# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=100 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 101 --- ## [Partial field value matching post Winlogbeat upgrade to 8.1](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222 "2022-03-22T13:24:07Z")
Hi All, We are using elk 7.17.1 with winlogbeat version 7.8 version with ECS version 1.5. While testing out winlogbeat 8.1.0 with ECS version 8.0.0, now my lucene queries are now doing partial matches. A simple exampl… --- ## [Load balanced access to fleet servers](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 7:10am UTC](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210 "2022-03-22T07:10:41Z")
Hi, I have setup 2 fleet servers successfully and want all additional elastic agents to connect to them via loadbalanced IP (haproxy with "round robin" option). Whenever I configure the loadbalanced URL instead of the … --- ## [How to Identify the Container Name When Collecting Container Logs?](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 2:46am UTC](https://discuss.elastic.co/t/how-to-identify-the-container-name-when-collecting-container-logs/300260 "2022-03-22T02:46:32Z")
Currently I use filebeat 7.16.3 and it runs on a kubernetes 1.20 cluster (docker runtime). I use the following configuration to collect container logs, but I found that FB does not recognize the container name correspond… --- ## [Filebeat keystore automation](https://discuss.elastic.co/t/filebeat-keystore-automation/300243)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-keystore-automation/300243 "2022-03-21T19:10:03Z")
Is it possible to automate the password entry when creating a filebeat keystore via PowerShell? I'm running the command '.\\filebeat keystore add ES\_PWD', and when prompted to 'Enter value for ES\_PWD', I'd like this to a… --- ## [Configuration: how to mix environment variable with static config in a list](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240)
**Author:** [@grained](https://discuss.elastic.co/u/grained)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 6:13pm UTC](https://discuss.elastic.co/t/configuration-how-to-mix-environment-variable-with-static-config-in-a-list/300240 "2022-03-21T18:13:57Z")
I'm trying to exclude\_files using a mix of environment variables and static configuration but the environment variable seems to be expanded to a list of it's own making it impossible to add to an existing list. Example: … --- ## [Dockershim is being deprecated in k8s 1.24](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/dockershim-is-being-deprecated-in-k8s-1-24/299808 "2022-03-21T17:35:44Z")
Starting with Kubernetes ver 1.24 the project is removing the dockershim that processes docker commands as the container runtime engine. I am running Filebeat and Metricbeat 7.16.2 in our clusters currently and they hav… --- ## [Packetbeat8.0 af\_packet report errors](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 7\ **Last updated:** [March 21, 2022, 5:27pm UTC](https://discuss.elastic.co/t/packetbeat8-0-af-packet-report-errors/298180 "2022-03-21T17:27:29Z")
Packetbeat Version: 8.0 Operating System: Rocky Linux 8.5 After the "af\_packet" mode is enabled in the configuration file, Packetbeat will report an error and prompt "exiting: sniffer loop failed: sniffing error: packe… --- ## [Inputs error journald](https://discuss.elastic.co/t/inputs-error-journald/299804)
**Author:** [@Gyrops](https://discuss.elastic.co/u/Gyrops)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/inputs-error-journald/299804 "2022-03-21T15:49:56Z")
log Exiting: Failed to start crawler: starting input failed: Error while initializing input: Error creating input. No such input type exist: 'journald' filebeat version 8.1.0 --- ## [Filebeat Apache Module - Apache Module (mod\_dumpio) Support](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-apache-module-mod-dumpio-support/299999 "2022-03-21T15:38:41Z")
Hi there, I have the following use-case: Capture and parse HTTP(S) POST request information from Apache web servers. An Apache module (mod\_dumpio) is able to do the job. However, the mod\_dumpio module gives tons of inf… --- ## [Filebeat does not harvest all logs from application](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-does-not-harvest-all-logs-from-application/300219 "2022-03-21T15:28:33Z")
I encounter an issue, when filebeat does not harvest all logs (only small amount of them) from my app. I have filebeat that harvest logs from docker applicaitons and send them to the Logstash. Applicaiton is running in … --- ## [Cannot connect to X.X.X.X:10514: Connection refused](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055)
**Author:** [@Oreius](https://discuss.elastic.co/u/Oreius)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:16pm UTC](https://discuss.elastic.co/t/cannot-connect-to-x-x-x-x-connection-refused/300055 "2022-03-21T15:16:41Z")
Configuring a ELK stack version 8.1, based on two virtual machine which both run Oracle linux 8. I need to send logs from a VM to the other using rsyslog. On the recieving machine logs will be acquired using FileBeat. Th… --- ## [Mysql slowquery pipeline fails if schema contains a dash](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173)
