# Specify extra fields in modules (e.g Elasticsearch)

**URL:** https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948
**Category:** Beats
**Tags:** filebeat
**Created:** [November 19, 2020, 8:30am UTC](https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948 "2020-11-19T08:30:32Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [November 19, 2020, 8:30am UTC](https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948/1 "2020-11-19T08:30:33Z")

</div>

I have several log type inputs in Filebeat, these specify one or more extra fields.

E.g. a.yml for logs from app 'A', b.yml for logs from app 'B'. The extra field 'index' is set to 'index\_A' and index\_B' respectively.

Logs are sent to a Logstash output where based on the field they end up in different Elasticsearch indices.

Now, I've just enabled the elasticsearch module on a test Elasticsearch node, but I cannot find a way to specify extra fields for logs harvested by this module.

Is there a way for this? I need to be able to separate logs on the Filebeat level, so when it arrives to Logstash it already has an index field.

---

<div class="post-metadata">

### Author: ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [November 25, 2020, 5:24am UTC](https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948/2 "2020-11-25T05:24:15Z")

</div>

Every Filebeat module ends up starting a Filebeat input under the hood. And it's possible to override or set this input's settings when configuring the module. You can learn more about this capability here: [https://www.elastic.co/guide/en/beats/filebeat/current/advanced-settings.html](https://www.elastic.co/guide/en/beats/filebeat/current/advanced-settings.html)

One of the settings available to all inputs is `fields`, which allows you to set additional fields in events harvested by that input. You can learn more about this setting over here: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-fields](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-fields).

Shaunak

---

<div class="post-metadata">

### Author: ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [December 3, 2020, 9:09am UTC](https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948/3 "2020-12-03T09:09:48Z")

</div>

Hi, thank you for your reply.

This indeed was the solution!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 31, 2020, 11:10am UTC](https://discuss.elastic.co/t/specify-extra-fields-in-modules-e-g-elasticsearch/255948/4 "2020-12-31T11:10:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
