# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [\[Elastic Log Driver\] Structured JSON logs breaks when Docker splits large log lines](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448)
**Author:** [@empee](https://discuss.elastic.co/u/empee)\ **Replies:** 0\ **Last updated:** [March 14, 2026, 2:10am UTC](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448 "2026-03-14T02:10:11Z")
Summary When using the Elastic Docker Logging Plugin, applications that already emit structured JSON logs cannot reliably ingest them into Elasticsearch because Docker may split large log lines before they reach the logg… --- ## [Syslog parser fails on double backslashes in structured data](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386)
**Author:** [@briandoesdev](https://discuss.elastic.co/u/briandoesdev)\ **Replies:** 2\ **Last updated:** [March 10, 2026, 1:35pm UTC](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386 "2026-03-10T13:35:19Z")
Hello everyone, My org is using the Custom UDP Logs integration to ingest RFC 5424 syslog messages from several network appliances. One of the appliances includes structured data with a parameter value containing a doub… --- ## [How to limit bandwidth usage of Windows Filebeat](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357)
**Author:** [@waitspring](https://discuss.elastic.co/u/waitspring)\ **Replies:** 1\ **Last updated:** [March 6, 2026, 6:18am UTC](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357 "2026-03-06T06:18:36Z")
Hello, every big brothers: I installed Filebeat in Windows Server 2012, and make Filebeat send log data to Kafka. I want to limit Filebeat’s bandwidth usage in 50Kbit, because my Windows Server 2012 only has 2Mbit band… --- ## [It looks like winlogbeat (8.19.10) is showing noisy warn logs again](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125)
**Author:** [@Alyssa\_Nunez](https://discuss.elastic.co/u/Alyssa_Nunez)\ **Replies:** 4\ **Last updated:** [March 5, 2026, 2:19pm UTC](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125 "2026-03-05T14:19:59Z")
Hi, I was going over some logs for an incident and noticed that a lot of logs we’re seeing are similar to the ones report here: Channel not found would be suppressed ( \[Winlogbeat\] Suppress excessive channel not found w… --- ## [container input: CRI partial line reassembly ignores max\_bytes, causing OOM](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340)
**Author:** [@raychinov](https://discuss.elastic.co/u/raychinov)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 2:15pm UTC](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340 "2026-03-05T14:15:36Z")
Filebeat version 8.19.12 Operating system and version Linux (Kubernetes with containerd runtime) Description of the problem including expected versus actual behavior When a container log contains many consecutive CRI p… --- ## [Logstash/Filebeat lag issue - Logs delayed by hours](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101)
**Author:** [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)\ **Replies:** 45\ **Last updated:** [March 5, 2026, 1:02pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101 "2026-03-05T13:02:46Z")
Hello Elastic Community, I am experiencing a significant lag in log ingestion where logs are arriving with a variable delay (sometimes hours late) despite having a high-performance environment. I would appreciate your a… --- ## [Filebeat - duplicated logs when using journald Input with systemd units](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347)
**Author:** [@maxp1](https://discuss.elastic.co/u/maxp1)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 12:15am UTC](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347 "2026-03-05T00:15:46Z")
Hello, I've encountered an issue while using the journald input in Filebeat, specifically when specifying individual systemd units. Instead of separating logs based on the systemd unit, Filebeat seems to be processing th… --- ## [Metricbeats for podman containers](https://discuss.elastic.co/t/metricbeats-for-podman-containers/370744)
**Author:** [@Vishwadeeptha\_P](https://discuss.elastic.co/u/Vishwadeeptha_P)\ **Replies:** 5\ **Last updated:** [February 27, 2026, 11:38am UTC](https://discuss.elastic.co/t/metricbeats-for-podman-containers/370744 "2026-02-27T11:38:08Z")
I am trying to add metricbeats on linux VM which has hosted 60 podman containers. I am able to fetch all the VM related metrics with configurations based on system.yml. The VM level metrics are displayed on Host Overview… --- ## [Winlogbeat Kafka output not reading SSL certs with "wrong" line ends](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257)
**Author:** [@ciranor](https://discuss.elastic.co/u/ciranor)\ **Replies:** 3\ **Last updated:** [February 27, 2026, 10:41am UTC](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257 "2026-02-27T10:41:24Z")
I’m setting up Winlogbeat to output to Kafka with SSL certificates used to authenticate. The certificates will be generated, rotated and supplied automatically by another system. But when trying to configure it, winlogbe… --- ## [Filebeat Event Publishing Delay to Kafka](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [February 24, 2026, 8:52am UTC](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064 "2026-02-24T08:52:30Z")
