# Nginx field disappeared after filebeat upgrade
**URL:** https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774
**Category:** Beats
**Tags:** filebeat
**Created:** [November 9, 2020, 3:08pm UTC](https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774 "2020-11-09T15:08:30Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@yukpun](https://discuss.elastic.co/u/yukpun)
#### Post date: [November 9, 2020, 3:08pm UTC](https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774/1 "2020-11-09T15:08:30Z")
Hi all.
I upgraded Elastic Stack (Elasticsearch + Kibana + Filebeat) from 6.6 to 7.9.3 version.
Previously I used to filter logs by nginx.access.host field. After upgrade - this field disappeared. And I don't see any new filed linked with hostname accessed with nginx. Is it possible to return it back, or use another similar filed?
---
### Author:  [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)
#### Post date: [November 10, 2020, 11:35pm UTC](https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774/2 "2020-11-10T23:35:25Z")
Hello! I don't see `nginx.access.host` field in [https://www.elastic.co/guide/en/beats/filebeat/6.6/exported-fields-nginx.html](https://www.elastic.co/guide/en/beats/filebeat/6.6/exported-fields-nginx.html). Do you mean maybe `nginx.access.user_name`?
---
### Author:  [@yukpun](https://discuss.elastic.co/u/yukpun)
#### Post date: [November 11, 2020, 5:17am UTC](https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774/3 "2020-11-11T05:17:45Z")
I solved this problem by myself.
I'm using custom nginx log format:
```auto
log_format main '$remote_addr - $remote_user [$time_local] "$host $request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
```
And seems somebody before me customized access pipeline in ingest node, so `$host` was parsed. After upgrading from 6.6 to 7.9.3 pipeline was changed and replaced.
I found needed data in `nginx.access.info` which was created by GROK and used to be deleted in pipeline.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 9, 2020, 7:17am UTC](https://discuss.elastic.co/t/nginx-field-disappeared-after-filebeat-upgrade/254774/4 "2020-12-09T07:17:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.