# Rename default output field names

**URL:** <https://discuss.elastic.co/t/rename-default-output-field-names/91021>\
**Category:** Beats\
**Created:** [June 27, 2017, 7:39pm UTC](https://discuss.elastic.co/t/rename-default-output-field-names/91021 "2017-06-27T19:39:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hding](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hding](https://discuss.elastic.co/u/hding)\
**Post date:** [June 27, 2017, 7:39pm UTC](https://discuss.elastic.co/t/rename-default-output-field-names/91021/1 "2017-06-27T19:39:33Z")

</div>

Is the default Filebeat output name for log lines "message"? Can I give it a different name by configuring filebeat.yml, instead of using the rename processor in ingest node?

Also, can I change the default "source" field (file path, not "\_source") name?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 27, 2017, 7:53pm UTC](https://discuss.elastic.co/t/rename-default-output-field-names/91021/2 "2017-06-27T19:53:15Z")

</div>

> [@hding](#):
>
> Is the default Filebeat output name for log lines "message"?

Yes

> [@hding](#):
>
> Can I give it a different name by configuring filebeat.yml

No, you need to use ingest node or Logstash to rename fields.

> [@hding](#):
>
> Also, can I change the default "source" field (file path, not "\_source") name?

Ditto

---

<div class="post-metadata">

**Author:** ![hding](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hding](https://discuss.elastic.co/u/hding)\
**Post date:** [June 27, 2017, 8:05pm UTC](https://discuss.elastic.co/t/rename-default-output-field-names/91021/3 "2017-06-27T20:05:16Z")

</div>

Thank you, Andrew.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2017, 7:39pm UTC](https://discuss.elastic.co/t/rename-default-output-field-names/91021/4 "2017-07-18T19:39:37Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.