# Fleet Integration Adding Cloud Fields to an Index from Elastic Agent's filebeat.yml

**URL:** <https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109>\
**Category:** Elastic Agent\
**Tags:** fleet, filebeat\
**Created:** [August 15, 2022, 2:10pm UTC](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109 "2022-08-15T14:10:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![othman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othman/32/109872_2.png) [@othman](https://discuss.elastic.co/u/othman)\
**Post date:** [August 15, 2022, 2:10pm UTC](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109/1 "2022-08-15T14:10:44Z")

</div>

I'm having an issue where some rogue configuration is adding `cloud` fields to the documents of one my indices. In particular, it looks like there is some `add_cloud_metadata: ~` processor running somewhere.

After much troubleshooting, I've confirmed that no index template or component template contains the `add_cloud_metadata: ~` processor.

However, I've discovered on the elastic agent itself, it seems the file `/opt/Elastic/Agent/data/elastic-agent-<ID>/data/install/filebeat-<VER>/filebeat.yml` is applying `add_cloud_metadata: ~` config. Apart from commenting the line out directly, is there another way of managing this config, ideally from the Fleet Server itself (GUI or API)?

---

<div class="post-metadata">

**Author:** ![othman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/othman/32/109872_2.png) [@othman](https://discuss.elastic.co/u/othman)\
**Post date:** [August 15, 2022, 2:29pm UTC](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109/2 "2022-08-15T14:29:24Z")

</div>

So it looks like this issue has been discussed before and there isn't a way via GUI or API as far as this post goes: [[Elastic Agent] Overwrite global processor settings · Issue #129 · elastic/elastic-agent · GitHub](https://github.com/elastic/elastic-agent/issues/129)

In short, filebeat and other beats have global processors running by default that are not managed by a Fleet Server. Just need to manually comment or remove them if they are causing noise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/fleet-integration-adding-cloud-fields-to-an-index-from-elastic-agents-filebeat-yml/312109/3 "2022-09-12T14:29:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
