and they are less cut than logstash , indeed in logstash for example i have the LOG LEVEL field and not in filebeat, how can i proceed to have it please ?
and the new
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 10, 2016, 9:57am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/2 "2016-08-10T09:57:00Z")
Filebeat does not parse the log entries, so it is common to send them through Logstash for this type of processing.
---
### Author:  [@fdlprod](https://discuss.elastic.co/u/fdlprod)
#### Post date: [August 10, 2016, 9:59am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/3 "2016-08-10T09:59:29Z")
thanks, yes but i have 2 problems,
1. Logstash forwarder is deprecated ( and handler logstash is not good solution because use rescource and have to modify server)
2. if i use handler i can"t know from what JVM the log come from...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 10:44am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/4 "2016-08-10T10:44:07Z")
If you use the `fields` option that I pointed you to an hour ago, what problem remains?
---
### Author:  [@fdlprod](https://discuss.elastic.co/u/fdlprod)
#### Post date: [August 10, 2016, 11:27am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/5 "2016-08-10T11:27:15Z")
Hi,
it is not the same issue there is one hour ago is add a field for i know what logs is associated with wat JVM, here i have an information like LOG level in the message i want as a field like logstash... but in message sent there is not the field i want
2016-08-10T11:31:54+02:00 DBG Publish: {
"@timestamp": "2016-08-10T09:31:54.201Z",
"beat": {
"hostname": "rs-tst-int-02",
"name": "rs-tst-int-02"
},
"count": 1,
"fields": null,
"input\_type": "log",
"message": "\tjava:app/AofWeb/EntityService!com.real.aof.business.service.EntityService",
"offset": 45708,
"source": "C:\dev\servers\wildfly-9.0.2.Final\domain\servers\server-two\log\server.log",
"type": "log"
}
or thread name, or thread ID , or logger class all those informations are in the message
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2016, 11:39am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/6 "2016-08-10T11:39:48Z")
First of all you should use Filebeat's multiline feature to join the multilined Java log messages into single events.
Secondly, just as Christian said earlier Filebeat (and logstash-forwarder) doesn't support parsing of message text and extraction of additional fields. You need to use Logstash (or a similar tool).
---
### Author:  [@fdlprod](https://discuss.elastic.co/u/fdlprod)
#### Post date: [August 10, 2016, 12:04pm UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/7 "2016-08-10T12:04:02Z")
thank you it is what i wanted to know. I worked on a POC and i think it can be used later.
thank you !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2016, 9:54am UTC](https://discuss.elastic.co/t/create-field-in-filebeat-as-logstash/57680/8 "2016-08-31T09:54:34Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.