# KV filter is not working with FILE input

**URL:** <https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767>\
**Category:** Logstash\
**Created:** [August 3, 2017, 7:21pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767 "2017-08-03T19:21:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\
**Post date:** [August 3, 2017, 7:21pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767/1 "2017-08-03T19:21:46Z")

</div>

input {  
file {  
path =\> "/prod/onic\_app\*.log"  
start\_position =\> beginning  
source =\> onic\_tomcat\_app  
}  
file {  
path =\> "/prod/onic\_\_perf\*.log"  
start\_position =\> beginning  
source =\> onic\_tomcat\_perf  
}  
file {  
path =\> "/prod/onic\_\_sys\*.log"  
start\_position =\> beginning  
source =\> onic\_tomcat\_sys  
}  
beats {  
port =\> “5044”  
}  
}

filter {  
grok {  
match =\> {“message” =\> “%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel} %{WORD:Activity} [{%{DATA:foo1}}]:(.\*) execution time: %{NUMBER:executionTime} ms”}  
}  
kv {  
source =\> "foo1"  
field\_split =\> ", "  
}  
}  
output {  
elasticsearch {  
hosts =\> “localhost:9200”  
#manage\_template =\> false  
index =\> onic  
user =\> elastic  
password =\> elasticpassword  
}  
#stdout { codec =\> rubydebug}  
}

And it gives me this error

ERROR logstash.inputs.file - Unknown setting ‘source’ for file

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2017, 6:08am UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767/2 "2017-08-04T06:08:37Z")

</div>

> ERROR logstash.inputs.file - Unknown setting ‘source’ for file

Yes, the file input doesn't have a `source` option (always consult the docs when doubt about the availability of various options). I don't even know what you're trying to do here. Did you mean `type`?

---

<div class="post-metadata">

**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\
**Post date:** [August 4, 2017, 1:46pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767/3 "2017-08-04T13:46:06Z")

</div>

i was trying to match the source field that i have set in file beat . I thought if i set a field source in the filebeat.yml same thing i can use in logstash config. But you cleared my doubt. Thanks so much.

---

<div class="post-metadata">

**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\
**Post date:** [August 4, 2017, 1:55pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767/4 "2017-08-04T13:55:42Z")

</div>

> [@shroh](#):
>
> ERROR logstash.inputs.file - Unknown setting ‘source’ for file

Yes i should define type instead of Source 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2017, 1:55pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working-with-file-input/95767/5 "2017-09-01T13:55:54Z")

</div>

Closed on September 1, 2017, 1:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.