# Filebeat - Should metadata overwrite event data?

**URL:** https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919
**Category:** Beats
**Tags:** filebeat
**Created:** [August 10, 2018, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919 "2018-08-10T18:42:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jaquisar1](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jaquisar1](https://discuss.elastic.co/u/jaquisar1)
#### Post date: [August 10, 2018, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919/1 "2018-08-10T18:42:56Z")

</div>

Hi!

I'm having an issue with Filebeat 6.3.2, basically because of: [https://github.com/elastic/beats/pull/7051](https://github.com/elastic/beats/pull/7051) and I'm thinking weather this is a bug, a feature or just an inconvenience.

Basically, my input configuration is:

```
- type: log
  enabled: true
  paths:
    - /var/log/some-json.log
  fields_under_root: true
  json:
    keys_under_root: true
    overwrite_keys: true
    add_error_key: true

```

And each of the entries looks like this:

```
{ "fieldA": "A", "fieldB": "B", "host": "somehostname" }

```

Because of the change in pull #7051, the final event looks like this:

```
{ "fieldA": "A", "fieldB": "B", "host": { "name": "hostnameoffilebeat" } }

```

I understand using metadata inside "beat" field, but using a root "host" gets in the way of many types event which already contains the host (I'm thinking of nginx logs for example).

Looking at the code seems to be on purpose: [https://github.com/elastic/beats/pull/5149](https://github.com/elastic/beats/pull/5149)

My opinion is that metadata fields should never overwrite event fields when they exists.

What do you guys think, does this deserve an issue in the repo or should I just use a workaround.

Edit: I've been searching and it looks like it's the issue described here: [Logstash errors after upgrading to filebeat-6.3.0](https://discuss.elastic.co/t/logstash-errors-after-upgrading-to-filebeat-6-3-0/135984). Anyway, my question still remains, should metadata overwrite fields? My opinion is that it shouldn't...

Thanks.

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 13, 2018, 4:35pm UTC](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919/2 "2018-08-13T16:35:59Z")

</div>

Could you please open an issue on Github? [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new)  
This seems to be a bug as the documentation clearly states that if `overwrite_keys` is set, the JSON object overwrites the fields that Filebeat normally adds. (See in: [https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#filebeat-input-log-config-json](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#filebeat-input-log-config-json))

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 10, 2018, 6:50pm UTC](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919/3 "2018-09-10T18:50:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.