# Filebeat events arriving in kibana with no \_source field (no data) **URL:** \ **Category:** Kibana\ **Created:** [December 2, 2018, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-events-arriving-in-kibana-with-no-source-field-no-data/159042 "2018-12-02T12:52:43Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Alex\_L](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_l/32/42834_2.png) [@Alex\_L](https://discuss.elastic.co/u/Alex_L)\ **Post date:** [December 2, 2018, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-events-arriving-in-kibana-with-no-source-field-no-data/159042/1 "2018-12-02T12:52:43Z")
I am using Beats/Logstash/ElasticSearch/Kibana version 6.3 on CentOS 7 I have written a short pipeline that listens for incoming filebeat traffic and applys a grok filter. I have tested the filter using the Kibana Grok Debugger and the simulation gives the expected data structure from the log that is being parsed. ELK is running on the same host (only the filebeat + winlogbeat are on different hosts than ELK) In Kibana under discover I see events for filebeat-\* but they are all missing \_source (no data fields attached..) winlogbeat is registering events fine with all the expected data. Where should I be looking to start debugging this? What can I check to narrow down the problem? I'm not sure if it's related to filebeat/logstash/elastic.. I don't even know what question to ask to solve the problem, let alone the solution. ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [December 4, 2018, 1:03am UTC](https://discuss.elastic.co/t/filebeat-events-arriving-in-kibana-with-no-source-field-no-data/159042/2 "2018-12-04T01:03:07Z")
You might check if the [`_source` field is disabled](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html). Also, [here is more information on debugging Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/enable-filebeat-debugging.html). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 1, 2019, 1:03am UTC](https://discuss.elastic.co/t/filebeat-events-arriving-in-kibana-with-no-source-field-no-data/159042/3 "2019-01-01T01:03:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.