# No data in Auditbeat events when using include\_fields processor

**URL:** <https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 7, 2018, 10:22am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802 "2018-02-07T10:22:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [February 7, 2018, 10:22am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/1 "2018-02-07T10:22:04Z")

</div>

Hey, I'm trying to run auditbeat for the first time on debian jessie. I've downloaded the current .deb (6.2) and configured auditbeat to log everything that it can (using the auditbeat.reference.yaml).

It's also exporting the elasticsearch template and kibana dashboards. However, if i run auditbeat, it does not ship any data... if i configure the file output than i can see only those type of lines showing up frequently:

```
{"@timestamp":"2018-02-07T10:14:01.853Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}
{"@timestamp":"2018-02-07T10:14:02.026Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}
{"@timestamp":"2018-02-07T10:14:01.857Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}
{"@timestamp":"2018-02-07T10:14:01.857Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}
{"@timestamp":"2018-02-07T10:14:01.857Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}
{"@timestamp":"2018-02-07T10:14:01.857Z","@metadata":{"beat":"auditbeat","type":"doc","version":"6.2.0"}}

```

This is the same kind of data which is also shipped via elasticsearch output. Any ideas whats wrong here?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 7, 2018, 10:28am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/2 "2018-02-07T10:28:49Z")

</div>

Could you share your config and the output of `auditbeat -e -d "*"`?

---

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [February 7, 2018, 10:53am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/3 "2018-02-07T10:53:02Z")

</div>

> [@kvch](#):
>
> auditbeat -e -d "\*"

Sure: [https://pastebin.com/raw/4sExQG1U](https://pastebin.com/raw/4sExQG1U)

/edit  
Sorry, forgot the config: [########################## Auditbeat Configuration ############################# - Pastebin.com](https://pastebin.com/Qbx1dLeu)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 7, 2018, 2:13pm UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/4 "2018-02-07T14:13:59Z")

</div>

The curprit here is the processor you have added which says to drop all fields **except for `cpu`**. `@timestamp` and `@metadata` are exempt from deletion b/c they are special fields.

```auto
processors:
- include_fields:
    fields: ["cpu"]

```

BTW, using `auditbeat export config` produces a more concise and easier to read (IMO) version of the config.

---

<div class="post-metadata">

**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Post date:** [February 8, 2018, 7:45am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/5 "2018-02-08T07:45:46Z")

</div>

Ah, thank you! 🙂

And thanks for the export config hint!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 5:13am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802/6 "2022-11-04T05:13:11Z")

</div>