# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=112 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 113 --- ## [Filebeat docker input type labels are not shown](https://discuss.elastic.co/t/filebeat-docker-input-type-labels-are-not-shown/294534)
**Author:** [@sahinguler](https://discuss.elastic.co/u/sahinguler)\ **Replies:** 0\ **Last updated:** [January 17, 2022, 6:40am UTC](https://discuss.elastic.co/t/filebeat-docker-input-type-labels-are-not-shown/294534 "2022-01-17T06:40:10Z")
Hi all, I use filebeat and logstash for store my all datas. My docker setup and log files are in /home/docker/containers folder. (not in /var/lib/docker path) The problem is when i was colleting my logs, the docker fie… --- ## [Increasing queue size](https://discuss.elastic.co/t/increasing-queue-size/294520)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 0\ **Last updated:** [January 17, 2022, 3:25am UTC](https://discuss.elastic.co/t/increasing-queue-size/294520 "2022-01-17T03:25:34Z")
Hi, I'm ingesting Netflow data using Filebeat 7.14.0 and writing the output into Elasticsearch. I'm trying to tweak the various configuration settings in order to improve the performance (currently, it seems like filebe… --- ## [Metricbeat Rollover Error](https://discuss.elastic.co/t/metricbeat-rollover-error/294508)
**Author:** [@idlerm](https://discuss.elastic.co/u/idlerm)\ **Replies:** 0\ **Last updated:** [January 16, 2022, 8:31pm UTC](https://discuss.elastic.co/t/metricbeat-rollover-error/294508 "2022-01-16T20:31:18Z")
Hello all! I'm new to building EL and I can't seem to find the solution to an error I've been troubleshooting for days. I'm using version 7.13.4 for elastic and I've recently installed metricbeat into my server Everyt… --- ## [Elastic Agent - Memory Usage](https://discuss.elastic.co/t/elastic-agent-memory-usage/294463)
**Author:** [@Huber](https://discuss.elastic.co/u/Huber)\ **Replies:** 0\ **Last updated:** [January 14, 2022, 11:45pm UTC](https://discuss.elastic.co/t/elastic-agent-memory-usage/294463 "2022-01-14T23:45:42Z")
Hello, Is it normal that Elastic Agent utilizes around 500MB of ram on Windows 10 Endpoint Version 7.16.3 I have disabled for test Detection/Protection in the Policy. I have disabled all events collection DNS, Netwo… --- ## [Filebeat module dashboard](https://discuss.elastic.co/t/filebeat-module-dashboard/294309)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 6:23pm UTC](https://discuss.elastic.co/t/filebeat-module-dashboard/294309 "2022-01-13T18:23:53Z")
I have created a dashboard for filebeat nginx module. I'm not able to change the index pattern for the dahboard. It defaults to filebeat-\*. As i'm shipping the logs for other application in the same server i have already… --- ## [Listening to multiple ports for Netflow traffic](https://discuss.elastic.co/t/listening-to-multiple-ports-for-netflow-traffic/294226)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 3\ **Last updated:** [January 14, 2022, 1:35pm UTC](https://discuss.elastic.co/t/listening-to-multiple-ports-for-netflow-traffic/294226 "2022-01-14T13:35:47Z")
Hi, My filebeat 7.14.0 is currently listening on UDP port 1234 for Netflow packets using the Netflow module. Can I configure my netflow.yml to listen to multiple UDP ports for Netflow packets? E.g. (netflow.yml) - mod… --- ## [Filebeat docker container labels do not seems](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408)
**Author:** [@sahinguler](https://discuss.elastic.co/u/sahinguler)\ **Replies:** 2\ **Last updated:** [January 14, 2022, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-labels-do-not-seems/294408 "2022-01-14T13:05:07Z")
Hi all, I use filebeat and logstash for store my all datas. My docker setup and log files are in /home/docker/containers folder. (not in /var/lib/docker path) The problem is when i was colleting my logs, the docker fie… --- ## [HTTPJSON input : share request identifier among events](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924)