**Author:** [@Rasmus\_Breinholm\_Rom](https://discuss.elastic.co/u/Rasmus_Breinholm_Rom)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:13pm UTC](https://discuss.elastic.co/t/mysql-slowquery-pipeline-fails-if-schema-contains-a-dash/300173 "2022-03-21T15:13:38Z")
The Grok patttern defined in the mysql slowlog ingest pipeline uses the WORD grok pattern to extract schema. This causes the pipeline to fail if schema contains a dash. Using the same pattern as USERNAME seems to fix t… --- ## [Some word should not be transmitted](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185)
**Author:** [@peyofe](https://discuss.elastic.co/u/peyofe)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:12pm UTC](https://discuss.elastic.co/t/some-word-should-not-be-transmitted/300185 "2022-03-21T15:12:19Z")
Hi. I have a question. I have a log with followings fileds: User;Target;IP-Adress;PrivateCode Name1;Server1;127.0.0.1;CD4523 Name2;Server21;127.0.0.2;CD4542 Name3;Server421;127.0.0.3;CD4556 Filebeat reading the log… --- ## [Elastic Agent Installation Verification Mode Fleet Cert](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:09pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-verification-mode-fleet-cert/300198 "2022-03-21T15:09:05Z")
Hi all, is it possible to define the verification\_mode used to validate the fleet server certificate when installing an elastic agent? I'm thinking about filebeat where you can set verification\_mode to certificate to on… --- ## [LDAP load while auditbeat collects event.category iam](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200)
**Author:** [@alchy](https://discuss.elastic.co/u/alchy)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/ldap-load-while-auditbeat-collects-event-category-iam/300200 "2022-03-21T15:04:49Z")
We have been dealing with the fact that twice a day we have a heavily loaded LDAP server that manages user accounts in the Unix world. The situation occurs regularly every day around 8:30 in the morning and 8:30 in the … --- ## [Filebeat: Error with the google\_workspace module](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871)
**Author:** [@PJ\_ceSofnI\_tseT](https://discuss.elastic.co/u/PJ_ceSofnI_tseT)\ **Replies:** 6\ **Last updated:** [March 21, 2022, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-error-with-the-google-workspace-module/298871 "2022-03-21T14:54:42Z")
Hi all, I find myself integrating the google\_workspace module via filebeat (filebeat-7.17.0-linux-x86\_64) on an Ubuntu 20.04 LTS. I have followed all the steps in the "Configure the module" reference (Google Workspace m… --- ## [Microsoft Filebeat Module](https://discuss.elastic.co/t/microsoft-filebeat-module/300115)
**Author:** [@John\_Doe4](https://discuss.elastic.co/u/John_Doe4)\ **Replies:** 4\ **Last updated:** [March 21, 2022, 10:16am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115 "2022-03-21T10:16:30Z")
Hi, I am using the Filebeat O365 module across a bunch of Azure AD tenants with great success. I am looking to onboard Microsoft Defender for Business and as such I'd like to ingest the Windows Defender events and I ca… --- ## [Exiting: resource 'metricbeat-7.8.1' exists, but it is not an alias](https://discuss.elastic.co/t/exiting-resource-metricbeat-7-8-1-exists-but-it-is-not-an-alias/300181)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 1\ **Last updated:** [March 21, 2022, 9:57am UTC](https://discuss.elastic.co/t/exiting-resource-metricbeat-7-8-1-exists-but-it-is-not-an-alias/300181 "2022-03-21T09:57:16Z")
Hello, Our ES cloud instance was having some storage issues, in order to clear some space we removed the metricbeat data. Now some of our metricbeat agents are not able to log data into metricbeat-\* index, I tried to r… --- ## [Httpjson Input Config Issue](https://discuss.elastic.co/t/httpjson-input-config-issue/299909)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 1\ **Last updated:** [March 18, 2022, 11:34am UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909 "2022-03-18T11:34:13Z")
I am using the Fleet integration for httpjson to attempt to pull down API logs. The request I am mimicking in the config is the curl request below (which works correctly). curl --location --request POST 'https://api.ju… --- ## [Logstash not monitored by metricbeat](https://discuss.elastic.co/t/logstash-not-monitored-by-metricbeat/299914)
**Author:** [@ashiqab](https://discuss.elastic.co/u/ashiqab)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 6:36am UTC](https://discuss.elastic.co/t/logstash-not-monitored-by-metricbeat/299914 "2022-03-18T06:36:48Z")
Hello, Still learning the set up of elastic stack, I am now stuck with metricbeat failing to register my logstash node on Kibana. However I could successfully register and monitor Elasticsearch and Kibana using metricbe… --- ## [Filebeat : How to get multiline logs together (with pattern) in one block](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971)
