# How to customize a filebeat to parse a log?
**URL:** https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049
**Category:** Beats
**Tags:** filebeat
**Created:** [September 18, 2020, 4:00am UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049 "2020-09-18T04:00:23Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@icaruswu](https://discuss.elastic.co/u/icaruswu)
#### Post date: [September 18, 2020, 4:00am UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049/1 "2020-09-18T04:00:24Z")
I read a the formal docs and wanna build my own filebeat module to parse my log. But there's little essays which could be helpful to me.
For example, my log is :
`2020-09-17T15:48:56.998+0800 INFO chain chain/sync.go:705 block validation {"took": 0.111962369, "height": "590", "age": 147656.998959135}`.
Is there any essays that I can read to build my own pipeline.yml or pipeline.json to parse this log?
I'm a rookie dev , pls forgive my ignorant.
Thanks.
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [September 18, 2020, 6:17am UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049/2 "2020-09-18T06:17:34Z")
Hello,
There a 3 ways to do this:
1. Use the dissect processor directly within FileBeat: [https://www.elastic.co/guide/en/beats/filebeat/current/dissect.html](https://www.elastic.co/guide/en/beats/filebeat/current/dissect.html)
2. Install LogStash and use a grok pattern: [https://www.elastic.co/guide/en/logstash/master/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/master/plugins-filters-grok.html)
3. Use an ElasticSearch ingest pipeline [https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html)
Best regards
Wolfram
---
### Author:  [@icaruswu](https://discuss.elastic.co/u/icaruswu)
#### Post date: [September 18, 2020, 10:45am UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049/3 "2020-09-18T10:45:51Z")
Yeah, I created my own filebeat module and created a fileset. Then in the ingest directory I modified the processors in dissect way, but in kibana Discover found it not worked. In case avoid I write the wrong code, I try to use 'remove' method in the processors but still not worked.
`{ "description": "Pipeline for parsing filecoin logdata logs", "processors": [{ "remove": { "field": "ecs" } }], "on_failure" : [{ "set" : { "field" : "error.message", "value" : "{{ _ingest.on_failure_message }}" } }] } `
And I checked the manifest.yml `ingest_pipeline: ingest/pipeline.json`. It's a right setting. After executing `make update`, I enable the module in the modules.d directory.
Finally I checked the kibana Discover but found it not worked (I use the updated datas). The 'ecs' field still exist.
Consequently, how can I set my own custom field with the 'source -\> message' ?
Best wishes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 16, 2020, 12:45pm UTC](https://discuss.elastic.co/t/how-to-customize-a-filebeat-to-parse-a-log/249049/4 "2020-10-16T12:45:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.