From the logs, we can see that the logger timestamp indicates a noticeable time gap between event processing and event publishing to Kafka. Due to this delay, events are not being pushed to Kafka in real-time as expected… --- ## [Agent (Winlogbeat) stop sending data](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [February 23, 2026, 8:21pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988 "2026-02-23T20:21:41Z")
Hi, i’m facing with a problem for some winlogbeat agents. Randomly the agent stop sending data to the cluster. When i restart the service It starts writing data from where it stopped and then after a few hours it stops a… --- ## [Selecting only wy WiFi interface for network metric does not seem to work](https://discuss.elastic.co/t/selecting-only-wy-wifi-interface-for-network-metric-does-not-seem-to-work/371486)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 22, 2026, 3:44pm UTC](https://discuss.elastic.co/t/selecting-only-wy-wifi-interface-for-network-metric-does-not-seem-to-work/371486 "2026-02-22T15:44:58Z")
Hello, I tried multiple variations of WiFi to only log network metrics for my WiFi adapter and not for all the rest: But whatever I try it keeps indexing metrics for all my interfaces. Anyone got an idea what I'm… --- ## [Operating system version when running inside Kubernetes daemonset](https://discuss.elastic.co/t/operating-system-version-when-running-inside-kubernetes-daemonset/385099)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 0\ **Last updated:** [February 18, 2026, 4:36pm UTC](https://discuss.elastic.co/t/operating-system-version-when-running-inside-kubernetes-daemonset/385099 "2026-02-18T16:36:36Z")
Hello, I am running metricbeat inside a Kubernetes cluster as a DaemonSet based on the manifest yaml https://raw.githubusercontent.com/elastic/beats/8.19/deploy/kubernetes/metricbeat-kubernetes.yaml . However, the outp… --- ## [Registry Fields with Winlogbeat](https://discuss.elastic.co/t/registry-fields-with-winlogbeat/385082)
**Author:** [@TheBob](https://discuss.elastic.co/u/TheBob)\ **Replies:** 1\ **Last updated:** [February 17, 2026, 10:05pm UTC](https://discuss.elastic.co/t/registry-fields-with-winlogbeat/385082 "2026-02-17T22:05:07Z")
Running an Elastic Stack version 8 server. Trying to get Winlogbeat to send events to the server and run some detection rules alerts on them, but not getting all the expected fields configured. E.g. one of the rules mon… --- ## [AbuseCH integration issue](https://discuss.elastic.co/t/abusech-integration-issue/385076)
**Author:** [@maryam\_naeem](https://discuss.elastic.co/u/maryam_naeem)\ **Replies:** 3\ **Last updated:** [February 17, 2026, 4:29pm UTC](https://discuss.elastic.co/t/abusech-integration-issue/385076 "2026-02-17T16:29:52Z")
I am using elastic basic plan , but i have a problem being encountered whenever i integrate abusech integration v1.25.0 , i cant see any datastream or data indices , which means the data is not flowing , when i researc… --- ## [Read latest logs from a file](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [February 8, 2026, 10:06am UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957 "2026-02-08T10:06:09Z")
Hello Folks, I have one log file and it is containing all logs since November 2025 to till now. For doing the parsing of logs i’ve copy-paste sample logs to test.log file and it worked. My question is How to read last… --- ## [Graylog + Metricbeat + IIS](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950)
**Author:** [@Lev\_Anni](https://discuss.elastic.co/u/Lev_Anni)\ **Replies:** 0\ **Last updated:** [February 6, 2026, 7:20pm UTC](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950 "2026-02-06T19:20:40Z")
Guys, I want to get IIS performance metrics from my IIS servers to use them in Graylog. Metribeat has this nice IIS module but it can not retrieve CPU usage per site, only globally. I can get per site application pool c… --- ## [Creating an alarm that outputs the group name](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [February 6, 2026, 9:31am UTC](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911 "2026-02-06T09:31:24Z")
I am trying to build an alert that emits data via a web hook. The alert has grouping, so multiple alerts can fire an any one time. What I’ve not managed to do is get the group name to be included in the data sent throu… --- ## [SentinelOne Integration with ELK](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924)
**Author:** [@Jayesh\_Auti](https://discuss.elastic.co/u/Jayesh_Auti)\ **Replies:** 4\ **Last updated:** [February 5, 2026, 1:22pm UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924 "2026-02-05T13:22:13Z")
Hi Guys, I am integrating SentinelOne with ELK, after adding console URL and API key it showing me to add elastic agent. Elastic agent is required for these type of integrations? Can anyone help me with this? Than… --- ## [Panic: runtime error: makeslice: cap out of range](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887)
**Author:** [@whanklee](https://discuss.elastic.co/u/whanklee)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 2:00pm UTC](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887 "2026-02-03T14:00:55Z")
Packetbeat 9.3.0 crashes with Go panic in DHCPv4 parser (makeslice: cap out of range) on Ubuntu 24 Environment • OS: Ubuntu Server 24.04 LTS (amd64) • Packetbeat version: packetbeat version 9.3.0 (amd64) libbeat 9… --- ## [Filebeat Unable to Handle Single Large Event (~5GB)](https://discuss.elastic.co/t/filebeat-unable-to-handle-single-large-event-5gb/384782)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 1\ **Last updated:** [January 29, 2026, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-handle-single-large-event-5gb/384782 "2026-01-29T13:57:18Z")
