# Logstash output cannot match a field set in filebeat

**URL:** <https://discuss.elastic.co/t/logstash-output-cannot-match-a-field-set-in-filebeat/46599>\
**Category:** Logstash\
**Created:** [April 6, 2016, 8:42pm UTC](https://discuss.elastic.co/t/logstash-output-cannot-match-a-field-set-in-filebeat/46599 "2016-04-06T20:42:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbrelsford](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@jbrelsford](https://discuss.elastic.co/u/jbrelsford)\
**Post date:** [April 6, 2016, 8:42pm UTC](https://discuss.elastic.co/t/logstash-output-cannot-match-a-field-set-in-filebeat/46599/1 "2016-04-06T20:42:38Z")

</div>

I've set up a prospector in filebeat that looks as follows:

```
   paths:
    - /mycompany/somedata/*
   fields:
     service: dataevent
     env: int
     appName: Myapp   

```

So I'd like to route any item that is written to /mycompany/somdata/\* to elasticsearch, s3, and stdout. So I've set up the following output rule on my logstash service:

output {  
if [fields.service] == "dataevent" {  
elasticsearch {  
hosts =\> "[search-mycompany-elk-cert-blahblahblah.us-east-1.es.amazonaws.com:80](http://search-mycompany-elk-cert-blahblahblah.us-east-1.es.amazonaws.com:80)"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
s3 {  
region =\> "us-east-1"  
bucket =\> "els-mycompany-mydata"  
size\_file =\> 2048  
time\_file =\> 5  
}  
stdout {}  
}  
}

The els-mycompany-mydata s3 bucket exists. And I have installed the logstash-output-amazon\_es plugin. But nothing is written to my s3 bucket or stdout.

If I remove the condition, then I see data in my s3 bucket and output goes to /var/log/logstash/stdout/logstash.log. The problem is that it is too much data. I really only want the filebeat records with a field of service matching "dataevent" to take this path.

So my question is: how can I get logstash to match on a fields value of "dataevent"?

I've tried setting both fields\_under\_root to both false and true and neither seems to affect the outcome.

thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 24, 2016, 7:39pm UTC](https://discuss.elastic.co/t/logstash-output-cannot-match-a-field-set-in-filebeat/46599/2 "2016-04-24T19:39:12Z")

</div>

```
if [fields.service] == "dataevent" {

```

This isn't the right syntax for nested fields. Use this instead:

```
if [fields][service] == "dataevent" {

```

If that doesn't help, please post what the messages you receive from Filebeat actually look like.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/logstash-output-cannot-match-a-field-set-in-filebeat/46599/3 "2017-07-06T05:00:56Z")

</div>