# Misleading type attribute in filebeat config

**URL:** https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221
**Category:** Beats
**Tags:** filebeat
**Created:** [October 29, 2015, 7:23am UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221 "2015-10-29T07:23:31Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![owulff](https://avatars.discourse-cdn.com/v4/letter/o/f475e1/32.png) [@owulff](https://discuss.elastic.co/u/owulff)
#### Post date: [October 29, 2015, 7:23am UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/1 "2015-10-29T07:23:31Z")

</div>

Hi all

I've set up FileBeat with Logstash and followed the documentation here:  
[https://www.elastic.co/guide/en/beats/libbeat/master/configuration.html#configuration-output](https://www.elastic.co/guide/en/beats/libbeat/master/configuration.html#configuration-output)

The doc states do configure the following mapping:  
index =\> "%{[@metadata][index]}"  
document\_type =\> "%{[@metadata][type]}"

But, the type is not the type you're used to with logstash-forwarder:  
{  
"paths": ["/app/myapp/container/logs/localhost\_access\_log.\*"],  
"fields": {  
"type": "tomcat\_access",  
"environment": "INT",  
"application": "myapp"  
}

It's the type configured here:

```
  # Possible options are:
  # * log: Reads every line of the log file (default)
  # * stdin: Reads the standard in
  type: log

```

IMHO, the new type attribute introduced in filebeat should be renamed to something different.

Thanks  
Oli

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 29, 2015, 1:06pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/2 "2015-10-29T13:06:17Z")

</div>

Related github PR: [https://github.com/elastic/filebeat/pull/153](https://github.com/elastic/filebeat/pull/153)

---

<div class="post-metadata">

### Author: ![owulff](https://avatars.discourse-cdn.com/v4/letter/o/f475e1/32.png) [@owulff](https://discuss.elastic.co/u/owulff)
#### Post date: [November 2, 2015, 1:04pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/3 "2015-11-02T13:04:25Z")

</div>

Now the documentation states:

```
"@metadata": {
  "beat": "<beat>",
  "type": "<event type>"
}

```

But with Beta 4 it's:

```
 "@metadata" => {
    "index" => "logstash-2015.11.02",
     "type" => "log"
}

```

Will the attribute "index" change to "beat" with RC/GA?

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 2, 2015, 5:32pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/4 "2015-11-02T17:32:05Z")

</div>

It will change with RC1 already

---

<div class="post-metadata">

### Author: ![owulff](https://avatars.discourse-cdn.com/v4/letter/o/f475e1/32.png) [@owulff](https://discuss.elastic.co/u/owulff)
#### Post date: [November 6, 2015, 12:08pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/5 "2015-11-06T12:08:11Z")

</div>

RC1 fixed the issue with document\_type.

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221/6 "2017-07-05T21:58:24Z")

</div>