# Source.bytes not showing up as a field in elb fileset for aws

**URL:** https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675
**Category:** Beats
**Tags:** filebeat
**Created:** [March 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675 "2021-03-29T16:04:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)
#### Post date: [March 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675/1 "2021-03-29T16:04:15Z")

</div>

I am trying to use the aws module for filebeat. My goal is to recreate the ELB Inbound Traffic [Filebeat AWS] visualization. It does not work by default. I've added an s3 bucket for collecting elb logs and an s3 bucket notification that is connected to an sqs queue. This queue is used as an input in the aws.yml like so

```auto
  elb:
    enabled: true

    # AWS SQS queue url
    var.queue_url: ${ELB_SQS}

```

When I try to add a data panel to sum the `source.bytes` field the selector does not show the field. Nor does the field exist when I look at the records from my ellb logs. Here is a screenshot

 ![Screen Shot 2021-03-29 at 12.01.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe92418e0c8615c476642e8a7a6aa1905fd7e23a.png)

I would love it if someone could help me with this. I've also attached my filebeat configuration for reference too.

```auto
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana.host: "host"
setup.kibana.protocol: "https"
setup.kibana.username: "user"
setup.kibana.password: password
setup.dashboards.enabled: true
setup.dashboards.directory: ${path.config}/kibana
setup.ilm.enabled: false
logging.level: debug
output.elasticsearch:
  hosts: ["host"]
  protocol: "https"
  username: "user"
  password: password
  bulk_max_size: 3200
  worker: 16
  indices:
  - index: "cloudtrail-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.cloudtrail"
  - index: "elb-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.elb"
  - index: "vpc-%{[agent.version]}-%{+yyyy.MM.dd}"
    when.contains:
      event.dataset: "aws.vpc"
processors:
  - add_fields:
      target: target
      fields:
        environment: ${ENV}

```

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [March 30, 2021, 4:29pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675/2 "2021-03-30T16:29:34Z")

</div>

Hi @EvanGertis,

What kind of load balancers are you collecting logs from? I think that `source.bytes` is only available for TCP load balancers. For HTTP load balancers you can use `http.request.body.bytes`/`http.response.body.bytes`.

For this reason is also possible that the `Inbound traffic` visualization only works for TCP lbs.

---

<div class="post-metadata">

### Author: ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)
#### Post date: [March 31, 2021, 7:12pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675/3 "2021-03-31T19:12:31Z")

</div>

Thank you I'm using an HTTP loadbalancer actually.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 28, 2021, 9:13pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675/4 "2021-04-28T21:13:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.