# How to seperate message field filebeat
**URL:** https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167
**Category:** Logstash
**Created:** [November 12, 2020, 8:14am UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167 "2020-11-12T08:14:50Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)
#### Post date: [November 12, 2020, 8:14am UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/1 "2020-11-12T08:14:50Z")
Guys, how can I seperate message field with filebeat to more field ? It keep just giving me message field, I am trying to use grok filter but it does not work. Filebeat agent work in 1 machine meanwhile elastic server work in another machine.
2020-10-14T01:57:40.537+0700 8.8.8.8 34 10.121.42.12 97 nophoso chrome
for example log like this
this is my grok filter
'input {
beats {
port =\> 5044
}
}
filter {
grok {
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:time} %{IP:ipsend} %{NUMBER:ports} %{IP:ipreceive} %{NUMBER:portr} %{WORD:action} %{WORD:td}" }
}
}
output {
elasticsearch { hosts =\> ["10.151.128.97:9200"]
hosts =\> "10.151.128.97:9200"
manage\_template =\> false
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
'
Pls help me . Tks
---
### Author:  [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)
#### Post date: [November 12, 2020, 9:31am UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/2 "2020-11-12T09:31:36Z")
anyone pls help me, I still can't deal with this problem yet
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 12, 2020, 3:28pm UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/3 "2020-11-12T15:28:32Z")
With that message and that grok filter I get
```
"ipreceive" => "10.121.42.12",
"portr" => "97",
"td" => "chrome",
"ipsend" => "8.8.8.8",
"action" => "nophoso"
"message" => "2020-10-14T01:57:40.537+0700 8.8.8.8 34 10.121.42.12 97 nophoso chrome for example log like this",
```
etc. I do not see a problem.
---
### Author:  [@Hi\_u\_Nguy\_n\_Dang](https://discuss.elastic.co/u/Hi_u_Nguy_n_Dang)
#### Post date: [November 13, 2020, 2:39am UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/4 "2020-11-13T02:39:33Z")
I use Kibana/elastic/logstash server on 10.151.128.97 and I use filebeat on 10.157.128.98 server. I change the grok filter on logstash server. The message field still does not seperate to 7 field. So do u think what did I do wrong ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 13, 2020, 3:39pm UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/5 "2020-11-13T15:39:26Z")
> [@Hi\_u\_Nguy\_n\_Dang](#):
>
> So do u think what did I do wrong ?
I cannot say.
---
### Author:  [@fadjar340](https://discuss.elastic.co/u/fadjar340)
#### Post date: [November 14, 2020, 1:00pm UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/6 "2020-11-14T13:00:39Z")
Perhaps, you need to set the output to rubudebug and paste the result here, so we can see whats the problem.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2020, 1:00pm UTC](https://discuss.elastic.co/t/how-to-seperate-message-field-filebeat/255167/7 "2020-12-12T13:00:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.