# \[threatintel Filebeat module\] MISP , not filtering attribites

**URL:** <https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 1, 2022, 1:19pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668 "2022-05-01T13:19:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 1, 2022, 1:19pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/1 "2022-05-01T13:19:00Z")

</div>

Hi team,

i'm using the below config to filters some attributes type, but when i look at my index i find all the attributes types , is something i'm doing it wrong ?  
Filebeat 7.17.3

```auto
misp:
    enabled: true

    # Input used for ingesting threat intel data, defaults to JSON.
    var.input: httpjson

    # The URL of the MISP instance, should end with "/events/restSearch".
    var.url: https://SERVER/events/restSearch

    # The authentication token used to contact the MISP API. Found when looking at user account in the MISP UI.
    var.api_token: xxxxxxx

    # Configures the type of SSL verification done, if MISP is running on self signed certificates
    # then the certificate would either need to be trusted, or verification_mode set to none.
    var.ssl.verification_mode: none

    # Optional filters that can be applied to the API for filtering out results. This should support the majority of fields in a MISP context.
    # For examples please reference the filebeat module documentation.
    var.filters:
    # - threat_level: [4, 5]
    # - to_ids: true
        type: ["md5", "sha256", "url", "ip-src", "filename", "sha1", "ip-dst", "domain", "email-src", "email-dst", "imphash"]

    # How far back to look once the beat starts up for the first time, the value has to be in hours. Each request afterwards will filter on any event newer
    # than the last event that was already ingested.
    var.first_interval: 100h

    # The interval to poll the API for updates.
    var.interval: 15m

```

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 2, 2022, 5:55pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/2 "2022-05-02T17:55:33Z")

</div>

Hi [@elastic\_team](https://discuss.elastic.co/groups/elastic_team) ,

Kindly your support.

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [May 3, 2022, 6:31pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/3 "2022-05-03T18:31:49Z")

</div>

Hello @ibra_013 .

Could you give this format a try?

```auto
var.filters:
  type:
    OR:
      - ip-src
      - ip-dst

```

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 3, 2022, 6:52pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/4 "2022-05-03T18:52:54Z")

</div>

Hi Marius,

i did as you suggested; still not filtering

```auto
var.filters:
       type:
         OR:
           - ip-src
           - ip-dst
    # How far back to look once the beat starts up for the first time, the value has to be in hours. Each request afterwards will filter on any event newer
    # than the last event that was already ingested.
    var.first_interval: 100h

    # The interval to poll the API for updates.
    var.interval: 15m

```

 ![Screen Shot 2022-05-03 at 7.48.13 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf18ab90a1db2a965af6c8d0a7ac043066130491.jpeg)

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 4, 2022, 1:09pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/5 "2022-05-04T13:09:42Z")

</div>

Hi,

i think there is an issue with filters, @Marius_Iversen can you confirm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2022, 3:10pm UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668/6 "2022-06-01T15:10:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.