# Filebeat doc has both message and error.message fields

**URL:** <https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528>\
**Category:** Elasticsearch\
**Created:** [July 24, 2020, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528 "2020-07-24T15:06:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![srpine](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@srpine](https://discuss.elastic.co/u/srpine)\
**Post date:** [July 24, 2020, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528/1 "2020-07-24T15:06:37Z")

</div>

I installed filebeat on several of my elastic cluster nodes and I am seeing docs from the (node)\_server.json that have both a message field and an error.message field complaining about Provided Grok expressions do not match field value with the message information as well.

Is this normal?  
If not how do I fix this?

Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2020, 3:19pm UTC](https://discuss.elastic.co/t/filebeat-doc-has-both-message-and-error-message-fields/242528/2 "2020-08-21T15:19:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.