# How can I expose new fields embodied in top-level fields?

**URL:** <https://discuss.elastic.co/t/how-can-i-expose-new-fields-embodied-in-top-level-fields/62854>\
**Category:** Kibana\
**Created:** [October 12, 2016, 7:28pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-embodied-in-top-level-fields/62854 "2016-10-12T19:28:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kpam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kpam/32/12447_2.png) [@kpam](https://discuss.elastic.co/u/kpam)\
**Post date:** [October 12, 2016, 7:28pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-embodied-in-top-level-fields/62854/1 "2016-10-12T19:28:28Z")

</div>

Hi all,

I'm using a structured logging package for Go ([https://github.com/sirupsen/logrus](https://github.com/sirupsen/logrus)) and using Filebeat to ship to our ES cluster. Unfortunately, all the structured fields we're exposing with logrus get wrapped up in a "msg" field that I believe Filebeat creates. This makes us unable to query on the structured fields.

For example, in logrus we have:  
log.WithFields(log.Fields{  
"event": event,  
"topic": topic,  
"key": key,  
}).Fatal("Failed to send event")

But on Kibana, we're reading in log records as such that have a field called 'message' which wraps up the logrus payload:  
`message: {"event":"click","topic":"video", "key"="key", "level"="fatal", "msg":"Failed to send event","time":"2015-08-12T18:47:07Z"}`

Is it possible to extract the event, topic, key fields to top-level?

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [October 12, 2016, 11:12pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-embodied-in-top-level-fields/62854/2 "2016-10-12T23:12:47Z")

</div>

Hi Kpam,

I'm assuming this question is a duplicate of [How can I expose new fields sourced from the log record?](https://discuss.elastic.co/t/how-can-i-expose-new-fields-sourced-from-the-log-record/62871)?

Thanks,  
CJ

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:36pm UTC](https://discuss.elastic.co/t/how-can-i-expose-new-fields-embodied-in-top-level-fields/62854/3 "2017-07-06T13:36:54Z")

</div>