# Problem deleting fields or renaming (from filebeat) **URL:** \ **Category:** Logstash\ **Created:** [February 11, 2016, 4:14pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512 "2016-02-11T16:14:16Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Post date:** [February 11, 2016, 4:14pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/1 "2016-02-11T16:14:16Z")
Hello there, I'm configuring filebeat. before i used logstashforwarder. In logstash i'm getting logs BUT, if i set filebeat to add a new fields, i receive it like field.nameIchoose If i use mutate filter to rename that field it doesn't work. Moreover if i try to delete it i can't. It means that fields, created in filebeat can't be deleted? Thank you all ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 11, 2016, 8:45pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/2 "2016-02-11T20:45:21Z")
You're not giving your configuration so we can only guess, and my guess is that you're not using the current field reference syntax for nested fields. Read more at [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references). To get your fields at the top level from the start, use the [`fields_under_root` configuration option](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#fields-under-root) in Filebeat. ---
**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Post date:** [February 12, 2016, 9:56am UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/3 "2016-02-12T09:56:39Z")
Here is my config There's something i'm doing wrong, because it avoids some configurations, such as document\_type.. > filebeat: > > # List of prospectors to fetch data. > > ## prospectors: > > paths: > > - /opt/tomcat/logs/tomcat.\*.log > input\_type: log > document\_type: filebeat > scan\_frequency: 60s > fields: > host: xxxx > fields\_under\_root: true > multiline: > #pattern: "(^%{TIMESTAMP\_ISO8601})|(^%{IPV4})" > pattern: "()|(^(?:[0-9]{1,3}.){3}[0-9]{1,3}$)" > negate: true > match: after > max\_lines: 200 > timeout: 4s > tail\_files: true > registry\_file: /var/lib/filebeat/registry > output: > logstash: > hosts: ["x.x.x.x:5044"] > shipper: > logging: > files: > rotateeverybytes: 10485760 # = 10MB ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 12, 2016, 12:35pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/4 "2016-02-12T12:35:02Z")
Please format your config as code so the indentation isn't stripped away. There's a toolbar button for that. ---
**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Post date:** [February 12, 2016, 12:46pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/5 "2016-02-12T12:46:59Z")
``` filebeat: # List of prospectors to fetch data. prospectors: - paths: - /opt/tomcat/logs/tomcat.*.log input_type: log document_type: filebeat scan_frequency: 60s fields: host: xxxx fields_under_root: true multiline: pattern: (^([0-9]{4})(-?)(1[0-2]|0[1-9])\2(3[01]|0[1-9]|[12][0-9])\s(2[0-3]|[01][0-9]):?([0-5][0-9]):?([0-5][0-9])$)|(^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$) negate: true match: after max_lines: 200 timeout: 4s tail_files: true registry_file: /var/lib/filebeat/registry output: logstash: hosts: ["x.x.x.x:5044"] shipper: logging: files: rotateeverybytes: 10485760 # = 10MB ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 12, 2016, 12:50pm UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/6 "2016-02-12T12:50:55Z")
The indentation is off. `input_type` and `document_type` should be on the same level as `paths`. See the [example in the docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html). ```auto filebeat: # List of prospectors to fetch data. prospectors: - paths: - /opt/tomcat/logs/tomcat.*.log input_type: log document_type: filebeat scan_frequency: 60s fields: host: aleadigital fields_under_root: true ``` ---
**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Post date:** [February 15, 2016, 11:29am UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/7 "2016-02-15T11:29:00Z")
Hi Magnus, right, that was the problem. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512/8 "2017-07-06T05:11:31Z")