# Client\_server and server fields in packetbeat showing empty

**URL:** <https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [February 6, 2016, 6:41am UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111 "2016-02-06T06:41:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![harshafrnd4u](https://avatars.discourse-cdn.com/v4/letter/h/fbc32d/32.png) [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\
**Post date:** [February 6, 2016, 6:41am UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111/1 "2016-02-06T06:41:58Z")

</div>

I am using packetbeat for http and mysql, these services are running inside a virtual machine. "client\_server" and "server" fields are coming empty in output events. Can anyone suggest what might be the cause or any configuration to change?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [February 8, 2016, 10:17pm UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111/2 "2016-02-08T22:17:34Z")

</div>

How do you run Packetbeat? Inside the same VM? Or sniffing on the virtual switch from the host? Also, do you use the Logstash output or directly Elasticsearch?

For the `client_server` and `server` to work, you need to enable the [save\_topology](https://www.elastic.co/guide/en/beats/packetbeat/1.1/packetbeat-configuration.html#save_topology) option from the Elasticsearch output.

---

<div class="post-metadata">

**Author:** ![harshafrnd4u](https://avatars.discourse-cdn.com/v4/letter/h/fbc32d/32.png) [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\
**Post date:** [February 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111/3 "2016-02-11T08:24:11Z")

</div>

I am running packetbeat inside VM, and I am using logstash as output. I dont see save\_topology for logstash output, is there any other alternate way for logstash outpu?

Also one more interesting point, can we sniff on virtual switch from host? If so please help me how to do that. Thanks a ton!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/client-server-and-server-fields-in-packetbeat-showing-empty/41111/4 "2017-07-05T21:55:48Z")

</div>