# Topbeat with redis
**URL:** https://discuss.elastic.co/t/topbeat-with-redis/34157
**Category:** Beats
**Created:** [November 9, 2015, 2:52pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157 "2015-11-09T14:52:10Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [November 9, 2015, 2:52pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/1 "2015-11-09T14:52:10Z")
topbeat version 1.0.0rc
logstash 2.0
redis
I am using the following in my logstash conf:
input {
beats {
port =\> 5044
type =\> "X"
}
}
output {
if [type] == "X" {
redis {
host =\> "192.168.99.4"
data\_type =\> "list"
key =\> "topbeat"
}
}
}
This is not working. If I comment out type in my input and output it works fine. Why is type not working. Am I missing something. I use a very similar config in other logstash files and it works just fine.
Thanks
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [November 9, 2015, 3:12pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/2 "2015-11-09T15:12:19Z")
I assume the issue here is that "type" is already used by topbeat to store data. What happens if you use instead of type for example my\_type?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 9, 2015, 5:32pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/3 "2015-11-09T17:32:41Z")
type is kind of a special field in beats and logstash. If type is already set in input event, It won't be overwritten by the configurated 'type' variable in logstash config file. See [code comment documenting behavior](https://github.com/elastic/logstash/blob/master/lib/logstash/inputs/base.rb#L15)
In case of topbeat the values of type are 'proc', 'system' and 'filesystem'. The beat its name is stored in [@metadata][beat].
Instead of 'type' you can use the ['add\_field' config option](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-add_field) to add another field with custom name to the generated event (store in [@metadata][my\_name] if you don't want to store the custom field in redis). But I'd recommend not doing so, as 'type' or custom field will add same field to every event, independent of actual event type or source making it inflexible for later additions (e.g. adding another beat to the system).
Maybe something like this better fits your use-case (untested):
```
input {
beats {
port => 5044
}
}
output {
if [@metadata] and [@metadata][beat] {
redis {
host => "192.168.99.4"
data_type => "list"
key => "%{[@metadata][beat]}"
}
}
}
```
Now every single beat you connect to logstash will produce it's own key in redis.
---
### Author:  [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [November 9, 2015, 6:39pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/4 "2015-11-09T18:39:24Z")
Thank you
This config doesn't work for some reason. If I do this
```
input {
beats {
port => 5044
}
}
output {
# if [@metadata] and [@metadata][beat] {
redis {
host => "192.168.99.4"
data_type => "list"
key => "%{[@metadata][beat]}"
}
# }
}
```
it works but not with the if statement included but the key name is literally "%{[@metadata][beat]}". It doesn't appear that "%{[@metadata][beat]}" is being picked up as a variable.
EDIT:
It appears that when I take out the if statement topbeat is still not functioning as expected. I am seeing the key in redis but other data is in there from another source not topbeat. So I think I have a more fundamental issue of logstash maybe not reading topbeat. I do see the port open using netstat and I see topbeat running using ps aux.
Is there a topbeat error log I can check
---
### Author:  [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [November 9, 2015, 7:01pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/5 "2015-11-09T19:01:54Z")
Figured it out. User error (BIG TIME). I fat fingered my host in the config file.
Thanks for the help
Side question. If I spin up multiple servers with topbeat running and use your above config, how will I be able to differentiate between them in elasticsearch?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [November 10, 2015, 6:28am UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/6 "2015-11-10T06:28:15Z")
Ever beat sends currently under the field "shipper" the hostname or the name set in the configuration. This should make it possible to differentiate between the beats. This field will change in the next release. For more details see here: [https://github.com/elastic/libbeat/issues/281](https://github.com/elastic/libbeat/issues/281)
---
### Author:  [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [November 10, 2015, 1:07pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/7 "2015-11-10T13:07:56Z")
So I've been testing the heck out of topbeat and I'm not sure if its a bug or not but using the following:
```
input {
beats {
port => 5044
add_field => { "[@metadata][stage]" => "topbeat_raw" }
}
}
output {
stdout { codec => rubydebug } metadata => true } }
}
```
I see my topbeat output but the new metadata field is not added (see below):
```
{
"@timestamp" => "2015-11-10T13:02:15.997Z",
"count" => 1,
"proc" => {
"cpu" => {
"user" => 0,
"user_p" => 0,
"system" => 0,
"total" => 0,
"start_time" => "11:59"
},
"mem" => {
"size" => 0,
"rss" => 0,
"rss_p" => 0,
"share" => 0
},
"name" => "rcuob/26",
"pid" => 83,
"ppid" => 2,
"state" => "sleeping"
},
"shipper" => "satcon99",
"type" => "proc",
"@version" => "1",
"@metadata" => {
"beat" => "topbeat",
"type" => "proc"
}
}
```
Is there a reason the add\_field syntax is not working? If I add it in a filter statement with the mutate plugin it works fine but according to the beats docs I should be able to use the add\_field syntax in the input section.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 12, 2015, 2:27am UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/8 "2015-11-12T02:27:50Z")
which beats plugin version have you installed? add\_field syntax not working was [fixed here](https://github.com/logstash-plugins/logstash-input-beats/issues/12).
You can update the plugin via:
```
$ bin/plugin update logstash-input-beats
```
---
### Author:  [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [November 12, 2015, 2:57am UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/9 "2015-11-12T02:57:26Z")
I will try checking my version tomorrow and updating if needed. Thanks for
pointing that out
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157/10 "2017-07-05T21:58:18Z")