# Filebeat lotstash output and 'exported fields'
**URL:** https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796
**Category:** Beats
**Tags:** filebeat
**Created:** [February 14, 2018, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796 "2018-02-14T12:40:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nathharp](https://discuss.elastic.co/u/nathharp)
#### Post date: [February 14, 2018, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796/1 "2018-02-14T12:40:54Z")
Hi all,
I am planning our migration from our ageing rsyslog(RELP) \> logtash \> elasticsearch with a new set of infrastructure.
I have been experimenting with filebeat \> logstash \> elasticsearch but I'm not getting the message granularity that I was hoping for.
Using filebeat \> elasticsearch I get lots of wonderful exported fields with loads of useful information. However, if I set filebeat with logstash output all this appears to be lost, and I just get everything lumped into the message field.
Is this expected behaviour? I know I can grok the output, but I was hoping save that for just additional insights or filtering
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 14, 2018, 2:38pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796/2 "2018-02-14T14:38:15Z")
You don't mention if you were using Filebeat modules when sending Filebeat -\> Elasticsearch, but I suspect that you were based on the experience you describe.
Unfortunately FIlebeat modules don't yet work with Logstash because they use Ingest Node in Elasticsearch to parse. See the note here: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html)
An equivalent Logstash filter setup to the Filebeat system module is provided [here](https://www.elastic.co/guide/en/logstash/6.2/logstash-config-for-filebeat-modules.html#parsing-system). You can add this to your Logstash config.
---
### Author:  [@nathharp](https://discuss.elastic.co/u/nathharp)
#### Post date: [February 14, 2018, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796/3 "2018-02-14T14:57:10Z")
Ah yes, I did miss that. You are correct, I am using filebeat modules.
Thank you for confirming, and particularly the logstash filter example, that will help out significantly.
---
### Author:  [@nathharp](https://discuss.elastic.co/u/nathharp)
#### Post date: [February 16, 2018, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796/4 "2018-02-16T15:36:11Z")
Finally got a chance to test. This does exactly what I was after, many thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2018, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796/5 "2018-03-16T15:36:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.