# Filebeat 7.17, error "cannot access method/field \[size\] from a null def reference" while trying to download IOCs from MISP

**URL:** https://discuss.elastic.co/t/filebeat-7-17-error-cannot-access-method-field-size-from-a-null-def-reference-while-trying-to-download-iocs-from-misp/359272
**Category:** Beats
**Tags:** filebeat
**Created:** [May 10, 2024, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-7-17-error-cannot-access-method-field-size-from-a-null-def-reference-while-trying-to-download-iocs-from-misp/359272 "2024-05-10T15:52:45Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![davekiny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davekiny/32/134381_2.png) [@davekiny](https://discuss.elastic.co/u/davekiny)
#### Post date: [May 10, 2024, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-7-17-error-cannot-access-method-field-size-from-a-null-def-reference-while-trying-to-download-iocs-from-misp/359272/1 "2024-05-10T15:52:45Z")

</div>

Hello Everyone,  
I'm trying to enable MISP integration, using the threatintel module.  
Seems that the agent s not able to download the IOCs and I can see only one document in Elastic, with this error message:

`cannot access method/field [size] from a null def reference`

I cannot see any error message (related to MISP or Threatintel module) in the log files.

This is my config:

```auto
misp:
    enabled: true
    var.input: httpjson
    var.url: https://MY_MISP_INSTANCE/events/restSearch
    var.api_token: MY_TOKEN
    var.ssl.verification_mode: none
    var.first_interval: 100h
    var.interval: 5m

```

Thanks for your support.