# Logstash Filter Elasticsearch - Referencing Fields

**URL:** https://discuss.elastic.co/t/logstash-filter-elasticsearch-referencing-fields/120070
**Category:** Logstash
**Created:** [February 15, 2018, 9:25pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticsearch-referencing-fields/120070 "2018-02-15T21:25:12Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![KRasekhi](https://avatars.discourse-cdn.com/v4/letter/k/85e7bf/32.png) [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)
#### Post date: [February 15, 2018, 9:25pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticsearch-referencing-fields/120070/1 "2018-02-15T21:25:12Z")

</div>

Hi,

I am a bit confused on reference some fields , for example -

fields =\> {  
"host" =\> "last\_logon\_host"  
"@timestamp" =\> "last\_logon\_time"  
"event\_data.LogonType" =\> "last\_logon\_type"  
}

all of them work except event\_data.LogonType. I've tried -  
"event\_data.LogonType"  
[event\_data][LogonType]  
[event\_data.LogonType]  
"[event\_data][LogonType]"  
"[event\_data.LogonType]"

Any suggestions? Thanks!

---

<div class="post-metadata">

### Author: ![KRasekhi](https://avatars.discourse-cdn.com/v4/letter/k/85e7bf/32.png) [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)
#### Post date: [February 20, 2018, 3:00pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticsearch-referencing-fields/120070/2 "2018-02-20T15:00:44Z")

</div>

also tried with no sucess -

[event\_data]LogonType  
event\_data[LogonType]

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2018, 3:00pm UTC](https://discuss.elastic.co/t/logstash-filter-elasticsearch-referencing-fields/120070/3 "2018-03-20T15:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.