# Is there any permanent ID in Filebeat logs?

**URL:** <https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 19, 2024, 8:26am UTC](https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118 "2024-08-19T08:26:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Post date:** [August 19, 2024, 8:26am UTC](https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118/1 "2024-08-19T08:26:57Z")

</div>

Hi,

I'm ingesting filebeat logs (`/var/log/filebeat/filebeat-<date>.ndjson`) to Elasticsearch so that I can build a dashboard showing the filebeat metrics (e.g. packets received, dropped, etc). Both Filebeat and ES are running version 8.8.0.

I'm running multiple filebeat instances on the same host. I noticed that in the filebeat logs, there isn't any permanent unique ID that would distinguish between different filebeat instances. I only see `monitoring.metrics.beat.info.ephemeral_id`, which changes every time I restart a filebeat instance, which means I have to modify my dashboard each time I restart a filebeat instance.

I have set `filebeat.inputs.id` (for `type: filestream`, which is the `inputs` for the filebeat logs), and also `name`, which shows up in my other records as `agent.name`, but they don't seem to be included in the filebeat logs.

Is there any permanent ID I can use for each filebeat instance?

Thank you.

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [August 21, 2024, 5:22pm UTC](https://discuss.elastic.co/t/is-there-any-permanent-id-in-filebeat-logs/365118/2 "2024-08-21T17:22:53Z")

</div>

@hjazz6, You can use [add\_fields](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html) processor. Define unique identification for each inputs.

I am also curious why you're using multiple instances on one host where as one instance of filebeat is capable to capture all logs?