# Filebeat is sending the empty value to logstash for the paramters configured in filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 9, 2018, 5:37am UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632 "2018-08-09T05:37:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![swethamahesh](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Post date:** [August 9, 2018, 5:37am UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/1 "2018-08-09T05:37:25Z")
Hi, Further to my discussion in the logstash forum regarding the junk directory getting created by logstash. It is conveyed that filebeat is sending the data empty, Hence logstash is writing the directory with junk name. FYI: [The Junk log directory created in logstash is invalid](https://discuss.elastic.co/t/the-junk-log-directory-created-in-logstash-is-invalid/141821) Can you please let us know why the paramters are sent empty from filebeat to logstash. Thanks In Advance, Swetha. M ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 9, 2018, 7:40pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/2 "2018-08-09T19:40:52Z")
Please provide your configuration and a debug log of filebeat so we can diagnose the issue. Run filebeat with `-d '*'` and paste the log and configuration here enclosed in triple backticks: ``` like this ``` ---
**Author:** ![swethamahesh](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Post date:** [August 14, 2018, 9:18am UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/3 "2018-08-14T09:18:30Z")
Hi Adrisr, please find the configuration below: ```auto filebeat.prospectors: input_type: log paths: /var/log/oes.log encoding: utf-8 fields_under_root: true document_type: log fields: service_name: ops app_name: oes ======================General======= registry_file: /var/lib/filebeat/registry fields_under_root: true fields: vnf_id: instance_id: xyz component_name: yz The service_name, app_name, vnf_id, instance_id and component_name is used in logstash configuration for creating the directory. ................................................................................................................................. Logstash.conf file is as below: output { if [service_name] == "ops" and [component_name] == "yz" { file{ path => "/var/log/store/%{vnf_id}/%{instance_id}/%{service_name}/%{app_name}_%{+yyyy-MM-dd-HH}.log.gz" codec => line { format => "%{message}, %{vnf_id}, %{instance_id}, %{component_name}, %{app_name}" } gzip => true } } ``` should i have to run filebeat -d '\*' and reproduce the issue to collect logs? Thanks, Swetha. M ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 14, 2018, 9:33am UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/4 "2018-08-14T09:33:05Z")
To understand your configuration I would need that you pasted it respecting the original indentation. Nonetheless, this seems wrong: ```auto fields: vnf_id: instance_id: xyz component_name: yz ``` `vnf_id` has no value, thus is not sent to Logstash. ---
**Author:** ![swethamahesh](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Post date:** [August 14, 2018, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/5 "2018-08-14T16:19:41Z")
Hi Adrisr, We keep the vnfd\_id value empty parameter in filebeat.yml during bootup where filebeat service is stopped. Later, we configure the filebeat.yml with values for vnf\_id, instance\_id and component\_name parameters with appropriate values and restart the filebeat. In this case we see the folder at logstash is created as %{vnf\_id}/ which is wrong We have also tried keep some default value such as vnf\_id: LSDL-1 and we configure filebeat.yml with proper value such as vnf\_id:LSDL-1 to vnf\_id:SDL then restart filebeat service. then we see the folder created with default value as LSDL-1/ even this is wrong. Basically if the parameter vnf\_id is empty or filled with any default value, we see the directory is created with the same. I request you to please help me how to over some this problem. Thanks, Swetha. M ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 14, 2018, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/6 "2018-08-14T17:24:14Z")
Can you run filebeat with the `-d publish` argument and share the logs with us? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 11, 2018, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-empty-value-to-logstash-for-the-paramters-configured-in-filebeat/143632/7 "2018-09-11T17:24:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.