# How to tell what fields can be examined/coded to in a Logstash filter?

**URL:** <https://discuss.elastic.co/t/how-to-tell-what-fields-can-be-examined-coded-to-in-a-logstash-filter/159772>\
**Category:** Logstash\
**Created:** [December 6, 2018, 4:58pm UTC](https://discuss.elastic.co/t/how-to-tell-what-fields-can-be-examined-coded-to-in-a-logstash-filter/159772 "2018-12-06T16:58:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RussellBateman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russellbateman/32/34928_2.png) [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Post date:** [December 6, 2018, 4:58pm UTC](https://discuss.elastic.co/t/how-to-tell-what-fields-can-be-examined-coded-to-in-a-logstash-filter/159772/1 "2018-12-06T16:58:23Z")

</div>

If I want to write a filter that does something different depending on the provenance of a log entry, I am encouraged by examples to write

```
filter
{
  if [source] =~ "/var/log/acme/debug.log"
  {
    dissect
    {
      mapping =>
      {
        "message" => "..."
      }
    }
  }
  else # filter entries from other logfiles:
  {
    dissect
    {
      ...
    }
  }
}

```

However, it appears that `source` is not a field (though I see it in Kibana) available to me at this point. How can I know which fields Kibana displays (see below) are available to my filter logic? In Kibana, with no logic in my Logstash filter, I see:

```
filebeat-*
Selected fields
t message
Available fields
O @timestamp
t @version
t _id
t _index
# _score
t _type
t beat.hostname
t beat.name
t beat.version
t host.name
t input.type
# offset
t prospector.type
t source
t tags

```

Experimentation seems to confirm that I can see `message`, because that's what my `dissect` operates successfully on (when I put no conditionals into the filter). However, when I try to code different `dissect` statements based on a conditional, my filter fails to do anything--as if `source` didn't exist. In fact, my observation is that if I put any such conditional at all (to which I have no access?, i.e.: doesn't exist?), the whole filter fails--not even the `else` part of my filter works which works perfectly if that is the only code in my filter, and I don't even get the option of a "filebeat-\*" index pattern in Kibana after.

---

<div class="post-metadata">

**Author:** ![RussellBateman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russellbateman/32/34928_2.png) [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\
**Post date:** [December 6, 2018, 11:49pm UTC](https://discuss.elastic.co/t/how-to-tell-what-fields-can-be-examined-coded-to-in-a-logstash-filter/159772/2 "2018-12-06T23:49:33Z")

</div>

The solution is in Elastic documentation  
[https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-log.html](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-log.html). The way to tell what fields are available in any given case is to:

1. Fire log entries at Logstash with no defined filter.
2. Create your index pattern in Kibana and examine the list of fields it associates with the data.
3. Whatever is both in the list in #2 above and also in the Elastic documentation's list of exported fields can be coded to (i.e.: used in conditional expressions) in your filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 11:49pm UTC](https://discuss.elastic.co/t/how-to-tell-what-fields-can-be-examined-coded-to-in-a-logstash-filter/159772/3 "2019-01-03T23:49:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.