# Filebeat and packetbeat not sending \_source data **URL:** \ **Category:** Beats\ **Created:** [June 11, 2018, 6:58am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300 "2018-06-11T06:58:51Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 11, 2018, 6:58am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/1 "2018-06-11T06:58:52Z")
Hi, Before 3 days, all beats are sending data properly on my elastic instance. I was noticed new version is available. So, I upgraded all beats including elastic and kiban from 6.2.3 to 6.2.4. (i am using all beats accept winlog.) After up-gradation, everything working as it is, accept **filebeat** and **packetbeat** not sending **\__source data_** to elastic search. On kibana's discover tab, only date is showing and next \_source is empty. But i can see some hits are coming by upper side graph's visualization. I checked everything(from last 2days), but don't know what i missed... Please suggest me, regarding it. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [June 11, 2018, 3:19pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/2 "2018-06-11T15:19:08Z")
@shivang_patel I've taken a look a the changelog between 6.2.3 and 6.2.4 and I don't see any changes related to the mapping, the `_source` field is managed on the Elasticsearch side, I've tested with FB 6.2.4 with the default template mapping and the `_source` is included. ```auto { "_index": "filebeat-6.2.4-2018.06.11", "_type": "doc", "_id": "yg9p72MBFf8FPI8lp7i7", "_version": 1, "_score": null, "_source": { "@timestamp": "2018-06-11T15:14:27.922Z", "message": "Jun 11 11:14:22 sashimi login[3765]: USER_PROCESS: 3765 ttys005", "prospector": { "type": "log" }, "beat": { "hostname": "sashimi", "version": "6.2.4", "name": "sashimi" }, "source": "/var/log/system.log", "offset": 120742 }, "fields": { "@timestamp": [ "2018-06-11T15:14:27.922Z" ] }, "sort": [ 1528730067922 ] } ``` Did you change the default mapping? Can you create a [gist](https://gist.github.com/) with the output of the following call? [http://localhost:9200/filebeat\*/\_mapping/doc](http://localhost:9200/filebeat*/_mapping/doc) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 11, 2018, 3:56pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/3 "2018-06-11T15:56:18Z")
I know we added the ability to disable \_source in the generated index templates. But the configuration to disable source is commented out in the config files we distribute with the Beats. If you're letting the Beat generate the index template, then did you uncomment this option? > ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 11, 2018, 5:12pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/4 "2018-06-11T17:12:56Z")
Ya. I already tried this option. but I don't know, why it's not working for me ! ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 11, 2018, 5:15pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/5 "2018-06-11T17:15:43Z")
No. I did not change any default mapping. I will post "[http://localhost:9200/filebeat\*/\_mapping/doc](http://localhost:9200/filebeat*/_mapping/doc)" output tomorrow at morning. ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 12, 2018, 5:40am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/6 "2018-06-12T05:40:43Z")
as per your request : [https://gist.github.com/shivangpatel/5ce46779daf95678388c0aa56714aac1](https://gist.github.com/shivangpatel/5ce46779daf95678388c0aa56714aac1) ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 12, 2018, 6:48am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/7 "2018-06-12T06:48:28Z")
@pierhugues : as per your suggestion, I observe that output and I can see ``` "_source": { "enabled": false }, ``` is still false ! So, Can you tell me how to make it true ? I already changed in filebeat.yml file. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [June 12, 2018, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/8 "2018-06-12T15:33:39Z")
@shivang_patel I think the easiest way to get running is to delete the template mapping and let Filebeat create it again, make sure `_source.enabled: false` is commented before starting it. To delete the template: ```auto curl -X DELETE "localhost:9200/_template/filebeat-6.2.4" ``` The newly indexed data will have the \_source. ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 13, 2018, 4:51am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/9 "2018-06-13T04:51:51Z")
Sorry, but it's not working ! Actually, `GET /_template/filebeat` results showing ``` "_source": { "enabled": true } ``` But,`https://myurl.in/elastic/filebeat*/_mapping/doc` still showing false ! ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [June 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/10 "2018-06-13T14:24:00Z")
Sorry, let me clarify what I've said previously. The way **template** works are to dynamically assign a specific mapping to a matching `index_pattern`, in your case "filebeat-6.2.4-\*". So when Filebeat creates a new indice that match the pattern the mapping will be automatically applied. If you look at the mapping for the created index after your change, the `_source.enabled` should be set to true. Previously created indices mapping won't change, the only way to change it is to reindex your data. But in your case you want to have access to the `_source`, this field contains the original JSON data, when `_source.enabled` is set to false we don't persist it, **It is gone**. The only way to have it is to reindex your data from the original file. ---
**Author:** ![shivang\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivang_patel/32/18594_2.png) [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Post date:** [June 14, 2018, 9:50am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/11 "2018-06-14T09:50:51Z")
Thanks it's working 👍 And this last information is very informative. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2018, 11:51am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300/12 "2018-07-12T11:51:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.