# Filebeat system module does not send process name

**URL:** <https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 23, 2023, 4:13am UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423 "2023-08-23T04:13:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cruz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cruz/32/116126_2.png) [@Cruz](https://discuss.elastic.co/u/Cruz)\
**Post date:** [August 23, 2023, 4:13am UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/1 "2023-08-23T04:13:42Z")

</div>

Does anyone encounter this?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2108629d557c1467ed7cbcc90d27715bbe8abed.png)

There is no data in field: process name

---

<div class="post-metadata">

**Author:** ![grfneto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grfneto/32/125776_2.png) [@grfneto](https://discuss.elastic.co/u/grfneto)\
**Post date:** [August 23, 2023, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/2 "2023-08-23T17:28:57Z")

</div>

Hi @Cruz

Did you filter events in discovery? Did you check if you have any date/time filters that could harm the dashboard?

A good tip is to confirm if there are process events being collected by the agents, through the discovery module.

Best regards

---

<div class="post-metadata">

**Author:** ![Cruz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cruz/32/116126_2.png) [@Cruz](https://discuss.elastic.co/u/Cruz)\
**Post date:** [August 23, 2023, 11:49pm UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/3 "2023-08-23T23:49:16Z")

</div>

Hi @grfneto, thank you for your kind response.

I tried to filter it on the discovery module but there is no logs found.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5e15254ccb1eb3bbf41454b790f8722fbf953c5.png)

What is the problem with this?  
my filebeat shipper installed on my test server in Ubuntu OS.  
I installed a new Ubuntu OS and tried to setup the filebeat there but encountered the same issue.  
I just followed the instruction here [Filebeat Installation GUIDE](https://www.elastic.co/guide/en/beats/filebeat/8.7/filebeat-installation-configuration.html)

I am using ELK version 8.7.0 and filebeat is also version 8.7.0

---

<div class="post-metadata">

**Author:** ![grfneto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grfneto/32/125776_2.png) [@grfneto](https://discuss.elastic.co/u/grfneto)\
**Post date:** [August 24, 2023, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/4 "2023-08-24T19:10:54Z")

</div>

Hi @Cruz

Does your filebeat send any data to elasticsearch?

Could you share with us filebeat.yml

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 24, 2023, 10:25pm UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/5 "2023-08-24T22:25:00Z")

</div>

BTW that is an invalid KQL query should be

`process.name: *`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 22, 2023, 12:25am UTC](https://discuss.elastic.co/t/filebeat-system-module-does-not-send-process-name/341423/6 "2023-09-22T00:25:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.