# Is it possible to add my own custom field using Winlogbeat?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [January 24, 2018, 2:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789 "2018-01-24T02:57:41Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [January 24, 2018, 2:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/1 "2018-01-24T02:57:41Z")

</div>

Hi,

I am trying to add my own custom field using winlogbeat. Can someone please say if that's p[ossible?

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 24, 2018, 4:39am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/2 "2018-01-24T04:39:09Z")

</div>

See [https://www.elastic.co/guide/en/beats/winlogbeat/6.1/configuration-general-options.html#libbeat-configuration-fields](https://www.elastic.co/guide/en/beats/winlogbeat/6.1/configuration-general-options.html#libbeat-configuration-fields).

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [January 24, 2018, 8:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/3 "2018-01-24T20:38:16Z")

</div>

Thanks Andrew. One more question - would this feature work in all versions of Winlogbeat? Because I am using Winlogbeat 1.x.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 24, 2018, 9:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/4 "2018-01-24T21:07:48Z")

</div>

No, it won't work in 1.x. (`fields` is not present in the 1.x [docs](https://www.elastic.co/guide/en/beats/winlogbeat/1.3/configuration-winlogbeat-options.html)).

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [January 29, 2018, 10:01pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/5 "2018-01-29T22:01:26Z")

</div>

From which version it supports?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 30, 2018, 3:51am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/6 "2018-01-30T03:51:19Z")

</div>

5.0+

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [January 30, 2018, 8:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/7 "2018-01-30T20:38:05Z")

</div>

Thanks Andrew 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2018, 8:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-my-own-custom-field-using-winlogbeat/116789/8 "2018-02-27T20:38:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
