# Issue: Adds all available datetime fields from index template with empty value, when add date\_index\_name processor in pipeline of filebeat fortinet module **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 10, 2020, 11:04am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680 "2020-07-10T11:04:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![umeshnagori](https://avatars.discourse-cdn.com/v4/letter/u/90db22/32.png) [@umeshnagori](https://discuss.elastic.co/u/umeshnagori)\ **Post date:** [July 10, 2020, 11:04am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/1 "2020-07-10T11:04:18Z")
**ISSUE** Adds all available datetime fields from index template with empty value (even those fields those are otherwise used by disabled modules and disabled) , when add date\_index\_name processor in pipeline of filebeat fortinet module. **Elasticsearch version** : 7.8.0 **Kibana version** : 7.8.0 **Filebeat version** : 7.8.0 **JVM version** : openjdk version "1.8.0\_252" OpenJDK Runtime Environment (build 1.8.0\_252-8u252-b09-1ubuntu1-b09) OpenJDK 64-Bit Server VM (build 25.252-b09, mixed mode) **OS version** : Linux elastic 5.4.0-40-generic #44-Ubuntu SMP Tue Jun 23 00:01:04 UTC 2020 x86\_64 x86\_64 x86\_64 GNU/Linux **Description of the problem including expected versus actual behavior** : I wanted to create the dyname index name for fortinet logs using the date from the log entry. So in the pipeline.yml for the fortinet module, I added following processor. ```auto - date_index_name: index_name_prefix: "filebeat-7.8.0-firewall-" field: fortinet.firewall.date date_formats: - "yyyy-MM-dd" date_rounding: "d" ``` This does create the proper index name using the date value from the firewall log entry. But when the log data is processed with this updated pipeline, for each log record doc, it adds all available data-time fields from the respective index template (that are even of other modules in filebeat which are disabled) with empty value. And if we don't have this processor added in the pipeline, it works okay except that I can have dynamic index name using the date from the log record. For your information, I have only Fortinet module enable for the filebeat. **Steps to reproduce** : 1. Install and configure the filebeat and enable fortinet module. 2. Configured fortinet module to use "file" input for the syslogs of Fortinet logs. 3. Run the filebeat module without and changes in the pipeline with the logs being feed to it. 4. Logs are processed and the index docs are created with only required field for the Fortinet module. 5. Now delete the indexes, to reprocess logs with update pipeline for fortinet module. 6. Update the injest/pipeline.yml for fortinet.firewall module to add the above mention processor code after the kv processor. 7. Setup this update pipeline using the "filebeat setup --pipelines" command. 8. Clean the file registry to reprocess the fortinet logs. 9. This time, it adds all available datetime fields from index template (even ones those are from disabled modules) with empty value which are not even being process by fortinet pipelines. Please guide me on the same, if I am doing anything wrong. I don't want fields from other modules (even ones those are disable) in docs of indexes for the fortinet logs. ---
**Author:** ![tjfred](https://avatars.discourse-cdn.com/v4/letter/t/e9c0ed/32.png) [@tjfred](https://discuss.elastic.co/u/tjfred)\ **Post date:** [July 17, 2020, 12:52pm UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/2 "2020-07-17T12:52:45Z")
i am also seeing the exact same behaviour ---
**Author:** ![umeshnagori](https://avatars.discourse-cdn.com/v4/letter/u/90db22/32.png) [@umeshnagori](https://discuss.elastic.co/u/umeshnagori)\ **Post date:** [July 22, 2020, 10:55am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/3 "2020-07-22T10:55:09Z")
Haven't heard any comments or solutions on this from elastic experts. ---
**Author:** ![tjfred](https://avatars.discourse-cdn.com/v4/letter/t/e9c0ed/32.png) [@tjfred](https://discuss.elastic.co/u/tjfred)\ **Post date:** [July 28, 2020, 8:04am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/4 "2020-07-28T08:04:10Z")
this was a bug [https://github.com/elastic/kibana/issues/69545](https://github.com/elastic/kibana/issues/69545) - now fixed in 7.8.1 ---
**Author:** ![umeshnagori](https://avatars.discourse-cdn.com/v4/letter/u/90db22/32.png) [@umeshnagori](https://discuss.elastic.co/u/umeshnagori)\ **Post date:** [July 28, 2020, 8:31am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/5 "2020-07-28T08:31:32Z")
Thanks Fred for the update....Will check it out... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2020, 10:31am UTC](https://discuss.elastic.co/t/issue-adds-all-available-datetime-fields-from-index-template-with-empty-value-when-add-date-index-name-processor-in-pipeline-of-filebeat-fortinet-module/240680/6 "2020-08-25T10:31:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.