# How to customize fields that Filebeat sends to Elasticsearch? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/how-to-customize-fields-that-filebeat-sends-to-elasticsearch/167625 "2019-02-08T12:25:50Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![morenz](https://avatars.discourse-cdn.com/v4/letter/m/77aa72/32.png) [@morenz](https://discuss.elastic.co/u/morenz)\ **Post date:** [February 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/how-to-customize-fields-that-filebeat-sends-to-elasticsearch/167625/1 "2019-02-08T12:25:50Z")
Hello folks 🙂 I have an ELK 6.5 server Debian 9 server (Bitnami build for Google Cloud Environment) to which I have to send my PostgreSQL 9.5 server (Debian 9) logs using Filebeat. I chose to send data directly to Elasticsearch but I have a strange issue. In the DB server, where Filebeat resides, I edited fields.yml and removed all groups but host, beats and postgres. I also set filebeat to overwrite templates. After starting filebeat if I connect with Kibana to ES server and create an index template, I see the one I created, but it has 670 fields(!!!) instead of the about 40 that I configured in fields.yml I tried also using drop\_fields processor, but it didn't work (I get a strange error about having an invalid character (sorry for not having kept the actual message), that I actually did not have, also checked with hexdump, that prevents the daemon to start) Am I missing something? Thanks in advance Moreno.- ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 8, 2019, 12:26pm UTC](https://discuss.elastic.co/t/how-to-customize-fields-that-filebeat-sends-to-elasticsearch/167625/2 "2019-03-08T12:26:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.