# Processor network\_direction in filebeat

**URL:** <https://discuss.elastic.co/t/processor-network-direction-in-filebeat/277900>\
**Category:** Elasticsearch\
**Created:** [July 6, 2021, 5:16am UTC](https://discuss.elastic.co/t/processor-network-direction-in-filebeat/277900 "2021-07-06T05:16:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sureshboiina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sureshboiina/32/79183_2.png) [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\
**Post date:** [July 6, 2021, 5:16am UTC](https://discuss.elastic.co/t/processor-network-direction-in-filebeat/277900/1 "2021-07-06T05:16:46Z")

</div>

Hi,

Actually we want to implement the **network\_direction** in filebeat processor for that we added below lines

```auto
# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - add_network_direction:
      source: source.ip
      destination: destination.ip
      target: network.direction
      internal_networks: ["203.80.16.0/21", "103.18.93.0/24"]

```

But when we check in elasticsearch data is still getting network.direction as "unknown",  
even we restarted the cluster also but still same.  
Please anyone have any idea do we need to add anythink.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2021, 5:17am UTC](https://discuss.elastic.co/t/processor-network-direction-in-filebeat/277900/2 "2021-08-03T05:17:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.