# Custom field (filebeat) in condition in logstash filter

**URL:** <https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761>\
**Category:** Logstash\
**Created:** [December 6, 2020, 7:23am UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761 "2020-12-06T07:23:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arp220](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arp220/32/84666_2.png) [@arp220](https://discuss.elastic.co/u/arp220)\
**Post date:** [December 6, 2020, 7:23am UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761/1 "2020-12-06T07:23:05Z")

</div>

I have this config in filebeat.yml:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  fields_under_root: true
  fields:
    service_name: "nginx"
##### OutPut #######
output.logstash:
  hosts: ["x.x.x.x:5044"]

```

and in logstash config:

```auto
input {
   beats {
     port => 5044
   }
}
filter {
    if [fields][service_name] == 'nginx' {
        json { source => "message" }
      }
}
output {
    if [fields][service_name] == 'nginx' {
        elasticsearch {
        hosts => ["https://x.x.x.x:9200"]
        user => "user"
        password => "password"
        index => "logstash_nginx"
        cacert => "/usr/share/logstash/config/elasticsearch-ca.pem"
        ssl_certificate_verification => false
    }
        stdout{ codec => rubydebug }
  }
}

```

But nothing happens!? Where is my mistake? filebeat config or logstash config?  
thanks.  
\*\*\*\*\*\*\*\* Update \*\*\*\*\*\*\*  
when I disable `if` in logstash config, filebeat sends the field correctly (service\_name).  
So, why logstash `if` not work?

thanks.

---

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [December 6, 2020, 8:28am UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761/2 "2020-12-06T08:28:06Z")

</div>

I think you to debug step by step

1. Remove all the filter entries and see if you can see the data inside elasticsearch or stdout
2. Check carefully for the field names, especially if the field name is. `fields.service_name` (which I don't think it is)
3. Then finding the correct field name and put the `if` condition accordingly or try other fields to see

my experience, always shows test with no filters, then build it upwards, so you can fine tune.

---

<div class="post-metadata">

**Author:** ![arp220](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arp220/32/84666_2.png) [@arp220](https://discuss.elastic.co/u/arp220)\
**Post date:** [December 6, 2020, 9:22am UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761/3 "2020-12-06T09:22:57Z")

</div>

@kelk thanks.  
I disable `if` and look structure log in elstiacsearch and I see `service_name` is a root structure because I use `fields_under_root: true`. So I remove `[fields]` in logstash config. as a result

 ![json-structure](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef30f67e1f4abdccf3482a47a0042199e8979870.png)  
filebeat.yml is:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  fields_under_root: true
  fields:
    service_name: "nginx"

```

and logstash config is:

```auto
input {
   beats {
     port => 5044
   }

}
filter {

    if [service_name] == "nginx" {
        json { source => "message" }
         mutate { remove_field => ["@version", "message","log", "port", "tags","@timestamp", "input", "ecs", "[agent][ephemeral_id]", "[agent][id]","[agent][name]","[agent][type]", "[agent][version]" ] }
      }
}

output {

    if [service_name] == "nginx" {
        elasticsearch {
        hosts => ["https://x.x.x.x:9200"]
        user => "user"
        password => "password"
        index => "logstash_nginx"
        cacert => "/usr/share/logstash/config/elasticsearch-ca.pem"
        ssl_certificate_verification => false
    }
  }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 6, 2020, 3:48pm UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761/5 "2020-12-06T15:48:57Z")

</div>

\_source is an elasticsearch construct, it does not exist in logstash.

```
if [service_name] == "nginx" {

```

would be correct provided that field\_under\_root is true.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2021, 3:48pm UTC](https://discuss.elastic.co/t/custom-field-filebeat-in-condition-in-logstash-filter/257761/6 "2021-01-03T15:48:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.