# "url.full" field not viewing in Packetbeat 7.16.3

**URL:** <https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [January 20, 2022, 1:42pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954 "2022-01-20T13:42:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 20, 2022, 1:42pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954/1 "2022-01-20T13:42:02Z")

</div>

Hi,

I've upgraded Packetbeat version from 7.16.0 to 7.16.3 but since then I've never seen the `url.full:` field in the packetbeats logs although:

1- I'm visiting urls to have some traffic which should log the `url.full:` field.

2- In the index management I can see the field there:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e13b80f8cd7cbf01ba811a256a398ae11c4b5c2.png)

3- I'm receiving logs from this machine for other protocols like TCP, DNS...

4-- The same _packetbeat.yml_ configuration was copied to the 7.16.3 version.

Here are the protocols I'm logging and both http and https are there.

```auto
# =========================== Transaction protocols ============================

packetbeat.protocols:
- type: icmp
  # Enable ICMPv4 and ICMPv6 monitoring. Default: false
  enabled: true

- type: amqp
  # Configure the ports where to listen for AMQP traffic. You can disable
  # the AMQP protocol by commenting out the list of ports.
  ports: [5672]

- type: cassandra
  #Cassandra port for traffic monitoring.
  ports: [9042]

- type: dhcpv4
  # Configure the DHCP for IPv4 ports.
  ports: [67, 68]

- type: dns
  # Configure the ports where to listen for DNS traffic. You can disable
  # the DNS protocol by commenting out the list of ports.
  ports: [53]

- type: http
  # Configure the ports where to listen for HTTP traffic. You can disable
  # the HTTP protocol by commenting out the list of ports.
  ports: [80, 8080, 8000, 5000, 8002]

- type: memcache
  # Configure the ports where to listen for memcache traffic. You can disable
  # the Memcache protocol by commenting out the list of ports.
  ports: [11211]

- type: mysql
  # Configure the ports where to listen for MySQL traffic. You can disable
  # the MySQL protocol by commenting out the list of ports.
  ports: [3306,3307]

- type: pgsql
  # Configure the ports where to listen for Pgsql traffic. You can disable
  # the Pgsql protocol by commenting out the list of ports.
  ports: [5432]

- type: redis
  # Configure the ports where to listen for Redis traffic. You can disable
  # the Redis protocol by commenting out the list of ports.
  ports: [6379]

- type: thrift
  # Configure the ports where to listen for Thrift-RPC traffic. You can disable
  # the Thrift-RPC protocol by commenting out the list of ports.
  ports: [9090]

- type: mongodb
  # Configure the ports where to listen for MongoDB traffic. You can disable
  # the MongoDB protocol by commenting out the list of ports.
  ports: [27017]

- type: nfs
  # Configure the ports where to listen for NFS traffic. You can disable
  # the NFS protocol by commenting out the list of ports.
  ports: [2049]

- type: tls
  # Configure the ports where to listen for TLS traffic. You can disable
  # the TLS protocol by commenting out the list of ports.
  ports:
    - 443 # HTTPS
    - 993 # IMAPS
    - 995 # POP3S
    - 5223 # XMPP over SSL
    - 8443
    - 8883 # Secure MQTT
    - 9243 # Elasticsearch

- type: sip
  # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports.
  ports: [5060]

```

Any help is really appreciated.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [January 20, 2022, 2:16pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954/2 "2022-01-20T14:16:09Z")

</div>

Are they http or https sites?

---

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 21, 2022, 7:46am UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954/3 "2022-01-21T07:46:48Z")

</div>

Thanks for your reply @legoguy1000

I've tested both, even [google.com](https://discuss.elastic.co/t/hadoop-getting-elasticsearch-hadoop-working-with-shark/15882) is not logging. In all ways the config file should be grabbing both _http_ and _https_.

---

<div class="post-metadata">

**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Post date:** [January 27, 2022, 1:18pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954/4 "2022-01-27T13:18:38Z")

</div>

Any help please?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2022, 3:19pm UTC](https://discuss.elastic.co/t/url-full-field-not-viewing-in-packetbeat-7-16-3/294954/5 "2022-02-24T15:19:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.