# Elapsed filter with filebeat

**URL:** <https://discuss.elastic.co/t/elapsed-filter-with-filebeat/204633>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 22, 2019, 11:10am UTC](https://discuss.elastic.co/t/elapsed-filter-with-filebeat/204633 "2019-10-22T11:10:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [October 22, 2019, 11:10am UTC](https://discuss.elastic.co/t/elapsed-filter-with-filebeat/204633/1 "2019-10-22T11:10:00Z")

</div>

Hi,

I used to work with elasticsearch, locally on my computer (using 'file' as input) and now we moved to work with filebeat and with 'S3' as input.  
Until now everything worked just fine with the elapsed filter, but now the new elapsed events don't appear in Kibana.

I do get the following message:" [2019-10-22T10:41:14,485][INFO][logstash.filters.elapsed] Elapsed timeout: 100000 seconds", but as I said there aren't any new elapsed event or ant failure tags (like "elapsed\_end\_without\_start","elapsed"...)

What am I missing? Do I need to create any particular configuration to make that work with filebeat?

Thank you!

---

<div class="post-metadata">

**Author:** ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)\
**Post date:** [October 23, 2019, 3:56pm UTC](https://discuss.elastic.co/t/elapsed-filter-with-filebeat/204633/2 "2019-10-23T15:56:37Z")

</div>

To understand your setup -- it seems like prior to Filebeat you were using logstash, is that right? (the elapsed filter is part of logstash). Are you now sending data from Filebeat to logstash to elasticsearch, or directly to elasticsearch? Can you share your `filebeat.yml` so we can troubleshoot what might be happening?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2019, 3:56pm UTC](https://discuss.elastic.co/t/elapsed-filter-with-filebeat/204633/3 "2019-11-20T15:56:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.