# Fields Input

**URL:** <https://discuss.elastic.co/t/fields-input/147406>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 5, 2018, 12:20pm UTC](https://discuss.elastic.co/t/fields-input/147406 "2018-09-05T12:20:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Goyal.vikas87](https://avatars.discourse-cdn.com/v4/letter/g/9fc348/32.png) [@Goyal.vikas87](https://discuss.elastic.co/u/Goyal.vikas87)\
**Post date:** [September 5, 2018, 12:20pm UTC](https://discuss.elastic.co/t/fields-input/147406/1 "2018-09-05T12:20:39Z")

</div>

I want to to add a custom field in my all events using FIELDS input in filebeat.yml. Please confirm how I can parameterize the value of the custom field and if possible can I extractt some part of the \_source field of the event.

For example:

\_source of event 1 = /a/b/job\_id1  
\_source of event 2= /a/b/job\_id2

Expected output of fields values:

Say custom field defined in filebeat.yml is JOB ID.

Event 1:  
JOB ID = job\_id1

Event 2:  
JOB ID = job\_id2

Please help me if above scenarios can be achieved and if yea then how.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 5, 2018, 12:41pm UTC](https://discuss.elastic.co/t/fields-input/147406/2 "2018-09-05T12:41:40Z")

</div>

Yes you can. There is the doc on how you can refer fields from events: [https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#\_format\_string\_sprintf](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#_format_string_sprintf)

May I ask why do you want to add `source` field to your events? It's already added to every event by Filebeat. So there is no need to add it to your config.

---

<div class="post-metadata">

**Author:** ![Goyal.vikas87](https://avatars.discourse-cdn.com/v4/letter/g/9fc348/32.png) [@Goyal.vikas87](https://discuss.elastic.co/u/Goyal.vikas87)\
**Post date:** [September 5, 2018, 12:46pm UTC](https://discuss.elastic.co/t/fields-input/147406/3 "2018-09-05T12:46:25Z")

</div>

I do not want to add complete source field but want to extract part of it in other custom field. In my case, source field is different in every event and want to extract that different part in my custom field using parameter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 3, 2018, 12:46pm UTC](https://discuss.elastic.co/t/fields-input/147406/4 "2018-10-03T12:46:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.