# Filebeats custom fields not sending with message
**URL:** https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708
**Category:** Beats
**Tags:** filebeat
**Created:** [September 15, 2017, 4:45pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708 "2017-09-15T16:45:00Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jspeer](https://discuss.elastic.co/u/jspeer)
#### Post date: [September 15, 2017, 4:45pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/1 "2017-09-15T16:45:00Z")
I'm running filebeats 5.5.1, the 2 fields that I've added into the prospector aren't sending with the logs. Here is my prospector:
```
- input_type: log
paths:
- /etc/filebeat/log/*.log
fields:
log_type: promolog
type: pricing
fields_under_root: true
```
Here is the message I'm sending to the log
```
echo "This is a test" >> test.log
```
Here is what logstash is seeing
```
2017-09-15T16:39:48.593Z 1843d9713bf0 This is a test
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 15, 2017, 6:27pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/2 "2017-09-15T18:27:48Z")
How do you have Logstash configured? Where is that output coming from? Please share your Logstash config.
---
### Author:  [@jspeer](https://discuss.elastic.co/u/jspeer)
#### Post date: [September 15, 2017, 6:35pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/3 "2017-09-15T18:35:16Z")
Here is the combined logstash config, it's separated into separate files for input, filter, and output
```
input {
beats {
port => 5044
ssl => false
#ssl_certificate => "/etc/pki/tls/certs/logstash-beats.crt"
#ssl_key => "/etc/pki/tls/private/logstash-beats.key"
}
}
filter {
if [fields][log_type] == "promolog" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:logtimestamp} %{WORD:msg} %
{SYSLOG5424SD:jclass} - %{WORD:rtype} %{SPACE}:%{SPACE}%{GREEDYDATA:payload}" }
}
date {
match => ["logtimestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
add_field => { "debug" => "timestampMatched"}
}
csv {
source => "payload"
separator => "|"
remove_field => ["payload"]
}
mutate {
add_field => {
"reqtype" => "%{column2}"
"ordernum" => "%{column3}"
"brand" => "%{column4}"
"promo" => "%{column5}"
}
}
}
}
output {
stdout {}
elasticsearch {
hosts => ["localhost"]
manage_template => false
index => "pricing-%{YYYY.MM.dd}"
document_type => "pricing"
user => "elastic"
password => "changeme"
}
}
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 15, 2017, 6:50pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/4 "2017-09-15T18:50:03Z")
Try using a [different codec](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html#_description_89) with the stdout output. This should cause all fields to be logged.
```auto
output {
stdout { codec => rubydebug { metadata => true } }
}
```
---
### Author:  [@jspeer](https://discuss.elastic.co/u/jspeer)
#### Post date: [September 15, 2017, 7:04pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/5 "2017-09-15T19:04:33Z")
Perfect, thank you! I'm now seeing the fields in the logstash output.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 13, 2017, 7:04pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708/6 "2017-10-13T19:04:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.