# Custom fields.yml not loaded

**URL:** <https://discuss.elastic.co/t/custom-fields-yml-not-loaded/371583>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 6, 2024, 9:29am UTC](https://discuss.elastic.co/t/custom-fields-yml-not-loaded/371583 "2024-12-06T09:29:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\
**Post date:** [December 6, 2024, 9:29am UTC](https://discuss.elastic.co/t/custom-fields-yml-not-loaded/371583/1 "2024-12-06T09:29:51Z")

</div>

I have changed the mapping of a field in `fields.yml` and saved it as `fields-patched.yml` in `C:\Program Files\Winlogbeat\`.  
In `winlogbeat.yml`, I have set this:  
`setup.template.fields: "${path.config}/fields-patched.yml"`  
I then stop Winlogbeat service, delete the current datastream from Elasticsearch, and start Winlogbeat again.  
But my field definition is not used.  
What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 6, 2024, 2:21pm UTC](https://discuss.elastic.co/t/custom-fields-yml-not-loaded/371583/2 "2024-12-06T14:21:04Z")

</div>

> [@Benjamin\_Gathmann](#):
>
> I then stop Winlogbeat service, delete the current datastream from Elasticsearch, and start Winlogbeat again.

You would also need need to delete the winlogbeat template (e.g. `DELETE _index_template/winlogbeat-8.16.0`) otherwise I don't think it will overwrite the existing template.

---

<div class="post-metadata">

**Author:** ![Benjamin\_Gathmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_gathmann/32/7561_2.png) [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\
**Post date:** [December 6, 2024, 2:54pm UTC](https://discuss.elastic.co/t/custom-fields-yml-not-loaded/371583/3 "2024-12-06T14:54:23Z")

</div>

Thank you so much!  
This would have taken me a long time to find out by myself 🙂