# How to config Logstash to set custom type

**URL:** https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616
**Category:** Logstash
**Created:** [March 28, 2016, 6:18pm UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616 "2016-03-28T18:18:50Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tuananhtd](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@tuananhtd](https://discuss.elastic.co/u/tuananhtd)
#### Post date: [March 28, 2016, 6:18pm UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/1 "2016-03-28T18:18:50Z")

</div>

Hi guys! I know that this maybe a duplicated topic but I guess that the old topic is just outdated since I couldn't make it works.

In my project I use FileBeat to ship JSON logs to Logstash. I want to have different type of logs eg. client side errors, server side errors ... so I think using the Elasticsearch's type could be a good idea.  
I couldn't find any concrete document about the Logstash's config file but it seems like the trick is having a type file in the JSON object and tell Logstash to use that value as the type. I tried to follow [this](https://discuss.elastic.co/t/how-could-i-set-index-type-at-logstash/985) but it didn't work. All the documents were set to log type.

I also tried this but there is no different

```auto
input {
  beats {
    port => 5044
    codec => "json"
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    document_type => "%{type}"
  }
}

```

Hope to hear from you!

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 28, 2016, 7:37pm UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/2 "2016-03-28T19:37:53Z")

</div>

You need to define `%{type}` somewhere, is it in your json?

---

<div class="post-metadata">

### Author: ![tuananhtd](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@tuananhtd](https://discuss.elastic.co/u/tuananhtd)
#### Post date: [March 28, 2016, 8:03pm UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/3 "2016-03-28T20:03:21Z")

</div>

Thank! but how to define it? my JSON will be something like this:

```auto
{"type": "server-error", "message":"random-error", ...}

```

But of course it didn't work!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 29, 2016, 5:33am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/4 "2016-03-29T05:33:56Z")

</div>

Seems like that should've worked. If you temporarily replace the elasticsearch output with a `stdout { codec => rubydebug }` output you can see exactly what the events look like. I'd be interesting to see your Filebeat configuration too.

---

<div class="post-metadata">

### Author: ![tuananhtd](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@tuananhtd](https://discuss.elastic.co/u/tuananhtd)
#### Post date: [March 29, 2016, 6:18am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/5 "2016-03-29T06:18:25Z")

</div>

Thank @magnusbaeck!

My FileBeat's config is just the default one except the log directory.

After debugging I find out that I just cannot use the `type` field in the JSON object. Maybe that name is reserved or overwritten at some point?  
So changing the Logstash config to `document_type => "%{MY_FIELD}"` (where `MY_FIELD` is NOT equal `type`) and having the corresponding field in my JSON object will make it work.

Recently I realized that beside the `_type` field which I think Elasticsearch set for every document, Logstash will have another `type` field (without the underscore). `document_type` setting will affect the `_type` field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:04am UTC](https://discuss.elastic.co/t/how-to-config-logstash-to-set-custom-type/45616/6 "2017-07-06T05:04:59Z")

</div>


