# How to index newly parsed fields to be searchable - My Dynamic Template

**URL:** <https://discuss.elastic.co/t/how-to-index-newly-parsed-fields-to-be-searchable-my-dynamic-template/276962>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 24, 2021, 4:47pm UTC](https://discuss.elastic.co/t/how-to-index-newly-parsed-fields-to-be-searchable-my-dynamic-template/276962 "2021-06-24T16:47:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rklemer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rklemer/32/90416_2.png) [@rklemer](https://discuss.elastic.co/u/rklemer)\
**Post date:** [June 24, 2021, 4:47pm UTC](https://discuss.elastic.co/t/how-to-index-newly-parsed-fields-to-be-searchable-my-dynamic-template/276962/1 "2021-06-24T16:47:45Z")

</div>

Hello, I'm trying to index custom fields that are parsed from s3 json log, it's not seeming to work, I have these processors:

```auto
filebeat.inputs:
- type: aws-s3
  queue_url: https://sqs.XXX>XXXX.com/XXXX/XXXXX
  access_key_id: 'XXXX-XXX'
  secret_access_key: 'XXXXXXX-XXXXXXX'
  file_selectors:
  - regex: '^AWSLogs/\d+/CloudTrail/'
    expand_event_list_from_field: 'Records'
  processors:
    - decode_json_fields:
        fields: ["message"]
        process_array: true
        max_depth: 1
        target: "s3.access"
        overwrite_keys: false

```

And so end up with ~15 fields all prepended with "s3.access.\*" but when I check in Kibana discover they're not index and I can't search based on them, how do I get this working? I already tried a dynamic template:

```auto
  {
    "s3.access.*": {
      "path_match": "s3.access.*",
      "mapping": {
        "type": "text"
      },
      "match_mapping_type": "*"
    }
  }

```

but that returned the error - "Can't get text on a START\_OBJECT at 1:995"  
I think I'm close but any help on this would be great, thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2021, 6:48pm UTC](https://discuss.elastic.co/t/how-to-index-newly-parsed-fields-to-be-searchable-my-dynamic-template/276962/2 "2021-07-22T18:48:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.