# "Unknown" logs in observability overview

**URL:** <https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240>\
**Category:** Logs\
**Created:** [May 18, 2021, 7:04am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240 "2021-05-18T07:04:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mar-ro](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@mar-ro](https://discuss.elastic.co/u/mar-ro)\
**Post date:** [May 18, 2021, 7:04am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240/1 "2021-05-18T07:04:49Z")

</div>

Good morning. When I click on the menu called "Observability Overview" it shows me an image with "Logs per minute rate" but all the bars in this image appear as "Unknown". I was searching in this forum and I could find [another user who has the same question as me](https://discuss.elastic.co/t/log-source-unknown-in-observability-overview/262568), but I still don't know how to change this "label" called "Unknown" to a custom one. From what I saw answered to this other user I understand that it can be done using logstash but can I do it directly from the filebeat configuration? Thanks!

---

<div class="post-metadata">

**Author:** ![felixbarny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarny/32/27341_2.png) [@felixbarny](https://discuss.elastic.co/u/felixbarny)\
**Post date:** [May 18, 2021, 10:34am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240/2 "2021-05-18T10:34:58Z")

</div>

As described in the thread you linked, your best bet would be to use ECS loggers and to define the `event.dataset` field. If that's not an option, you can use an [`add_fields` processor](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html) to manually add this field in your Filebeat configuration.

Example:

```auto
processors:
  - add_fields:
      target: ''
      fields:
        event:
          dataset: my-app.log

```

---

<div class="post-metadata">

**Author:** ![mar-ro](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@mar-ro](https://discuss.elastic.co/u/mar-ro)\
**Post date:** [May 18, 2021, 12:00pm UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240/3 "2021-05-18T12:00:23Z")

</div>

Thank you very much for your reply Felix.  
In my `/etc/filebeat/filebeat.yml` file I have the following:

```auto
# ============================== Filebeat inputs ===============================
filebeat.config.inputs:
  enabled: true
  path: inputs.d/*.yml

```

And in `/etc/filebeat/inputs.d/` I have the files `nginx.yml` and `crontab.yml` among others.  
I tried to include the code you indicated in the `nginx.yml` and `crontab.yml` file but modifying the dataset value but when I restart the filebeat service it fails. I looked up the processors documentation and found this [Define processors | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid) , according to which I understand that I could include a processors field inside an input (like the ones I have in `nginx.yml` and `crontab.yml`) but despite that, it still crashes when restarting the service.

I tried to include this processors field only in `/etc/filebeat/filebeat.yml` and there it doesn't fail, but of course, I can't distinguish between the different datasets. I think the solution could be to use the `when` tag, but I'm not sure how to use it to identify the file path, that is, that the value of the dataset is the same as the file path, is this possible?

Thank you very much in advance.

Best regards

---

<div class="post-metadata">

**Author:** ![felixbarny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarny/32/27341_2.png) [@felixbarny](https://discuss.elastic.co/u/felixbarny)\
**Post date:** [May 20, 2021, 8:29am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240/4 "2021-05-20T08:29:58Z")

</div>

> [@mar-ro](#):
>
> I could include a processors field inside an input (like the ones I have in `nginx.yml` and `crontab.yml` )

What's the error message you get?  
How does your `nginx.yml` look like?

> [@mar-ro](#):
>
> the value of the dataset is the same as the file path, is this possible?

I'm out of my depth here, not sure if that's possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2021, 8:30am UTC](https://discuss.elastic.co/t/unknown-logs-in-observability-overview/273240/5 "2021-06-17T08:30:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.