We are facing an issue where Filebeat is not able to process or hold a single large event of approximately 5 GB . Due to this limitation, the event is not being shipped successfully to Elasticsearch. This appears to be … --- ## [Use filebeat processor to concatenate string](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725)
**Author:** [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)\ **Replies:** 2\ **Last updated:** [January 26, 2026, 3:15pm UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725 "2026-01-26T15:15:49Z")
I have a situation where a customer has a custom syslog file for the Citrix ADC Netscaler. I would like to use the fleet integration for this but it doesn’t support the header format they have. I would like to modify tha… --- ## [When using s3-compatible service as inputs, path\_style is un-useful](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709)
**Author:** [@luxin88](https://discuss.elastic.co/u/luxin88)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 9:33am UTC](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709 "2026-01-23T09:33:30Z")
filebeat: inputs: - type: aws-s3 endpoint: "http://obs.cn-north-4.myhuaweicloud.com" access\_key\_id: "###" secret\_access\_key: "###" non\_aws\_bucket\_name: log-parse path\_style: false … --- ## [Filebeat package (filebeat-9.2.1-amd64.deb) is affected by CVE-2025-11226/CVE-2025-5818/CVE-2025-47914](https://discuss.elastic.co/t/filebeat-package-filebeat-9-2-1-amd64-deb-is-affected-by-cve-2025-11226-cve-2025-5818-cve-2025-47914/384618)
**Author:** [@cahl](https://discuss.elastic.co/u/cahl)\ **Replies:** 2\ **Last updated:** [January 19, 2026, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-package-filebeat-9-2-1-amd64-deb-is-affected-by-cve-2025-11226-cve-2025-5818-cve-2025-47914/384618 "2026-01-19T21:56:11Z")
Hi, I see the filebeat-9.2.1-amd64.deb is affected by CVE-2025-10543 which is present on GitHub - eclipse-paho/paho.mqtt.golang 1.3.5 and fixed on 1.5.1. Also, the same package is affected by CVE-2025-58181 and CVE-2025-… --- ## [Elastic Agent vs Logstash with Filebeat](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556)
**Author:** [@marian.veverka](https://discuss.elastic.co/u/marian.veverka)\ **Replies:** 5\ **Last updated:** [January 17, 2026, 5:10pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556 "2026-01-17T17:10:53Z")
Hello, I have a server running several Docker containers (including, for example, Keycloak). I want to send logs from these Docker containers to Elasticsearch. Currently, for one Docker container I'm using a separate D… --- ## [How to parse json from message field](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/384560)
**Author:** [@k0i3n](https://discuss.elastic.co/u/k0i3n)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 2:56pm UTC](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/384560 "2026-01-15T14:56:01Z")
{ "headers": {}, "message": "�\\u0005Jan 15 15:54:00 10.104.65.41 date=2026-01-15 time=15:54:00 devname=\\"FW\_WAN\_01\\" devid=\\"FG201\\" eventtime=1768467240656260450 tz=\\"+0700\\" logid=\\"1059028704\\" type=\\"utm\\" subtyp… --- ## [Metricbeat 8 sql module leaks connections when using prepared statements](https://discuss.elastic.co/t/metricbeat-8-sql-module-leaks-connections-when-using-prepared-statements/377684)
**Author:** [@jay-dba](https://discuss.elastic.co/u/jay-dba)\ **Replies:** 2\ **Last updated:** [January 14, 2026, 10:16pm UTC](https://discuss.elastic.co/t/metricbeat-8-sql-module-leaks-connections-when-using-prepared-statements/377684 "2026-01-14T22:16:22Z")
We recently went from Metricbeat 7.14 to 8.14 We have found idle metricbeat connections piling up in mysql. Problem: We use the sql module to run queries on mysql. The queries use prepared statements. Since going to me… --- ## [Filebeat Bug: journal remote directory unhandled](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467)
**Author:** [@log1](https://discuss.elastic.co/u/log1)\ **Replies:** 0\ **Last updated:** [January 11, 2026, 12:17am UTC](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467 "2026-01-11T00:17:48Z")
Filebeat version: 8.19.9 OS: Debian 13 Documentation here Journald input | Beats, states: For example, this configuration will ingest all journals and correctly handle the journald rotation: - type: journald id: jo… --- ## [We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607)
**Author:** [@Jeya\_Pradeen1](https://discuss.elastic.co/u/Jeya_Pradeen1)\ **Replies:** 4\ **Last updated:** [January 8, 2026, 9:08pm UTC](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607 "2026-01-08T21:08:20Z")
We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license. Blackduck scanning tools detect elastic… --- ## [Filebeat clients unable to publish events to logstash](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592)
**Author:** [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\ **Replies:** 31\ **Last updated:** [December 31, 2025, 2:42am UTC](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592 "2025-12-31T02:42:21Z")
Hi all, I had a filebeat to logstash setup running successfully for the past months where both services where running on the same host. I recently moved filebeat to it's own server in a different zone. I am able to hit … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=2)