# Bucket split group terms data coming in missing through filebeat

**URL:** <https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [January 11, 2023, 6:12am UTC](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869 "2023-01-11T06:12:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![devdev7711](https://avatars.discourse-cdn.com/v4/letter/d/3be4f8/32.png) [@devdev7711](https://discuss.elastic.co/u/devdev7711)\
**Post date:** [January 11, 2023, 6:12am UTC](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869/1 "2023-01-11T06:12:56Z")

</div>

![1](https://us1.discourse-cdn.com/elastic/original/3X/3/f/3f986e0e84f2fe9bee65904780744f7fd88f28ea.png)  
 ![2](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ea896efedab3e76658ef5b0dfb2ec5012525f10.png)  
We are using filebeat to read logs we have 2 logs entry count but when we are doing metrics bucket split group aggregation that time these 2 records are not visible those are coming in missing.

below is the log details when we discover

| Jan 11, 2023 @ 11:20:50.003 | @timestamp:Jan 11, 2023 @ 11:20:50.003 cloud.provider:gcp cloud.instance.id:6266342169768528032 cloud.instance.name:gmuvmd27116-011 cloud.machine.type:e2-medium cloud.availability\_zone:asia-south1-a cloud.project.id:dev-27116 log.file.path:C:\ProgramData\UNO\SES\Logs\vs00776071\UnoSES11012023.log log.offset:2,508 message:11-Jan-2023 11:20:49 INFO : ExecuteDeployment: END : Output :: execProcessModel ={strStartTime:01/11/2023 11:20:49,strEndTime:01/11/2023 11:20:49,inputArgs:null,InvokedBy:null,AcknowledgementAPI:null,outputArgs:null,Activebots:0,JobName:null,ScheduleName:null,NextRunTime:null,isHolidayExecutionNotRequired:false,IsQueueRequired:false,ProcessName:proc2,ProcessVersion:11123055029.1,Status:Deployed,TotalTimeTakenInSeconds:0.0,ExecType:Deploy,CmdType:Start,TxnId:52,Guid:00000000-0000-0000-0000-000000000000,BotName:11,DeployInputs:{fileName:proc2\_11123055029.1.zip,downloadUrl:proc2\_11123055029.1.zip,checksum:9B22317D89B82E80B406DA141F170DC938C7D649BFECFDAF03E612484280FBB4,contentLength:1613},ExecuteProcessOutputDetail:null,ExecuteProcessIntermediateResult:null} input.type:log ecs.version:1.1.0 host.name:11 agent.version:7.5.0 agent.type:filebeat agent.ephemeral\_id:f80dd79f-613b-4d27-ad60-38238064af79 agent.hostname:11 agent.id:50b10be1-f039-49af-97a2-b65f34b432fd \_id:k8hhn4UBgNX4d1QAmxpO \_type:\_doc \_index:filebeat-7.5.0-2023.01.11-000001 \_score: - |
| --- | --- |
| Jan 11, 2023 @ 11:20:49.987 | @timestamp:Jan 11, 2023 @ 11:20:49.987 log.file.path:C:\ProgramData\UNO\SES\Logs\vs00776071\UnoSES11012023.log log.offset:1,682 message:11-Jan-2023 11:20:47 INFO : ExecuteDeployment: START : INputs :: execProcessModel ={strStartTime:null,strEndTime:null,inputArgs:null,InvokedBy:null,AcknowledgementAPI:null,outputArgs:null,Activebots:0,JobName:null,ScheduleName:null,NextRunTime:null,isHolidayExecutionNotRequired:false,IsQueueRequired:false,ProcessName:proc2,ProcessVersion:11123055029.1,Status:InProgress,TotalTimeTakenInSeconds:0.0,ExecType:Deploy,CmdType:Start,TxnId:52,Guid:00000000-0000-0000-0000-000000000000,BotName:11,DeployInputs:{fileName:proc2\_11123055029.1.zip,downloadUrl:proc2\_11123055029.1.zip,checksum:9B22317D89B82E80B406DA141F170DC938C7D649BFECFDAF03E612484280FBB4,contentLength:1613},ExecuteProcessOutputDetail:null,ExecuteProcessIntermediateResult:null} input.type:log host.name:11 agent.ephemeral\_id:f80dd79f-613b-4d27-ad60-38238064af79 agent.hostname:11 agent.id:50b10be1-f039-49af-97a2-b65f34b432fd agent.version:7.5.0 agent.type:filebeat ecs.version:1.1.0 cloud.instance.name:gmuvmd27116-011 cloud.instance.id:6266342169768528032 cloud.machine.type:e2-medium cloud.availability\_zone:asia-south1-a cloud.project.id:dev-27116 cloud.provider:gcp \_id:kshhn4UBgNX4d1QAmxpO \_type:\_doc \_index:filebeat-7.5.0-2023.01.11-000001 \_score: - |

if we look into result of discover host.name value is coming why it is considering missing

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2023, 6:12am UTC](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869/2 "2023-02-08T06:12:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.