# Wrong source name

**URL:** https://discuss.elastic.co/t/wrong-source-name/84723
**Category:** Logstash
**Created:** [May 5, 2017, 1:34pm UTC](https://discuss.elastic.co/t/wrong-source-name/84723 "2017-05-05T13:34:45Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![theplayer777](https://avatars.discourse-cdn.com/v4/letter/t/eada6e/32.png) [@theplayer777](https://discuss.elastic.co/u/theplayer777)
#### Post date: [May 5, 2017, 1:34pm UTC](https://discuss.elastic.co/t/wrong-source-name/84723/1 "2017-05-05T13:34:45Z")

</div>

HI there,

I have some troubles with the source field on logstash that is incorrect for som logs. Here is an example (taken from Kibana):

message: 2017-05-05 14:12:48,395 [INFO] [ID=XXXXXX] [User=] [org.my.class] Successfully loaded custom xml mappings from URL: [jar:file:/opt/[...]-0.0.4-SNAPSHOT.jar!/BOOT-INF/lib/[...]-0.0.4-SNAPSHOT.jar!/[...]]  
source: config.log

after a check, this log comes from interfaces.log

All the stack (filebeat, logstash, elasticsearch and kibana) are up to date.

Here is the (anonymized) config of filebeat

```
  prospectors:
    -
      paths:
        - /var/log/mail.log
      document_type: postfix
    -
      paths:
        - /var/log/wildfly/server.log
      document_type: wildfly
      fields_under_root: true
      force_close_files: true
      multiline:
        pattern: '^\<'
        negate: true
        match: after
    -
      paths:
        - /opt/app1/logs/backend-app.log
        - /opt/app1/logs/output.log
        - /opt/app1/logs/interface.log
        - /opt/app1/logs/config.log
      document_type: app1
      fields_under_root: true
      force_close_files: true
      multiline:
        pattern: '^\<'
        negate: true
        match: after
    -
      paths:
        - /opt/app2/log/batch.log
        - /opt/app2/log/error.log
        - /opt/app2/log/batch/**/*.log
      document_type: app2
      fields_under_root: true
      force_close_files: true
      multiline:
        pattern: '^\<'
        negate: true
        match: after

output:
  ### logstash as output
  logstash:
    enabled: true
    hosts: ["elasticsearch:5000"]
    timeout: 15
    ssl:
      # List of root certificates for HTTPS server verifications
      certificate_authorities: ["/etc/ssl/certs/logstash-.crt"]
      certificate: /etc/ssl/certs/logstash.crt
      key: /etc/pki/tls/private/logstash.key
  file:
    path: /var/log/filebeat
    filename: event
    rotate_every_kb: 10000
    number_of_files: 7

logging:
  to_files: true
  files:
    path: /var/log/filebeat
    name: filebeat
    rotateeverybytes: 104857600
    keepfiles: 3
  level: info

```

and here is logstash input config file:

```
  input {
  beats {
    port => 5000
    ssl => true
    ssl_certificate => "/etc/ssl/certs/logstash.crt"
    ssl_key => "/etc/pki/tls/private/logstash.key"
    codec => multiline {
      pattern => "^%{TIMESTAMP_ISO8601}"
      negate => true
      what => "previous"
    }

  }
}
filter {
  if [source] =~ "\/opt\/app1\/logs\/(config|backend-app|outputmgt|interface)\.log" {
    grok {
      match => ["message", "%{TIMESTAMP_ISO8601:log.timestamp} \[[]?%{LOGLEVEL:log.level}\] \[CorrelationID=(%{NOTSPACE:log.correlationId})?\] \[User=(%{NOTSPACE:log.username})?\] \[%{JAVACLASS:log.logger}\] %{GREEDYDATA:log.message}"]
    }
    date {
      match => ["log.date", "YYYY-MM-dd HH:mm:ss,SSS"]
      target => "log.date"
    }
  }
}

```

and, finally, logstash output:

```
filter {
  uuid {
    target => "@uuid"
    overwrite => true
  }
  fingerprint {
    source => ["message"]
    target => "fingerprint"
    key => "XXXXXX"
    method => "SHA1"
    concatenate_sources => true
  }

}

output {
        elasticsearch {
                hosts => ["localhost:9200"]
                sniffing => true
                manage_template => false
        # document_id => "%{fingerprint}"
        }
}

```

I don't really know what is the problem here. Thanks in advance for your help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2017, 1:48pm UTC](https://discuss.elastic.co/t/wrong-source-name/84723/2 "2017-06-02T13:48:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.