# Send metadata from filebeat to logstash
**URL:** https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030
**Category:** Beats
**Tags:** filebeat
**Created:** [August 6, 2019, 2:20pm UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030 "2019-08-06T14:20:41Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@bm\_rec](https://discuss.elastic.co/u/bm_rec)
#### Post date: [August 6, 2019, 2:20pm UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/1 "2019-08-06T14:20:42Z")
Hi! I'd like to send a hostname and some other host metadata from filebeat to Logstash. Then Logstash saves files with a name like:
> **Summary**
>
> ```
> file {
> path => "~/%{+YYYY-MM-dd}/%{component}/%{[@metadata][host]:[name]}-%{log_name}-%{+HH}.00.log.gz"
> codec => line { format => "%{message}"}
> file_mode => 0644
> gzip => true }
>
> ```
But Logstash can't parse this path, it saves a file like: _~/2019-08-06/app/%{[@metadata][host]:[name]}-weblogic-14.00.log.gz_
I've tried a lot of different combinations of **{, @,[ and "**. Where am I wrong? Part of my Filebeat configuration:
> **Summary**
>
> ```
> - type: log
> enabled: true
> paths:
> - /var/log/weblogic/weblogic.log
> fields:
> component: app
> env: test
> log_name: weblogic
> fields_under_root: true
> processors:
> - add_host_metadata:
> cache.ttl: 5m
>
> ```
Also I tried _- add\_host\_metadata: ~_
What does tilde mean?
Of course, I can add a hostname in fields, but I'll have several paths and many servers so I don't want to enumerate each field in every path block.
Can anyone help, please!?
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 7, 2019, 11:12am UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/2 "2019-08-07T11:12:12Z")
`~` means null in YAML files. It means that `add_host_metadata` is running with the default configuration.
Could you please share your debug logs of Filebeat?
---
### Author:  [@bm\_rec](https://discuss.elastic.co/u/bm_rec)
#### Post date: [August 8, 2019, 7:26pm UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/3 "2019-08-08T19:26:24Z")
Thank you! Here you are: [https://pastebin.com/4pTYg0Ei](https://pastebin.com/4pTYg0Ei)
This is journalctl output.
I changed some company's data like servername.
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [August 8, 2019, 7:47pm UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/4 "2019-08-08T19:47:30Z")
It was a bit hard to parse the output of journalctl, so it might not work. But I think you need to change the path to `"~/%{+YYYY-MM-dd}/%{component}/%{[host]:[name]}-%{log_name}-%{+HH}.00.log.gz"`, as the event contains `host.name` on the top level of the fields.
---
### Author:  [@bm\_rec](https://discuss.elastic.co/u/bm_rec)
#### Post date: [August 9, 2019, 3:57am UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/5 "2019-08-09T03:57:23Z")
Yeah, it works! Thanks! 😌
But filebeat doesn't write log to file. I even added these configs:
> **Summary**
>
> logging.to\_files: true
> logging.level: debug
> logging.files:
> path: /var/log/filebeat
> name: filebeat.log
But it doesn't matter now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 6, 2019, 3:58am UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030/6 "2019-09-06T03:58:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.