# Problem with filebeat prozessors

**URL:** <https://discuss.elastic.co/t/problem-with-filebeat-prozessors/267996>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 22, 2021, 5:04pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-prozessors/267996 "2021-03-22T17:04:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![UweW](https://avatars.discourse-cdn.com/v4/letter/u/ed8c4c/32.png) [@UweW](https://discuss.elastic.co/u/UweW)\
**Post date:** [March 22, 2021, 5:04pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-prozessors/267996/1 "2021-03-22T17:04:01Z")

</div>

Hi,  
I run filebeat with a few moduled enabled like cef, cisco and fortinet.  
In the modules input area I add an tag related to the customer. Later in the processors part of filebeat.yml I use this tag to set correct organization.name.  
So far so good and it works.  
For the fortinet firewall input I have to set the customer name dependent to the value of fortinet.firewall.vd which is available in the ingested data. But this doesn't work.  
It seems that the fortinet specific field are not available when it runs through the prozessor.  
A section of the filebeat.yml

```auto
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - add_fields:
      when:
        or:
          - contains:
              tags: "CustA"
          - contains:
              fortinet.firewall.vd: "custA"
      target: organization
      fields:
        name: "CustomerA"
  - add_fields:
      when:
        or:
          - contains:
              fortinet.firewall.vd: "Gxxxx"
          - contains:
              tags: "Gxxxx"
      target: organization
      fields:
        name: "Gxxxx"
  - add_fields:
      when:
        equals:
          fortinet.firewall.vd: "K"
      target: organization
      fields:
        name: "Kddd"

```

Hope somebody has an idea.

Best regards  
Uwe

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [March 23, 2021, 9:06am UTC](https://discuss.elastic.co/t/problem-with-filebeat-prozessors/267996/2 "2021-03-23T09:06:31Z")

</div>

Hi!

I'm not sure if you can use conditions in this processor and if the processor actually has access to event's fields (didn't check but [docs](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html) does not mention that)

However I think that [script](https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html) can be of help in your case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2021, 11:07am UTC](https://discuss.elastic.co/t/problem-with-filebeat-prozessors/267996/3 "2021-04-20T11:07:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.