# Sending filebeat to logstash loses system fields

**URL:** https://discuss.elastic.co/t/sending-filebeat-to-logstash-loses-system-fields/124736
**Category:** Logstash
**Created:** [March 20, 2018, 11:07am UTC](https://discuss.elastic.co/t/sending-filebeat-to-logstash-loses-system-fields/124736 "2018-03-20T11:07:15Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![KevSex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevsex/32/29031_2.png) [@KevSex](https://discuss.elastic.co/u/KevSex)
#### Post date: [March 20, 2018, 11:07am UTC](https://discuss.elastic.co/t/sending-filebeat-to-logstash-loses-system-fields/124736/1 "2018-03-20T11:07:16Z")

</div>

Hi all,

Have been setting up ELK stack and hitting some issues that's been bugging me for a while.

When I set up FileBeat (RHEL server) to output to ES, everthing seems to work correctly in that I'm able to filter by system.auth.ssh.event etc  
However when I update FileBeat to go through Logstash (not filters), it arrives in ES and viewable in Kibana however the message is not being fully matched (not sure how else to explain it). i.e none of the system.\* fields are available.

Have trolled through various topics and SO to no avail.

I thought originally it might have been a filter missing on Logstash but noticed there was plugins that I could use and assume this should cover the basic pattern matches.

Is there something obvious I'm missing here?

input.conf

```
input {
 beats {
  port => 5044
  host => "10.202.11.6"
 }
}

```

filter.conf

```
filter {
  if "filebeat" in [tags] {
    mutate {
    add_tag => "DEBUGTAG"
  }
}

```

output.conf

```
output {
  if "DEBUGTAG" in [tags]{
    stdout {
      codec => rubydebug
    }
  }
  if "filebeat" in [tags] {
   elasticsearch {
     hosts => ["10.202.11.4:9200"]
     user => "elastic"
     password => "s3cR3t"
     index => "filebeat-%{+YYYY.MM.dd}"
  }
}

```

filebeat.yml

```
filebeat.prospectors:
- type: log 
  enabled: true
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true   
setup.template.settings:
tags: ["filebeat"]
output.logstash:
  hosts: ["10.202.11.6:5044"]

```

Cheers,  
Kev

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2018, 11:07am UTC](https://discuss.elastic.co/t/sending-filebeat-to-logstash-loses-system-fields/124736/2 "2018-04-17T11:07:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.