# \[threatintel Filebeat module\] MISP , not filtering attributes. How can I solve it?

**URL:** <https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attributes-how-can-i-solve-it/359431>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 14, 2024, 7:02am UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attributes-how-can-i-solve-it/359431 "2024-05-14T07:02:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fabiodanzetta](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@fabiodanzetta](https://discuss.elastic.co/u/fabiodanzetta)\
**Post date:** [May 14, 2024, 7:02am UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attributes-how-can-i-solve-it/359431/1 "2024-05-14T07:02:34Z")

</div>

Hi everyone,

I've been struggling with the problem indicated in question for several days and I haven't been able to find a solution.  
I did a lot of research online and finally came across this link but unfortunately the proposed solution doesn't work: [[threatintel Filebeat module] MISP , not filtering attribites](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attribites/303668)  
Please is there a way to make the filters work?  
Without the filters the data from the MISP is imported but I would need to filter it as I don't need all the generic data.

Thank you all.

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [May 14, 2024, 8:52am UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attributes-how-can-i-solve-it/359431/2 "2024-05-14T08:52:24Z")

</div>

Hi @fabiodanzetta,

Welcome! Which version of Filebeat are you using?

It might be an issue with you filters. Can you share your config?

---

<div class="post-metadata">

**Author:** ![fabiodanzetta](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@fabiodanzetta](https://discuss.elastic.co/u/fabiodanzetta)\
**Post date:** [May 14, 2024, 9:03am UTC](https://discuss.elastic.co/t/threatintel-filebeat-module-misp-not-filtering-attributes-how-can-i-solve-it/359431/3 "2024-05-14T09:03:03Z")

</div>

Hi @carly.richmond ,

the version of Filebeat is: filebeat version 7.17.21 (amd64), libbeat 7.17.21 [ba1f1c115316c2434bb0d713bc211d63bc899a14 built 2024-04-10 18:05:45 +0000 UTC]

This is my conf and where it says tags and type we also tried with in front -

```auto
misp:
    enabled: true

    # Input used for ingesting threat intel data, defaults to JSON.
    var.input: httpjson

    # The URL of the MISP instance, should end with "/events/restSearch".
    var.url: https://my_misp_instace_ip/events/restSearch

    # The authentication token used to contact the MISP API. Found when looking at user account in the MISP UI.
    var.api_token: my_api_token

    # Configures the type of SSL verification done, if MISP is running on self signed certificates
    # then the certificate would either need to be trusted, or verification_mode set to none.
    var.ssl.verification_mode: none

    # Optional filters that can be applied to the API for filtering out results. This should support the majority of fields in a MISP context.
    # For examples please reference the filebeat module documentation.
    var.filters:
      type: ["domain"]
      tags: ["Elastic-SIEM"]
    # - threat_level: [4, 5]
    # - to_ids: true

    # How far back to look once the beat starts up for the first time, the value has to be in hours. Each request afterwards will filter on any event newer
    # than the last event that was already ingested.
    var.first_interval: 240h

    # The interval to poll the API for updates.
    var.interval: 10m

```

Finally, this is the error when we restart the agent:

ERROR instance/beat.go:1027 Exiting: Failed to start crawler: creating module reloader failed: error checking input configuration: can not convert 'object' into 'string' accessing 'type'

Thank you very much for your help.