# Filebeat fields are not working
**URL:** https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155
**Category:** Logstash
**Created:** [March 1, 2018, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155 "2018-03-01T21:11:02Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@red888](https://discuss.elastic.co/u/red888)
#### Post date: [March 1, 2018, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155/1 "2018-03-01T21:11:02Z")
Here is my filebeat config:
```
filebeat.prospectors:
- type: log
paths:
- C:/inetpub/app01/logs/IIS/*/*.log
fields:
app_group: iis
app_id: app01
- type: log
paths:
- C:/inetpub/app02/logs/IIS/*/*.log
fields:
app_group: iis
app_id: app02
- type: log
paths:
- C:/inetpub/app03/logs/IIS/*/*.log
fields:
app_group: iis
app_id: app03
output:
logstash:
hosts: ["myserver:7777"]
```
And here is logstash:
```
input {
beats {
port => 7777
}
}
filter {
if [fields][app_group] == "iis" {
.... do my parsing ...
}
}
output {
if [fields][app_group] == "iis" {
elasticsearch {
hosts => "mycluster"
index => "logstash-iis-%{[fields][app_id]}-%{+YYYY-MM-dd}"
}
} else {
elasticsearch {
hosts => "mycluster"
index => "uncategorized"
}
}
}
```
They are all getting pushed into my "uncategorized" index which means the fields aren't getting applied or if [fields][app\_group] is wrong or something. I can't find any example with setting multiple fields and having logstash access them
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2018, 9:34pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155/2 "2018-03-01T21:34:04Z")
Both configurations look OK to me. You don't have fields\_under\_root set in filebeat, right?
I suggest you look at the events in elasticsearch and make sure they really do have [fields][app\_group] set.
---
### Author:  [@red888](https://discuss.elastic.co/u/red888)
#### Post date: [March 1, 2018, 9:34pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155/3 "2018-03-01T21:34:59Z")
yeah i don't have fields\_under\_root set. Should i be able to see the "fields" for the events in kibana?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 1, 2018, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155/4 "2018-03-01T21:54:21Z")
Yes. Look at [this post](https://discuss.elastic.co/t/parse-sonarqube-logs/122130/3?u=badger) for an example.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2018, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-fields-are-not-working/122155/5 "2018-03-29T21:54:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.