# Fields removed from Filebeat Zeek Module/Pipeline

**URL:** <https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [July 7, 2021, 6:57am UTC](https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029 "2021-07-07T06:57:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![valhalla](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@valhalla](https://discuss.elastic.co/u/valhalla)\
**Post date:** [July 7, 2021, 6:57am UTC](https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029/1 "2021-07-07T06:57:19Z")

</div>

Hi team,

I need some help regarding some fields that are being removed from one version to another. I am using ES 7.13.2. Some fields from this Zeek module/pipeline were available under older ES/ ECS versions, that are currently not available anymore. I am using Zeek 4.0.0

Unavailable fields:

Zeek. Connection: temp.duration, zeek.connection.local\_orig and zeek.connection.local\_resp

Other: network.bytes, network.packets and network.direction that were used in conn, dce/rpc, dns, http, ssl, smtp, x509 etc

How can I make them visible in pipeline? Just to really understand the situation, I have some charts that are using those fields and while migrating my arhitecture to last version I loose my chart functionality.

Could you please advise about how can I make them visible in the default pipelines?

Thank you for your answer!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2021, 6:58am UTC](https://discuss.elastic.co/t/fields-removed-from-filebeat-zeek-module-pipeline/278029/2 "2021-08-04T06:58:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.