Filebeat system module does not send process name

Elastic Stack Beats
1

Does anyone encounter this?

image
image649×508 10.8 KB

There is no data in field: process name

2

Hi @Cruz

Did you filter events in discovery? Did you check if you have any date/time filters that could harm the dashboard?

A good tip is to confirm if there are process events being collected by the agents, through the discovery module.

Best regards

3

Hi @grfneto, thank you for your kind response.

I tried to filter it on the discovery module but there is no logs found.

image
image1900×808 83.8 KB

What is the problem with this?
my filebeat shipper installed on my test server in Ubuntu OS.
I installed a new Ubuntu OS and tried to setup the filebeat there but encountered the same issue.
I just followed the instruction here Filebeat Installation GUIDE

I am using ELK version 8.7.0 and filebeat is also version 8.7.0

4

Hi @Cruz

Does your filebeat send any data to elasticsearch?

Could you share with us filebeat.yml

5

BTW that is an invalid KQL query should be

process.name: *

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.