# Parsing typical logback log lines
**URL:** https://discuss.elastic.co/t/parsing-typical-logback-log-lines/117665
**Category:** Beats
**Tags:** filebeat
**Created:** [January 30, 2018, 4:47pm UTC](https://discuss.elastic.co/t/parsing-typical-logback-log-lines/117665 "2018-01-30T16:47:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@gaukharaya](https://discuss.elastic.co/u/gaukharaya)
#### Post date: [January 30, 2018, 4:47pm UTC](https://discuss.elastic.co/t/parsing-typical-logback-log-lines/117665/1 "2018-01-30T16:47:25Z")
Hi,
I am trying to send the following format log line from filebeat 6 to es6:
%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n
In my prospectors I specify:
- type: log
Looking at fields.xml the default log fields do not contain fields described in the above log line, from forum posts from '16 it looks like `input-type: log` used to be able to parse the typical logback log lines.
In the latest filebeat though I see a lot of fields I do not need such as offset, [beat.name](http://beat.name), beat.version etc.
Can I modify fields.xml to extact the fields like thread, logger and level or is there a default module that let's me do that out of the box?
Thank you very much in advance!
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [January 30, 2018, 5:25pm UTC](https://discuss.elastic.co/t/parsing-typical-logback-log-lines/117665/2 "2018-01-30T17:25:59Z")
Filebeat is not doing any parsing for you. Do you use logstash or Elasticsearch ingest node for parsing?
Some fields (like offset) can be removed using the [drop\_fields](https://www.elastic.co/guide/en/beats/filebeat/current/drop-fields.html#drop-fields) or [include\_fields](https://www.elastic.co/guide/en/beats/filebeat/current/include-fields.html#include-fields) processors.
The `fields.yml` file only specifies the mapping of fields (essentially defines schema of beats events), but does not configure the fields to be exported.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2018, 5:26pm UTC](https://discuss.elastic.co/t/parsing-typical-logback-log-lines/117665/3 "2018-02-27T17:26:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.