# Create new Filebeat

**URL:** <https://discuss.elastic.co/t/create-new-filebeat/246081>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 24, 2020, 9:19am UTC](https://discuss.elastic.co/t/create-new-filebeat/246081 "2020-08-24T09:19:28Z")\
**Posts on this page:** 1\
**Showing post:** 18

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [September 21, 2020, 10:42am UTC](https://discuss.elastic.co/t/create-new-filebeat/246081/18 "2020-09-21T10:42:35Z")

</div>

Hey @saffatechy,

I have taken a look to your module and it needs some changes:

- `thread` and `category` need to be prefixed with `bizswitch`.
- `timestamp` should be parsed and stored in `@timestamp`.
- Log message should be stored in `message`, or at least in a known field.
- `loglevel` should be stored in `log.level` (or in some known field).

Find here a patch with some changes that work for me:

```auto
diff --git a/filebeat/module/bizswitch/log/ingest/pipeline.json b/filebeat/module/bizswitch/log/ingest/pipeline.json
index 43bf104344..d9b674433b 100644
--- a/filebeat/module/bizswitch/log/ingest/pipeline.json
+++ b/filebeat/module/bizswitch/log/ingest/pipeline.json
@@ -8,13 +8,21 @@
         "grok": {
           "field": "message",
           "patterns":
-["%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} (%{SPACE})?(?<thread>(%{IP}[:]%{INT})?(-)?(Thread-%{INT})?(\\(%{INT}\\)-)?%{WORD}(:%{WORD})?([\\-])?(%{SPACE})?(([a-zA-Z]+)?(%{SPACE})?(%{WORD})?([:])?)(%{INT})?([:])?(%{INT})?([\\-])?(%{INT})?) \\[%{WORD:category}\\] %{GREEDYDATA:bizlog}"],
+["%{TIMESTAMP_ISO8601:_tmp.timestamp} %{LOGLEVEL:log.level} (%{SPACE})?(?<bizswitch.thread>(%{IP}[:]%{INT})?(-)?(Thread-%{INT})?(\\(%{INT}\\)-)?%{WORD}(:%{WORD})?([\\-])?(%{SPACE})?(([a-zA-Z]+)?(%{SPACE})?(%{WORD})?([:])?)(%{INT})?([:])?(%{INT})?([\\-])?(%{INT})?) \\[%{WORD:bizswitch.category}\\] %{GREEDYDATA:message}"],
           "ignore_missing": true
           }
         },
+ {
+ "date": {
+ "field": "_tmp.timestamp",
+ "target_field": "@timestamp",
+ "formats": ["yyyy-MM-dd HH:mm:ss,SSS"],
+ "timezone": "{{ event.timezone }}"
+ }
+ },
         {
           "remove": {
- "field": "message"
+ "field": "_tmp"
           }
         }
     ],

```

---

_[View the full topic](https://discuss.elastic.co/t/create-new-filebeat/246081)._