# Cannot get all fields in Kibana

**URL:** <https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [June 8, 2017, 9:29pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764 "2017-06-08T21:29:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\
**Post date:** [June 8, 2017, 9:29pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764/1 "2017-06-08T21:29:48Z")

</div>

I have the following `packetbeat.yml`

```
packetbeat.flows:
  period: 60s

packetbeat.interfaces.device: any

packetbeat.protocols.icmp:
  enabled: true

packetbeat.protocols.amqp:
  ports: [5672]

packetbeat.protocols.nfs:
  ports: [2049]

packetbeat.protocols.http:
  ports: [80, 8080, 8000, 5000, 8002]

output.elasticsearch:
  hosts: ["...:9200"]

```

But for some reason I am not able to see any `http`-related and other fields in Kibana:

![](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2fa806f491a14bdaadf8ae4087c7f1d929fc47da.png)

Did I do something wrong in config file?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [June 9, 2017, 10:56am UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764/2 "2017-06-09T10:56:25Z")

</div>

Do you have any HTTP events with `type: http` in the packetbeat index? Have you check any flows with supposed HTTP port numbers exist? Have you tried to reload the index in kibana?

Does packetbeat gets to see actual unencrypted HTTP traffic? You can a dump all packets being processed by packetbeat into a pcap file for inspection with wireshark (I can't recall the CLI flag right now, just run packetbeat with `-h`). Enabling debug logging (`-d '*'`) will print potential errors if HTTP parsing/processing fails.

---

<div class="post-metadata">

**Author:** ![Steve\_1](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\
**Post date:** [June 9, 2017, 7:59pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764/3 "2017-06-09T19:59:07Z")

</div>

Not sure why but this is all data I get:

```
{"@timestamp":"2017-06-09T19:55:00.747Z","beat":{"hostname":"host_name","name":"host_name",
"version":"5.3.0"},"dest":{"ip":"xx.xxx.xx.x","port":53,"stats":{"net_bytes_total":384,"net_packets_total":2}},
"final":false,"flow_id":"EAL/////AP////8I//8AAAEKb18FCm/uLzUAi7k","last_time":"2017-06-09T19:54:54.085Z",
"source":{"ip":"xx.xxx.xx.x","port":47499,"stats":{"net_bytes_total":174,"net_packets_total":2}},
"start_time":"2017-06-09T19:54:54.085Z","transport":"udp","type":"flow"}
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [June 10, 2017, 5:06pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764/4 "2017-06-10T17:06:40Z")

</div>

The flow seems to be a DNS request.

Check packetbeat logs for error or warning message. Also enable debug logging.

Have packetbeat record a pcap file for inespection with wireshark. This let's you see exactly the packets packetbeat did read from the device.

What's your full packetbeat configuration?

Do you want to monitor localhost or some other container/machine/network? Have you enabled promisc mode for you network adapter?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2017, 5:06pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764/5 "2017-07-08T17:06:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.