# Custom fields.yml

**URL:** <https://discuss.elastic.co/t/custom-fields-yml/178879>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 29, 2019, 9:27am UTC](https://discuss.elastic.co/t/custom-fields-yml/178879 "2019-04-29T09:27:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aksadvance](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@aksadvance](https://discuss.elastic.co/u/aksadvance)\
**Post date:** [April 29, 2019, 9:27am UTC](https://discuss.elastic.co/t/custom-fields-yml/178879/1 "2019-04-29T09:27:02Z")

</div>

Hi,

- I have defined template in ES via \_template api.
- Created index also , having mapping as per above template.  
Now i want to feed data hence i have setup filebeat -\> Logstash -\> ES.  
I have created dummy data as per index mapping and pass as a source to filebeat.

End to end data flow happening but with below issue:-

I am getting my dummy data in "message":"\<\>" property of filebeat template and updating index mapping also . My question is how to handle this issue,i dont want the filebeat fields in this index.

1. Write a gork in Logstash to get the dummy data from "message" property?
2. Can we pass the same(defined in ES via api) template to file beat and not use fields.yml?
3. Is it possible to convert template.json into \*.yml via some utility?

Please suggest.  
Regards  
Ajay

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 29, 2019, 12:56pm UTC](https://discuss.elastic.co/t/custom-fields-yml/178879/2 "2019-04-29T12:56:09Z")

</div>

fields.yml files are the input to the index mapping generator of Beats. If you already deployed your own index and do not want any additional fields from Beats, just don't set `setup.template.enabled` to `false`. Make sure to set the `index` option of your configured input, so Filebeat forwards it to the appropriate index.

---

<div class="post-metadata">

**Author:** ![aksadvance](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@aksadvance](https://discuss.elastic.co/u/aksadvance)\
**Post date:** [April 30, 2019, 6:48am UTC](https://discuss.elastic.co/t/custom-fields-yml/178879/3 "2019-04-30T06:48:06Z")

</div>

hi,  
after setting setup.template.enabled: false , stilling getting filebeat fields in document.

I am sending logs like filebeat -\> logstash -\> ES so i think index info i have provided in logstash.

After enabling json.keys\_under\_root: true and one json object in one line in log, i can see the dummy data in document but some extra filebeat fields are still coming.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2019, 6:48am UTC](https://discuss.elastic.co/t/custom-fields-yml/178879/4 "2019-05-28T06:48:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.