# Filebeat overwriting log.level and log.logger

**URL:** <https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 12, 2019, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548 "2019-11-12T15:11:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Heatzone87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heatzone87/32/57088_2.png) [@Heatzone87](https://discuss.elastic.co/u/Heatzone87)\
**Post date:** [November 12, 2019, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/1 "2019-11-12T15:11:42Z")

</div>

I have my application logger below:

```auto
{"@timestamp":"2019-11-12T16:05:05.407636Z","log":{"level":"INFO","logger":"audit"}

```

However when i run Filebeat in debug mode i notice that my keys are gone and replace with the file pointers:

```auto
2019-11-12T16:05:15.305+0100	DEBUG	[processors]	processing/processors.go:183	Publish event: {
  "@timestamp": "2019-11-12T15:05:15.305Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.4.2"
  },
  "log": {
    "offset": 32778,
    "file": {
      "path": "/app/data/log/audit.log"
    }
  },

```

My filebeat config overall is pretty basic:

```auto
#=========================== Filebeat inputs =============================

filebeat.inputs:

- type: log
  enable: true
  paths:
    - /app/data/log/**/*.log
  json.keys_under_root: true
  json.add_error_key: true
  fields:
    application: myapp

#================================ Processors =====================================
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - timestamp:
      field: '@timestamp'
      timezone: CET
      layouts:
        - '2006-01-02T15:04:05Z'
        - '2006-01-02T15:04:05.999Z'
      test:
        - '2019-06-22T16:33:51Z'
        - '2019-11-18T04:59:51.123Z'

```

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [November 13, 2019, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/2 "2019-11-13T15:05:44Z")

</div>

Hi @Heatzone87,

What's happening is that log input is overwriting your fields with log related info. Perhaps you can try to decode fields under `json`, and then rename them using the [rename processor](https://www.elastic.co/guide/en/beats/filebeat/7.4/rename-fields.html).

Best regards

---

<div class="post-metadata">

**Author:** ![Heatzone87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heatzone87/32/57088_2.png) [@Heatzone87](https://discuss.elastic.co/u/Heatzone87)\
**Post date:** [November 13, 2019, 3:17pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/3 "2019-11-13T15:17:22Z")

</div>

Yeah i am flexible though so i could push it to a different key however according the Elastic Common Schema this is the way to go?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [November 14, 2019, 12:25pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/4 "2019-11-14T12:25:04Z")

</div>

Yes, and you can definitely do that. Is just that in order to get it right you need to do it with the rename processor, after the input has written it's own fields. That should ensure you don't get yours overwritten.

Best regards

---

<div class="post-metadata">

**Author:** ![Heatzone87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heatzone87/32/57088_2.png) [@Heatzone87](https://discuss.elastic.co/u/Heatzone87)\
**Post date:** [November 17, 2019, 8:29pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/5 "2019-11-17T20:29:50Z")

</div>

@exekias i dont understand what you mean i think. The problem is that the filebeat processor is overwriting the key instead of merging it. How will a rename processor help here where actually the values are in log.level and should be there as well?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2019, 8:45pm UTC](https://discuss.elastic.co/t/filebeat-overwriting-log-level-and-log-logger/207548/6 "2019-12-15T20:45:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.