# Filebeat: field "log.file" - is empty

**URL:** <https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 7, 2019, 5:05pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295 "2019-08-07T17:05:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![maxozerov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxozerov/32/48068_2.png) [@maxozerov](https://discuss.elastic.co/u/maxozerov)\
**Post date:** [August 7, 2019, 5:05pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295/1 "2019-08-07T17:05:35Z")

</div>

Hi There,  
Hope you are good.  
Help to understand what is the reason

```
# Custom filebeat-module
- module: my-service
  ## Requests logs
  requests:
    enabled: true
    var.paths: ["/var/lib/lxd/containers/ZZ/rootfs/var/www/logs/requests.log", "/var/lib/lxd/containers/YY/rootfs/var/www/logs/requests_se.log"]
    var.input: "file"

```

And Then in Kibana I see:

```
{
    "log": {
      "file": {},
      "offset": 1079568
}

```

So what kind of log filebeat is processed??  
Why field - log.file - is null? (empty)

`filebeat version 7.1.0 (amd64), libbeat 7.1.0 [03b3db2a1d9d76fdf10475e829fce436c61901e4 built 2019-05-15 23:59:19 +0000 UTC]`

Thx

---

<div class="post-metadata">

**Author:** ![maxozerov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxozerov/32/48068_2.png) [@maxozerov](https://discuss.elastic.co/u/maxozerov)\
**Post date:** [August 8, 2019, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295/2 "2019-08-08T13:16:04Z")

</div>

- i'm check - all pipelines (for example removed fields) - and nothings

`_ingest/pipeline?pretty` - 'remove.field' is not present

Just try it (field: log.file) on non-custom-module case?  
Ok.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 8, 2019, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295/3 "2019-08-08T13:46:02Z")

</div>

Could you please share the debug logs?

---

<div class="post-metadata">

**Author:** ![maxozerov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxozerov/32/48068_2.png) [@maxozerov](https://discuss.elastic.co/u/maxozerov)\
**Post date:** [August 8, 2019, 2:29pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295/4 "2019-08-08T14:29:54Z")

</div>

@kvch thx!

Sorry, I seem to have missed the deletion field twice! o\_O  
I’ll check it again!

I saw it in the debug log:

```
Aug 08 16:15:51 HOSTNAME filebeat[25031]: 
2019-08-08T16:15:51.128+0200 DEBUG [processors] processing/processors.go:108
Fail to apply processor global{drop_fields=offset, beat.name, input.type, prospector, beat.version, log.file.path}: key not found, key not found, key not found, key not found
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2019, 2:30pm UTC](https://discuss.elastic.co/t/filebeat-field-log-file-is-empty/194295/5 "2019-09-05T14:30:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.