# Filebeat for just forwarding Full text log
**URL:** https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697
**Category:** Beats
**Tags:** filebeat
**Created:** [November 25, 2020, 5:48pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697 "2020-11-25T17:48:12Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 25, 2020, 5:48pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/1 "2020-11-25T17:48:12Z")
Hello team,
Is there any way using filebat (7.10), for just forwarding logs ?
The main goals is :
- shipping log from differents sources (file log text)
- forward them to another (file log text), without do any changes inside
i will also remove the metadata from filebeat !!
here my config file :
```
filebeat.inputs:
- type: log
paths:
- /ines-logs-nfs/syslog-ng/uaaifnd11rou01/LogFonct.log
- /ines-logs-nfs/syslog-ng/uaaifnd11rou02/LogFonct.log
output.file:
path: "/ines-logs-nfs/syslog-ng/"
filename: all.log
permissions: 0600
```
Any ideas about this ??
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [November 26, 2020, 5:42am UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/2 "2020-11-26T05:42:51Z")
Sure, you can do this. And you can use the [`drop_fields` processor](https://www.elastic.co/guide/en/beats/filebeat/master/drop-fields.html) to remove any unwanted fields from events before they are sent to the output.
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 26, 2020, 11:39am UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/3 "2020-11-26T11:39:11Z")
@shaunak thanks for replying !
i have tested this in my config file, but didn't work !! filebeat service failed
```
processors:
- drop_fields:
when:
has_fields:
fields: ["log.offset", "input.type", "fileset.name"]
ignore_missing: false
```
any idea ?
Regards
sai
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 26, 2020, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/4 "2020-11-26T13:14:58Z")
i have changed the configuration (drop\_fields) to
```
processors:
- drop_fields:
fields: ["log.offset", "input.type", "fileset.name", "log.source.address", "log.flags"]
```
but didn't works, i still show on the output file the medatada (tomestamps version, beat etc ....) 😕
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 26, 2020, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/5 "2020-11-26T13:31:30Z")
i can summarize here, what i need .
see below the output generated by filebeat :
`{"@timestamp":"2020-11-26T13:19:24.149Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.10.0"},"log":{"file":{"path":"/logs-nfs/syslog-ng/XXXX/appli.log"}},"message":"2020-11-26T14:19:23+01:00 servermaster CORE: TimeStamp=\"2020-11-26 14:19:23.560\" TraceID=\"TIDcb28e32379fd73bdbe896cqsdsdd979ffc\" LogType=\"APPLI_LOG\" MessType=\"QUEING\" StateInd=\"0\" ErrCode=\"0\" ErrMess=\"Operation successful\" Serial=\"TID04b55dab01dsdfdsac13141b\" TicketNBR=\"4\"","input":{},"agent":{"hostname":"filebeatserver","ephemeral_id":"2488c327-71c6-4bcb-a747-eee5b86190a0","id":"91f74f15-737a-42df-b5d7-c629b3dd9e74","name":"filebeatserver","type":"filebeat","version":"7.10.0"},"ecs":{"version":"1.6.0"},"host":{"name":"filebeatserver"}}`
the needed is to keep just this part of output , and remove the rest :
`2020-11-26T14:19:23+01:00 servermaster CORE: TimeStamp=\"2020-11-26 14:19:23.560\" TraceID=\"TIDcb28e32379fd73bdbe896cqsdsdd979ffc\" LogType=\"APPLI_LOG\" MessType=\"QUEING\" StateInd=\"0\" ErrCode=\"0\" ErrMess=\"Operation successful\" Serial=\"TID04b55dab01dsdfdsac13141b\" TicketNBR=\"4\"`
many thanks for helps
sai
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 27, 2020, 10:45am UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/6 "2020-11-27T10:45:58Z")
any help plz ??
sai
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [November 30, 2020, 3:10am UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/7 "2020-11-30T03:10:12Z")
I think you need to include `@metadata` in your `drop_fields` processor's `fields` setting? Also, the `@timestamp` field cannot be dropped, as noted in the processor's documentation: [https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html](https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html)
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [November 30, 2020, 11:08am UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/8 "2020-11-30T11:08:24Z")
hi ,
@metadata in drop\_fields didn't resolve the pb 😕
you think it is a bug ?
regards
---
### Author:  [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)
#### Post date: [December 1, 2020, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/9 "2020-12-01T16:49:14Z")
any with this plz ?
Regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2020, 6:49pm UTC](https://discuss.elastic.co/t/filebeat-for-just-forwarding-full-text-log/256697/10 "2020-12-29T18:49:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.