**Author:** [@MLAYEH\_Ismail](https://discuss.elastic.co/u/MLAYEH_Ismail)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971 "2022-03-17T16:14:46Z")
Hi everyone, im working on extracting log by filebeat and processing it by ELK stack. every thing works exept that the logs are readed line per line and not by block with the specified pattern . thank you in advance. t… --- ## [Can't connect filebeat to elastic search](https://discuss.elastic.co/t/cant-connect-filebeat-to-elastic-search/299966)
**Author:** [@Mariem](https://discuss.elastic.co/u/Mariem)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 3:51pm UTC](https://discuss.elastic.co/t/cant-connect-filebeat-to-elastic-search/299966 "2022-03-17T15:51:46Z")
this is my filebeat configuration file : when i execute filebeat setup -e : Can someone help me??? --- ## [Need to ship confluent cloud logs and metrics](https://discuss.elastic.co/t/need-to-ship-confluent-cloud-logs-and-metrics/297962)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 16\ **Last updated:** [March 17, 2022, 5:39am UTC](https://discuss.elastic.co/t/need-to-ship-confluent-cloud-logs-and-metrics/297962 "2022-03-17T05:39:08Z")
Hi team, Need to ship confluent cloud logs/metrics to beats that are installed on a Kubernetes cluster and eventually to Elasticsearch. Have read about Elasticsearch syn connector but can we first ship it to beats and … --- ## [How metricbeat to monitor Filebeat running in Daemonset on K8s](https://discuss.elastic.co/t/how-metricbeat-to-monitor-filebeat-running-in-daemonset-on-k8s/299397)
**Author:** [@cmy214](https://discuss.elastic.co/u/cmy214)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 5:23am UTC](https://discuss.elastic.co/t/how-metricbeat-to-monitor-filebeat-running-in-daemonset-on-k8s/299397 "2022-03-17T05:23:42Z")
Hi all, My filebeat is in Daemonset on K8s cluster. In 7.17 internal monitoring of beats is removed and requires a separate metricbeat for achieving monitoring. So I'm setting up metricbeat as Daemonset to monitor my … --- ## [Azure Filebeats Module](https://discuss.elastic.co/t/azure-filebeats-module/299878)
**Author:** [@tman5](https://discuss.elastic.co/u/tman5)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878 "2022-03-16T18:06:44Z")
We're looking to configure Azure module | Filebeat Reference \[7.17\] | Elastic and I had a question. Our filebeats is outputing to logstash which then in turn writes out to Graylog. I have filebeat setup to gather logs f… --- ## [Help with Fleet setup](https://discuss.elastic.co/t/help-with-fleet-setup/299759)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 4:55pm UTC](https://discuss.elastic.co/t/help-with-fleet-setup/299759 "2022-03-16T16:55:22Z")
I got a fleet server to connect to my sandbox cluster to test and setup this framework. I am trying to get an agent to connect with my fleet server. I am trying to just get the quickstart going so useing the --insecur… --- ## [How to Configure FileBeat to be used with an Existing Index while deploying in Kubernetes as DaemonSet](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601)
**Author:** [@roy3861](https://discuss.elastic.co/u/roy3861)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 4:20pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-be-used-with-an-existing-index-while-deploying-in-kubernetes-as-daemonset/299601 "2022-03-16T16:20:24Z")
Hi, We are trying to deploy filebeat in our Kuberenets cluster following: Running Filebeat on Kubernetes | Filebeat Reference \[6.8\] | Elastic However we want the Pod logs to go to a pre defined Index in Elastic. How to… --- ## [Filebeat Modules for Syslog-ng files not creating index](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767)
**Author:** [@sevtech](https://discuss.elastic.co/u/sevtech)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767 "2022-03-16T14:25:20Z")
I have a Syslog-NG server that has been upgraded from 7.4 to 8.0.1 via YUM on CentOS. I am new to ELK. I have mostly switch syslog data and Palo Alto FW syslog data on the Syslog -NG server. When I set the filebeat co… --- ## [Metricbeat kibana no stable](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091 "2022-03-16T10:48:51Z")
We are triying to deploy metricbeat to monitor kibana in eck with stack monitoring. The problem is, the monitoring is not working fine: Kibana stack monitoring: Last 15 min of a single kibana node (continous monitor… --- ## [Error: failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/error-failed-to-publish-events-temporary-bulk-send-failure/299270)
**Author:** [@samettozbay](https://discuss.elastic.co/u/samettozbay)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 9:00am UTC](https://discuss.elastic.co/t/error-failed-to-publish-events-temporary-bulk-send-failure/299270 "2022-03-16T09:00:39Z")
I have issue about sending logs with filebeat. I have checked all the topics related this issue but i couldn't figure out it yet . I have Elasticsearch v 7.10.2 and i am using filebeat 7.10.0. I created my pipeline as… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=99) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=101)