# Fields/tag set custom fields in filebeat, but logstash gives error

**URL:** https://discuss.elastic.co/t/fields-tag-set-custom-fields-in-filebeat-but-logstash-gives-error/209086
**Category:** Beats
**Tags:** filebeat
**Created:** [November 22, 2019, 4:01pm UTC](https://discuss.elastic.co/t/fields-tag-set-custom-fields-in-filebeat-but-logstash-gives-error/209086 "2019-11-22T16:01:21Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [November 22, 2019, 4:01pm UTC](https://discuss.elastic.co/t/fields-tag-set-custom-fields-in-filebeat-but-logstash-gives-error/209086/1 "2019-11-22T16:01:22Z")

</div>

What is the right way for version 7.4 to add feilds in filebeat and then connect it with logstash.conf file so each log file has its own index created in ES?

Below is logstash.conf

```auto
input {
  beats {
    port => 5044
  }
}
filter {
    if[type] =="DispatcherApp"{
		grok {
			match => {"message" => "%{COMBINEDAPACHELOG}"}
        }
	} else if [type] == "IncidentAgent" {
        grok {
            match => { "message" => "%{COMBINEDAPACHELOG}" }
        }
    }
	  
  }

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
	sniffing => true
	manage_template => false
       index => "dispatcher-%{+YYYY.MM.dd}"
	#index => "web-%{type}"
	#document_type => "log"
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

```

And here is filebeat.yml

```auto
filebeat.inputs:
    -
      paths:
         - E:\DemoSetup\DispatcherApp\logs\dispatcher-scheduler.log
      input_type: log
      fields:
        dispatcher: true
      fields_under_root: true
           
    -  
      paths:
         - E:\DemoSetup\Incident Agent\Logs\Trace.log
      input_type: log
       fields:
        trace: true
      fields_under_root: true
           
    setup.template.name: "index-%{[beat.version]}"
    setup.template.pattern: "index-%{[beat.version]}-*"       

output:
  logstash:
    hosts: ["localhost:5044"]	

```

@andrewkroh I read your pull from github but the document\_type and formaating there is for older version and doesnt create separate index in ES. Thanks for your help in advance.

> <https://github.com/elastic/beats/pull/1092>

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2019, 4:01pm UTC](https://discuss.elastic.co/t/fields-tag-set-custom-fields-in-filebeat-but-logstash-gives-error/209086/2 "2019-12-20T16:01:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.