# How to tag log files in filebeat for logstash ingestion?

**URL:** <https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 17, 2016, 1:54pm UTC](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713 "2016-03-17T13:54:18Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 18, 2016, 2:16pm UTC](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713/7 "2016-03-18T14:16:23Z")

</div>

The first part is correct on its own, but you may want to change it based on how you intend to write your Logstash config.

The second part won't work. You cannot override the `type` field once it's set. This is documented [here](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-type). If you want to change the `type` then set [`document_type: access`](https://www.elastic.co/guide/en/beats/filebeat/1.1/configuration-filebeat-options.html#_document_type) in your Filebeat configuration.

Here's an example Logstash config based on the Filebeat config you gave:

Filebeat:

```auto
filebeat:
  prospectors:
    - paths:
        - /path/to/logs/access.log
      fields: {log_type: access}
    -   
      paths:
        - /path/to/other/logs/errors.log
      fields: {log_type: errors}

```

Logstash:

```auto
input {
  beats {
    port => 5044
  }
}

filter {
  if [fields][log_type] == "access" {
    mutate {
      add_field => { "foo" => "var" }
    }
  }
}

output {
  stdout { codec => rubydebug{} }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713)._