# Prospector "fields" values being overwritten
**URL:** https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423
**Category:** Beats
**Tags:** filebeat
**Created:** [February 5, 2018, 10:20am UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423 "2018-02-05T10:20:19Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Aceman87](https://discuss.elastic.co/u/Aceman87)
#### Post date: [February 5, 2018, 10:20am UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/1 "2018-02-05T10:20:19Z")
Hi,
We have a Filebeat config that has two prospectors. Both prospectors define their own tags and "fields" values. However, the fields values of the first prospector are being overwritten by the values of the second prospector. Here is the config:
```
filebeat.prospectors:
- type: log
enabled: true
paths: ["C:/path1"]
fields:
sw: SW_name_1
include_lines: ['ERROR', 'WARN']
multiline.pattern: ^([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} - )
multiline.negate: true
multiline.match: after
tags: ["tag1"]
- type: log
enabled: true
paths: ["C:/path2"]
fields:
sw: SW_name_2
include_lines: ['\AERROR', '\AWARN']
multiline.pattern: ^(TID)
multiline.negate: true
multiline.match: after
tags: ["tag2"]
```
So in KIbana we can only see "fields.sw:SW\_name\_2", even when the source is "C:/path1" and the tags contain "tag1". This has led us to believe that the "fields.sw" value is being overwritten somehow.
We then tried removing the
fields:
sw: SW\_name\_2
section. Then the "SW\_name\_1" value appeared in new entries as expected.
Any idea what might be the cause?
Thank you!
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 5, 2018, 1:32pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/2 "2018-02-05T13:32:14Z")
What Filebeat version are you using?
---
### Author:  [@Aceman87](https://discuss.elastic.co/u/Aceman87)
#### Post date: [February 5, 2018, 1:35pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/3 "2018-02-05T13:35:50Z")
filebeat 6.0.0
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 5, 2018, 1:38pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/4 "2018-02-05T13:38:51Z")
Could you try version 6.1.3. I vaguely recall there being an [issue](https://github.com/elastic/beats/pull/5808) with fields that was fixed.
---
### Author:  [@Aceman87](https://discuss.elastic.co/u/Aceman87)
#### Post date: [February 5, 2018, 1:54pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/5 "2018-02-05T13:54:39Z")
Thank you for the tip. The update to 6.1.3 seems to have fixed the issue 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 5, 2018, 1:54pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423/6 "2018-03-05T13:54:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.