# How to make the changes in filebeat effective

**URL:** <https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 5, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143 "2021-01-05T01:46:50Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 5, 2021, 8:47pm UTC](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143/24 "2021-01-05T20:47:45Z")

</div>

It makes sense, but please provide the information requested.  
Specifically the entire document that was output, not just a section of it.

---

<div class="post-metadata">

**Author:** ![aagarwal3](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@aagarwal3](https://discuss.elastic.co/u/aagarwal3)\
**Post date:** [January 5, 2021, 8:59pm UTC](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143/25 "2021-01-05T20:59:17Z")

</div>

logs of dec 16:

```auto
    @timestamp	Dec 16, 2020 @ 18:59:59.715
	_id	_KCkbnYBaWc7eVWEZIer
	_index	log-2020.12.17
	_score - 
	_type	_doc
	agent.ephemeral_id	59068176-f55f-437b-97b8-a0933dd9d968
	agent.id	c2863c1e-bc3d-4d18-8be4-d5db8b214edc
	agent.name	VM_0_16_centos
	agent.type	filebeat
	agent.version	7.10.0
	ecs.version	1.6.0
	input.type	log
	log.file.path	somefilepath
	log.offset	172,959,393
	message	[sometext1] [2020-11-30 02:10:17.736] [loglevel] [sometext2] msg

```

recent log

```auto
    @timestamp	Jan 5, 2021 @ 12:56:38.165
	_id	SUVW1HYBaWc7eVWEYHkl
	_index	log-node2-2021.01.06
	_score - 
	_type	_doc
	agent.ephemeral_id	ad80e8ba-bbac-4e2c-a33b-09135f3b6553
	agent.id	c2863c1e-bc3d-4d18-8be4-d5db8b214edc
	agent.name	VM_0_16_centos
	agent.type	filebeat
	agent.version	7.10.0
	dissect.start_time	2021-01-06 04:56:33.698
	ecs.version	1.6.0
	input.type	log
	log.file.path	somefilepath
	log.offset	169,458,666
	message	[sometext1] [2021-01-05 09:56:17.736] [loglevel] [sometext2] msg

```

`dissect.start_time` is working only on recent logs not on previous ones.I do not think that logs which are sent to ES can have the changes made in filebeat. I just simply added `add_host_metadata:` and they are not visible in Dec 16,2020 logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2021, 8:59pm UTC](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143/26 "2021-02-02T20:59:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/how-to-make-the-changes-in-filebeat-effective/260143.md?page=1)