# Filebeat pipeline for elasticsearch slowlog not indexing/parsing slowlog\_took (slowlog.duration)

**URL:** <https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 24, 2020, 8:57am UTC](https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777 "2020-09-24T08:57:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jiri\_Petak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jiri_petak/32/69174_2.png) [@Jiri\_Petak](https://discuss.elastic.co/u/Jiri_Petak)\
**Post date:** [September 24, 2020, 8:57am UTC](https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777/1 "2020-09-24T08:57:57Z")

</div>

Hi, i have a question about filebeat elasticsearch module and it’s slowlog pipeline part. I found that in `filebeat-7.7.0-elasticsearch-slowlog-pipeline-json` which is default pipeline in fb 7.7.0 version, there is parsed `elasticsearch.slowlog.duration` field with long type. But i cannot find it in saved/parsed docs (logs) in elasticsearch, where that pipeline is installed and logs are send.

Log message is parsed by pipeline because i can see other fields, but this field which is pretty major for use is not. There is field `elasticsearch.slowlog.took` but it’s keyword and it’s useless for creating visualisations (longest slowlog query, etc…).

I found that in filebeat-7.7.0 index template mapping field `elasticsearch.slowlog.duration` is missing so is that some bug? Or i am missing something?

It's odd because of field like slowlog took which will be integer, slowlogs are useless for kibana's visualisations/dashboards. If you cannot sort or agregate by time how long slowlog took, you can't use that logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2020, 10:57am UTC](https://discuss.elastic.co/t/filebeat-pipeline-for-elasticsearch-slowlog-not-indexing-parsing-slowlog-took-slowlog-duration/249777/2 "2020-10-22T10:57:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.