# Filebeat overwrites log file source field

**URL:** <https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 13, 2016, 10:39am UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233 "2016-04-13T10:39:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![indreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/indreek/32/46368_2.png) [@indreek](https://discuss.elastic.co/u/indreek)\
**Post date:** [April 13, 2016, 10:39am UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233/1 "2016-04-13T10:39:10Z")

</div>

I have a log file with data  
"event": "response",  
"timestamp": 1460542601136,  
"id": "1460542601136:tw-api-test:11613:imx8v2w8:10545",  
"instance": "[http://127.0.0.1:3000](http://127.0.0.1:3000)",  
"labels": ["api"],  
"method": "post",  
"path": "/calculator/calculate",  
"query": {},  
"responseTime": 108,  
"statusCode": 200,  
"pid": 11613,  
"httpVersion": "1.0",  
"source": {  
"remoteAddress": "127.0.0.1",  
"userAgent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36",  
"referer": "[http://devel/](http://devel/)"  
}  
But elastic gets  
"event":"response",  
"timestamp":1460538299188,  
"id":"1460538299188:tw-api-test:11613:imx8v2w8:10362",  
"instance":"[http://127.0.0.1:3000](http://127.0.0.1:3000)",  
"labels":["api"],  
"method":"post",  
"path":"/calculator/calculate",  
"query":{},  
"responseTime":65,  
"statusCode":200,  
"pid":11613,  
"httpVersion":"1.0",  
"source":"/opt/api/logs/api.tavexwise.com/general/request-20160413-0000-db9723d1f2.log",

Filebeat exports field source what overwrites my source. Is it possible to rename one of them? Ex filebeat export\_field source field to log\_file etc?

Thanks,  
Indrek

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 13, 2016, 12:09pm UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233/2 "2016-04-13T12:09:08Z")

</div>

you send via logstash? In logstash you use json codec or json filter?

---

<div class="post-metadata">

**Author:** ![indreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/indreek/32/46368_2.png) [@indreek](https://discuss.elastic.co/u/indreek)\
**Post date:** [April 13, 2016, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233/3 "2016-04-13T12:47:12Z")

</div>

Yes, logstash.  
My current conf is

input {  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate =\> "/etc/ssl/logstash/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/ssl/logstash/private/logstash-forwarder.key"  
codec =\> json  
}  
}

#filter {

# mutate {

# rename =\> {

# "source" =\> "logfile"

# }

# }

#}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
#index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
index =\> "%{[@metadata][beat]}"  
document\_type =\> "%{[@metadata][type]}"  
}  
stdout {  
codec =\> json  
}  
}

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 13, 2016, 7:26pm UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233/4 "2016-04-13T19:26:55Z")

</div>

you might want to use the json filter instead of codec. Have mutate filter renaming source to logfile before applying the json filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-overwrites-log-file-source-field/47233/5 "2017-07-05T21:53:19Z")

</div>