# Some questions about Filebeat that are not clear in the docs **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 11, 2019, 11:19am UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172 "2019-06-11T11:19:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jesusgn90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesusgn90/32/26998_2.png) [@jesusgn90](https://discuss.elastic.co/u/jesusgn90)\ **Post date:** [June 11, 2019, 11:19am UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/1 "2019-06-11T11:19:03Z")
Hi team, just some quick questions: 1. Can Filebeat setup a pipeline in Elasticsearch like it does with the template? What I meant is that I can send a JSON index template from FIlebeat to Elasticsearch using `setup.template.json.path: "/etc/filebeat/wazuh-template.json"`, is there something similar to send ingest pipelines? 2. How can I tell Filebeat that the time field for reference should be `myfield` instead of `@timestamp`? This question is about using `%{+yyyy.MM.dd}` in the Elasticsearch output, it takes `@timestamp` but it would be nice if I can change it. 3. How can I use `%{+yyyy.MM.dd}` for other fields than `@timestamp` (related to 2. ) ? 4. Can I split/extract strings from a field? Use case: my JSOn log has `"id": "11:22"` how can I extract 11 and 12 into different fields before sending it to Elasticsearch? **Important note 1** : I know most things can be achieved using Logstash, this use case has no Logstash. **Important note 2** : Some other things can be achieved using some ingest pipes in Elasticsearch, but I want to avoid doing a curl to Elasticseach and leave most of the logic to Filebeat when possible. Thanks in advance, you guys are doing a great job. Regards, ---
**Author:** ![jesusgn90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesusgn90/32/26998_2.png) [@jesusgn90](https://discuss.elastic.co/u/jesusgn90)\ **Post date:** [June 13, 2019, 7:41am UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/2 "2019-06-13T07:41:55Z")
Any news guys? ---
**Author:** ![maxozerov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxozerov/32/48068_2.png) [@maxozerov](https://discuss.elastic.co/u/maxozerov)\ **Post date:** [June 13, 2019, 6:10pm UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/3 "2019-06-13T18:10:42Z")
Hi, jesusgn90! I quickly read your questions, and the answers are yes, it can be done with filebeat 1. When your write module - filebeat create ingest pipelines 2. In kibana you can setup timestamp field, in elastic - its template (set correct type to field) 3. templates (mappings) 4. yeah, its module (regexp, patterns) ---
**Author:** ![maxozerov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxozerov/32/48068_2.png) [@maxozerov](https://discuss.elastic.co/u/maxozerov)\ **Post date:** [June 13, 2019, 6:14pm UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/4 "2019-06-13T18:14:49Z")
although, after reading more carefully, need to allocate time and answer them ... my answer is higher, in some points it is not quite correct. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 13, 2019, 10:17pm UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/5 "2019-06-13T22:17:31Z")
1. What @maxozerov said about this is correct. This is only possible with modules today. For instance, the `apache` module defines an ingest pipeline for parsing Apache HTTP server access logs here: [https://github.com/elastic/beats/tree/master/filebeat/module/apache/access/ingest](https://github.com/elastic/beats/tree/master/filebeat/module/apache/access/ingest). 2. `@timestamp` is a fundamental and, in fact, required field in all Beats events. There is no way to override it. Given that, perhaps you could just copy the value of `myfield` to the `@timestamp` field? Perhaps [https://www.elastic.co/guide/en/elasticsearch/reference/master/date-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/date-processor.html) could help? 3. See 2. 4. Perhaps [https://www.elastic.co/guide/en/elasticsearch/reference/master/split-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/split-processor.html) could help? Cheers, Shaunak ---
**Author:** ![jesusgn90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesusgn90/32/26998_2.png) [@jesusgn90](https://discuss.elastic.co/u/jesusgn90)\ **Post date:** [June 14, 2019, 9:29am UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/6 "2019-06-14T09:29:11Z")
Hi @maxozerov, @shaunak, Thanks for the replies. 1. I thought the same, then we need an improvement for this, it would be great, there are multiple use cases. 2, 3 and 4. Yes, processors and more processors, so the question here is: Is there a way to have a processor in Elasticsearch without doing a curl to enable it? Regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2019, 9:29am UTC](https://discuss.elastic.co/t/some-questions-about-filebeat-that-are-not-clear-in-the-docs/185172/7 "2019-07-12T09:29:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.