# Customizing source field

**URL:** <https://discuss.elastic.co/t/customizing-source-field/59423>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 31, 2016, 12:49pm UTC](https://discuss.elastic.co/t/customizing-source-field/59423 "2016-08-31T12:49:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![budm](https://avatars.discourse-cdn.com/v4/letter/b/dc4da7/32.png) [@budm](https://discuss.elastic.co/u/budm)\
**Post date:** [August 31, 2016, 12:49pm UTC](https://discuss.elastic.co/t/customizing-source-field/59423/1 "2016-08-31T12:49:26Z")

</div>

I use filebeat with Graylog and noticed that in there `source` is always set to `admin` even if I override it with

```
fields:
   source: srcm

```

I also tried to set it in the top-level prospector configuration as

```
-
   #some config
   source: srcm
   #other config

```

How to customize it?

Specifying

`fields_under_root: true`

does not work as well.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 31, 2016, 2:32pm UTC](https://discuss.elastic.co/t/customizing-source-field/59423/2 "2016-08-31T14:32:16Z")

</div>

Can you please share your full config file and the filebeat version you are using?

---

<div class="post-metadata">

**Author:** ![budm](https://avatars.discourse-cdn.com/v4/letter/b/dc4da7/32.png) [@budm](https://discuss.elastic.co/u/budm)\
**Post date:** [September 1, 2016, 7:20am UTC](https://discuss.elastic.co/t/customizing-source-field/59423/3 "2016-09-01T07:20:41Z")

</div>

No problem.  
`filebeat version 1.2.3 (amd64)`

filebeat-test.yml:

```
filebeat:                                                                                            
    prospectors:                                                                                       
       -                                                                                                
         paths:                                                                                         
           - /path/to/log/file                                                       
         input_type: log                                                                                
         fields_under_root: true                                                                        
         source: srcm                                                                                   
         multiline:                                                                                     
               pattern: '_pattern_'        
               negate: true⋅                                                                                
               match: after                                                                                 
         fields:                                                                                        
               source: srcm                                                                                 
               #other project-specific properties
       registry_file: /var/lib/filebeat/registry                                                          
    output:                                                                                              
        logstash:                                                                                          
             hosts: ["0.0.0.0:5044"]                                                                          
    logging:                                                                                             
        files:                                                                                              
             rotateeverybytes: 10485760                        

```

I have tried some variations with setting the `source` field like with or without `fields_under_root` set to true, setting it as a top-level prospector field and so forth, but it doesn't work. How to override it? Maybe that's a graylog issue?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [September 2, 2016, 7:34am UTC](https://discuss.elastic.co/t/customizing-source-field/59423/4 "2016-09-02T07:34:28Z")

</div>

I think the problem is with the name `source`. This field is already used for the filename source. But if you use it under fields without `fields_under_root` it should work.

Can you run filebeat with `-e -d "publish"` and check if the `fields.source` shows up? If yes, it is probably graylog specifc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2016, 12:49pm UTC](https://discuss.elastic.co/t/customizing-source-field/59423/5 "2016-09-21T12:49:48Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.