# How to filter Filebeat output by input id?

**URL:** https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603
**Category:** Beats
**Tags:** filebeat
**Created:** [April 7, 2023, 10:34pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603 "2023-04-07T22:34:04Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![paolovalladolid](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [April 7, 2023, 10:34pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/1 "2023-04-07T22:34:04Z")

</div>

I configured filebeat.yml as follows:

```auto
filebeat.inputs:
- type: filestream
  id: my-input1
  paths:
    - /opt/mything1/logs/*.log

- type: filestream
  id: my-input2
  paths:
    - /opt/mything2/logs/*.log

- type: filestream
  id: my-input3
  paths:
    - /opt/mything3/logs/*.log

```

But when I look at the data in Kibana Discover, I cannot figure out how to filter by id. For example I want to see data only from the my-input2 ID. But Discover gives me no way to do it from what I can tell.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 7, 2023, 10:50pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/2 "2023-04-07T22:50:02Z")

</div>

Hi @paolovalladolid

The input ID is internal to filebeat and is not exported as part of the data set.

But you can [simply add a tag or a field](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#filebeat-input-filestream-common-options) as you like to each of those inputs and then filter on them

---

<div class="post-metadata">

### Author: ![paolovalladolid](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [April 7, 2023, 10:56pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/3 "2023-04-07T22:56:02Z")

</div>

I added a fields as follows:

```auto
filebeat.inputs:
- type: filestream
  id: my-input1
  fields: 
    app_id: my-input1
  paths:
    - /opt/mything1/logs/*.log

```

but Discover is not letting me use app\_id as a filter.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/c/aca4eaac12449e2de78ab8d182d0e32c5045fcc1.png)

I'll try adding a tags option instead.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 8, 2023, 12:36am UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/4 "2023-04-08T00:36:38Z")

</div>

Works for me...  
What version?  
Did you refresh the Discover Page? or what ever page you are on? Sometime the Data view needs to be refreshed.  
Are you using the Default Template?  
Are you using a different index name / data stream?

You did not provide much for me to go on, what filter is that?

```auto
# filestream is an input for collecting log messages from files.
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - /var/log/*.log
  fields: 
    my-app-id: "app-1"  

```

 ![Screenshot 2023-04-07 at 5.34.45 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/9/794bbd6fc9150eb7f2e1ebdb0c83a3a2b92664db.png)  
 ![Screenshot 2023-04-07 at 5.34.27 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc1c11e1f3c0651e9409dfbe3d92908438dadb1f.png)

---

<div class="post-metadata">

### Author: ![paolovalladolid](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [April 10, 2023, 9:44pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/5 "2023-04-10T21:44:02Z")

</div>

Sorry about the missing details. We're on 7.17.0

Refreshing the Discover page in Kibana fixed my issue. I am now able to filter by fields.app\_id as expected.

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 8, 2023, 11:44pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603/6 "2023-05-08T23:44:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.