# Packetbeat not always populating "server" common field

**URL:** <https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 24, 2018, 4:39pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426 "2018-07-24T16:39:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [July 24, 2018, 4:39pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426/1 "2018-07-24T16:39:36Z")

</div>

Is there a reason that packetbeat would not always collect the `server` field?

I'm collecting `tls` packets and only sending events that have the `tls.handshake_completed` field.

```auto
packetbeat.protocols:
- type: tls
  send_certificates: false
  include_raw_certificates: false
  ports: [443]

packetbeat.ignore_outgoing: true

processors:
- drop_event:
    when:
      not:
        has_fields: ['tls.handshake_completed']

```

I tried comparing the events which did have the `server` field to the ones that did not, and I wasn't seeing any noticeable patterns.

Thanks.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 24, 2018, 5:00pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426/2 "2018-07-24T17:00:47Z")

</div>

`server` gets populated with the `tls.client_hello.extensions.server_name_indication` value. So if the client doesn't specify a SNI then server won't be populated.

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [July 24, 2018, 5:16pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426/3 "2018-07-24T17:16:00Z")

</div>

Thank you for the quick response. That makes sense.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2018, 5:16pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426/4 "2018-08-21T17:16:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.