# Write log category to field

**URL:** <https://discuss.elastic.co/t/write-log-category-to-field/352000>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 29, 2024, 2:42pm UTC](https://discuss.elastic.co/t/write-log-category-to-field/352000 "2024-01-29T14:42:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonas\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jonas_s/32/97631_2.png) [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\
**Post date:** [January 29, 2024, 2:42pm UTC](https://discuss.elastic.co/t/write-log-category-to-field/352000/1 "2024-01-29T14:42:26Z")

</div>

Hello,

if i have logs like this:

```auto
2024-01-29 15:09:43,102 - ERROR - DB:Test1 - Test Error
2024-01-29 15:09:48,653 - ERROR - DB:Test2 - Test Error
2024-01-29 15:09:49,041 - ERROR - DB:Test1 - Test Error
2024-01-29 15:09:49,308 - ERROR - DB:Test1 - Test Error
2024-01-29 15:09:43,102 - ERROR - DB:Test2 - Test Error

```

And i read those logs with the filebeat filestream input, is it possible to write a custom field `fields:DB` for each document containing the db name?

The documentation only shows how to write a static string into the config like this:

```auto
filebeat.inputs:
- type: filestream
  fields:
    appName: "app1"

```

So can i do something like

```auto
filebeat.inputs:
- type: filestream
  fields:
    DB: ..processor or something..

```

that writes me the DB name, in this case Test1 or Test2 to this field for each log?

If yes, what's the best way and how to do it?

Best regards

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [January 29, 2024, 3:22pm UTC](https://discuss.elastic.co/t/write-log-category-to-field/352000/2 "2024-01-29T15:22:37Z")

</div>

> [@Jonas\_S](#):
>
> Hello,
> 
> if i have logs like this:
> 
> ```auto
> 2024-01-29 15:09:43,102 - ERROR - DB:Test1 - Test Error
> 2024-01-29 15:09:48,653 - ERROR - DB:Test2 - Test Error
> 2024-01-29 15:09:49,041 - ERROR - DB:Test1 - Test Error
> 2024-01-29 15:09:49,308 - ERROR - DB:Test1 - Test Error
> 2024-01-29 15:09:43,102 - ERROR - DB:Test2 - Test Error
> 
> ```
> 
> And i read those logs with the filebeat filestream input, is it possible to write a custom field `fields:DB` for each document containing the db name?
> 
> The documentation only shows how to write a static string into the config like this:
> 
> ```auto
> filebeat.inputs:
> - type: filestream
> fields:
> appName: "app1"
> 
> ```
> 
> So can i do something like
> 
> ```auto
> filebeat.inputs:
> - type: filestream
> fields:
> DB: ..processor or something..
> 
> ```
> 
> that writes me the DB name, in this case Test1 or Test2 to this field for each log?
> 
> If yes, what's the best way and how to do it?
> 
> Best regards

Hi,

The `dissect` processor would be a good fit for this task.

Here's an example of how you could configure it:

```auto
filebeat.inputs:
- type: filestream
  processors:
    - dissect:
        tokenizer: '%{} - ERROR - DB:%{[fields.DB]} - %{}'
        field: "message"
        target_prefix: ""

```

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2024, 5:23pm UTC](https://discuss.elastic.co/t/write-log-category-to-field/352000/3 "2024-02-26T17:23:21Z")

</div>

Closed on February 26, 2024, 5:23pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.