# Why I am seeing type 1 in my logs from logstash **URL:** \ **Category:** Logstash\ **Created:** [July 11, 2018, 4:31am UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462 "2018-07-11T04:31:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![saad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saad/32/17214_2.png) [@saad](https://discuss.elastic.co/u/saad)\ **Post date:** [July 11, 2018, 4:31am UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/1 "2018-07-11T04:31:28Z")
logstash was configured to receive logs on port 517 and type was defined as "websense". in elasticsearch I am seeing two type values. Logs with value "1" and the other logs with value "websense". Why I am see type ="1"? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 11, 2018, 9:06pm UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/2 "2018-07-11T21:06:23Z")
That's of course impossible to say without seeing your configuration. Also, are you seeing _current_ documents with such a `type` value or is it possible that they're old documents produced when Logstash was misconfigured? ---
**Author:** ![saad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saad/32/17214_2.png) [@saad](https://discuss.elastic.co/u/saad)\ **Post date:** [July 12, 2018, 3:05am UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/3 "2018-07-12T03:05:37Z")
the conf file is as below. I am seeing type field with two vaules "1" and "Forcepoint". The logstash.yml is the defualt and the logs is coming from cef connector and aggregated in the cef connector before coming to logstash: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6a02047ed9a1ac4dff7e10110d2ef02f1675a5a.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b742159052e72c2bc11d76d2f66c6b002cc6c49c.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 12, 2018, 7:56am UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/4 "2018-07-12T07:56:17Z")
Maybe the cef codec under some circumstances sets the type to 1? I'm not familiar with it. ---
**Author:** ![saad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saad/32/17214_2.png) [@saad](https://discuss.elastic.co/u/saad)\ **Post date:** [July 12, 2018, 4:02pm UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/5 "2018-07-12T16:02:25Z")
I am getting now only one value "Forcepoint" for type field when I removed the aggregation in the cef connector that feeding the logstash. Any helpful comments please ---
**Author:** ![saad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saad/32/17214_2.png) [@saad](https://discuss.elastic.co/u/saad)\ **Post date:** [July 12, 2018, 4:28pm UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/6 "2018-07-12T16:28:39Z")
I found that I am having \_aggregateexception in the tag field for the aggregated logs from cef connector ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2018, 4:28pm UTC](https://discuss.elastic.co/t/why-i-am-seeing-type-1-in-my-logs-from-logstash/139462/7 "2018-08-09T16:28:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.