# Auditbeat Not Sending -k tags **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [August 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/auditbeat-not-sending-k-tags/244439 "2020-08-10T16:32:13Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MikeHarness](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikeharness/32/67763_2.png) [@MikeHarness](https://discuss.elastic.co/u/MikeHarness)\ **Post date:** [August 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/auditbeat-not-sending-k-tags/244439/1 "2020-08-10T16:32:13Z")
I've just set up auditbeat on a RHEL8 box to log various commands. In the 'audit.rules.d' directory I've added a new file with entries such as: `-a always,exit -F path=/usr/bin/wget -F perm=x -k external_call` Running `ausearch -k external_call` reports correctly. If I look in Kibana, the "tags" field isn't even listed as an option in the "Available Fields" column. How can I tell where the breakdown is for the -k tags not being sent to ES? ---
**Author:** ![MikeHarness](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikeharness/32/67763_2.png) [@MikeHarness](https://discuss.elastic.co/u/MikeHarness)\ **Post date:** [August 10, 2020, 7:22pm UTC](https://discuss.elastic.co/t/auditbeat-not-sending-k-tags/244439/2 "2020-08-10T19:22:39Z")
Seems to be an issue with running auditd and auditbeat. From what I had read, if you have a new enough kernel, this shouldn't be an issue, but seems to be. If I stop auditd and restart auditbeat, tags are sent correctly. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 7, 2020, 9:22pm UTC](https://discuss.elastic.co/t/auditbeat-not-sending-k-tags/244439/3 "2020-09-07T21:22:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.