# Filebeat 6.0.0 prospectors and fields
**URL:** https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602
**Category:** Beats
**Tags:** filebeat
**Created:** [December 7, 2017, 3:59am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602 "2017-12-07T03:59:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@panic](https://discuss.elastic.co/u/panic)
#### Post date: [December 7, 2017, 3:59am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602/1 "2017-12-07T03:59:54Z")
Hi,
I'm currently using filebeat 5.6.5 to extract data from specific log types with using the following configuration:
```
filebeat.prospectors:
- type: log
paths:
- /logfiles/x.log
fields:
document_type: x
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
- type: log
paths:
- /logfiles/y.log
fields:
document_type: y
- type: log
paths:
- /logfiles/z.log
fields:
document_type: z
```
The output in 5.6.5 looks something like this:
```
{"@timestamp":"2017-12-07T03:37:45.936Z","beat":{"hostname":"aaa","name":"aaa","version":"5.6.5"},"fields":{"document_type":"x"},"source":"/logfiles/x.log"}
{"@timestamp":"2017-12-07T03:37:45.936Z","beat":{"hostname":"aaa","name":"aaa","version":"5.6.5"},"fields":{"document_type":"y"},"source":"/logfiles/y.log"}
{"@timestamp":"2017-12-07T03:37:45.936Z","beat":{"hostname":"aaa","name":"aaa","version":"5.6.5"},"fields":{"document_type":"z"},"source":"/logfiles/z.log"}
```
Using the same configuration in 6.0.0 I end up with all of the document\_type fields being set as "z" for all unique sources. (also the output is a lot messier... the fields aren't necessarily in the same order)
```
{"@timestamp":"2017-12-07T01:19:48.018Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.0.0"},"source":"/logfiles/x.log","prospector":{"type":"log"},"fields":{"document_type":"z"},"beat":{"name":"aaa","hostname":"aaa","version":"6.0.0"}}
{"@timestamp":"2017-12-07T01:19:48.018Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.0.0"},"source":"/logfiles/y.log,"prospector":{"type":"log"},"fields":{"document_type":"z"},"beat":{"name":"aaa","hostname":"aaa","version":"6.0.0"}}
{"@timestamp":"2017-12-07T01:19:48.018Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.0.0"},"prospector":{"type":"log"},"fields":{"document_type":"z"},"beat":{"version":"6.0.0","name":"aaa","hostname":"aaa"},"source":"/logfiles/z.log}
```
It just seems to set the last value... I believe this is a bug?
Has something changed in the way fields are handled?
I looked up the reference, but from what I can tell, it should work.
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [December 7, 2017, 5:09am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602/2 "2017-12-07T05:09:29Z")
You are hitting this issue here: [https://github.com/elastic/beats/pull/5808](https://github.com/elastic/beats/pull/5808)
---
### Author:  [@panic](https://discuss.elastic.co/u/panic)
#### Post date: [December 7, 2017, 5:35am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602/3 "2017-12-07T05:35:27Z")
Ah, thanks ruflin!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2018, 5:36am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602/4 "2018-01-04T05:36:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.