# Harvest + Analyze customers application logs
**URL:** https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678
**Category:** Beats
**Tags:** filebeat
**Created:** [August 4, 2019, 1:36pm UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678 "2019-08-04T13:36:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@mnaveh](https://discuss.elastic.co/u/mnaveh)
#### Post date: [August 4, 2019, 1:36pm UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/1 "2019-08-04T13:36:46Z")
Hi
I am new with Elastic and Filebeat.
Decided to test harvesting and analyze customers application logs.
- Installed (Windows) Elastic + Filebeat + Kibana.
- Configured Filebeat fields.yml to the customized logs fields source:
-- Log row example:
0614\_15:00:00.831, "SYSTEM pre-ordering starting, lastRun: \<20190613\>", [INFO], T@105918, T:ActiveMgr.105918, , com.mm.PreMN, PreMN::orderSystemIntoShadow, ,
-- Fields.yml:
"date":"id": "date"
"error.message":"id": "string"
"process.title":"id": "string"
"event.action":"id": "string"
"process.program":"id": "string"
"event.type":"id": "string"
"event.hash":"id": "string"
Yet, Kibana has created the filebeat new index with the default fields.
Please assist. Thanks!
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 5, 2019, 10:31am UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/2 "2019-08-05T10:31:06Z")
Could you please share your debug logs (output of `./filebeat -e -d "*"`) and your configuration formatted using ``?
To me it seems that the format of your `fields.yml` file is incorrect. This is the `fields.yml` of HAProxy module in Filebeat: [https://github.com/elastic/beats/blob/master/filebeat/module/haproxy/\_meta/fields.yml](https://github.com/elastic/beats/blob/master/filebeat/module/haproxy/_meta/fields.yml) You need something like that.
---
### Author:  [@mnaveh](https://discuss.elastic.co/u/mnaveh)
#### Post date: [August 5, 2019, 11:41am UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/3 "2019-08-05T11:41:03Z")
Hi Noémi,
thanks for responding to my query.
- The filebeat debugged output does show that most of the input files didn't change, yet it does not show on Kibana as supposed.
- Filebeat keeps harvesting the Filebeat+Kibana log files.
- My fields.yml should be quite short, I just couldn't figure out its structure.
Can you say how to add just the requested fields to this example load:
"date":"id": "date"
"error.message":"id": "string"
"process.title":"id": "string"
"event.action":"id": "string"
"process.program":"id": "string"
"event.type":"id": "string"
"event.hash":"id": "string"
Thanks.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 5, 2019, 11:55am UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/4 "2019-08-05T11:55:19Z")
Do you want to add these fields to the existing fields, or add only these fields without the fields provided by Filebeat?
---
### Author:  [@mnaveh](https://discuss.elastic.co/u/mnaveh)
#### Post date: [August 5, 2019, 2:18pm UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/5 "2019-08-05T14:18:29Z")
For now, I need to test only those fields.
Next, will need to add fields per log file type.
Wish Filebeat could analyze such log files pattern.
Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2019, 2:18pm UTC](https://discuss.elastic.co/t/harvest-analyze-customers-application-logs/193678/6 "2019-09-02T14:18:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.