# Field "process.command\_line" not popluated even though I can see it in the message field

**URL:** <https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 16, 2020, 8:14pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589 "2020-11-16T20:14:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hilo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilo21/32/66272_2.png) [@hilo21](https://discuss.elastic.co/u/hilo21)\
**Post date:** [November 16, 2020, 8:14pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589/1 "2020-11-16T20:14:18Z")

</div>

Hello,

I need some orientation with my issue :

- Description : I have an ELK stack version 7.6 that collects event logs from different log sources via logstash. All endpoints (windows ends linux) send logs to logstash then logstash frowards them to Elasticsearch. No actions are done by logstash this is only so that I can have a global index under "ecs-organisation-\*". Lately, after installation of sysmon on some windows server, I noticed that all the fields are populated except for process.command\_line. First i thought this is only related to winlogbeat but after exploring auditbeat logs i found the same issue, meaning I can see fields like process.args, process.executable, process.working\_directory populated with values except for process.command\_line.
- Mapping : I use the ecs mapping template from github for all the data coming to elasticsearch. the template is applied on indexes starting sith ecs-\*. I have no mapping conflicts regarding the field process.command\_line.
- Data is indexed as follow :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1f4ab9638e58af49594aaeefe449299177e85fa.png)
- The field value is sent by the endpoint and included in message :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61fcd68520417e77ce12c1309dd85d9a10718def.png)
- All the other fields are extracted :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0ca3727cf3133987d6af7363600217bbf0254202.png)
- Except for process.command\_line :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d337fe73f1a0523949381c88083fb7806e28d51f.png)

Before i go and reindex my data. I would love to understand what can cause this kind of situation.

Thank you so much for all the help you're providing.

---

<div class="post-metadata">

**Author:** ![hilo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilo21/32/66272_2.png) [@hilo21](https://discuss.elastic.co/u/hilo21)\
**Post date:** [November 17, 2020, 9:53pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589/2 "2020-11-17T21:53:12Z")

</div>

Anyone can give me where this problem can be caused from please ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2020, 11:53pm UTC](https://discuss.elastic.co/t/field-process-command-line-not-popluated-even-though-i-can-see-it-in-the-message-field/255589/3 "2020-12-15T23:53:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.