**Author:** [@thopic](https://discuss.elastic.co/u/thopic)\ **Replies:** 5\ **Last updated:** [January 14, 2022, 10:23am UTC](https://discuss.elastic.co/t/httpjson-input-share-request-identifier-among-events/293924 "2022-01-14T10:23:41Z")
Hi, I've been struggling for a long time to configure my filebeat to request RESTful APIs when the response is a JSON array of multiple objects. Because I want to sum a metric over time (this metric is present in each … --- ## [Filebeat ingesta de AWS CloudTrail](https://discuss.elastic.co/t/filebeat-ingesta-de-aws-cloudtrail/294184)
**Author:** [@Elisa\_LB](https://discuss.elastic.co/u/Elisa_LB)\ **Replies:** 1\ **Last updated:** [January 14, 2022, 9:46am UTC](https://discuss.elastic.co/t/filebeat-ingesta-de-aws-cloudtrail/294184 "2022-01-14T09:46:31Z")
Buenas tardes, Estoy teniendo inconvenientes con la ingesta de AWS CloudTrail mediante filebeat, tengo el agente conectado a la consola de Elastic Cloud y la configuración del modulo de aws en filebeat desde la consola … --- ## [Incomplete data transfer on winlogbeat 7.16.1](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [January 14, 2022, 3:40am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607 "2022-01-14T03:40:11Z")
hi, We upgraded ELK clusters to v7.16.1 on 2021/12/21. (winlogbeat v7.4.2) Everything is fine. And our AD servers updated patch 'KB5008218' on 2021/21/27. Winlogbeat transferred incomplete data to logstash! Our wind… --- ## [Elastic Agent is Healthy, but no data streams](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-data-streams/294224)
**Author:** [@harwinds](https://discuss.elastic.co/u/harwinds)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 10:06pm UTC](https://discuss.elastic.co/t/elastic-agent-is-healthy-but-no-data-streams/294224 "2022-01-13T22:06:34Z")
Hi, I'm running fleet managed elastic agent on Elastic 7.15.1. I've multiple agents running on Linux and Windows endpoints. All agents are showing healthy. On both Linux and Windows, custom certificate is added to system… --- ## [Error fetching data for metricset beat.state: error making http request: Get "https://xxx.xxxx.cloudapp.azure.com:5066/state": dial tcp connect: connection refused](https://discuss.elastic.co/t/error-fetching-data-for-metricset-beat-state-error-making-http-request-get-https-xxx-xxxx-cloudapp-azure-com-5066-state-dial-tcp-connect-connection-refused/294003)
**Author:** [@aviad.co1](https://discuss.elastic.co/u/aviad.co1)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 9:08pm UTC](https://discuss.elastic.co/t/error-fetching-data-for-metricset-beat-state-error-making-http-request-get-https-xxx-xxxx-cloudapp-azure-com-5066-state-dial-tcp-connect-connection-refused/294003 "2022-01-13T21:08:42Z")
Hi, I'm Build remote monitoring cluster elastic stack to monitor elastic production environment. I'm install metricbeats on the target and success to configure elasticsearch-xpack and kibana-xpack, and I see metrics on… --- ## [Filebeat deployed as deamonset reports wrong image versions for containers](https://discuss.elastic.co/t/filebeat-deployed-as-deamonset-reports-wrong-image-versions-for-containers/294329)
**Author:** [@vikas1389](https://discuss.elastic.co/u/vikas1389)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-deployed-as-deamonset-reports-wrong-image-versions-for-containers/294329 "2022-01-13T20:46:00Z")
Hey Team- seeing filebeat is reporting older image where is container has latest image- I see lot of logs like below on filebeat- what could be issue 2022-01-13T20:29:34.022Z INFO log/harvester.go:333 File is inactive: … --- ## [Winlogbeat sending data to default index](https://discuss.elastic.co/t/winlogbeat-sending-data-to-default-index/294210)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 4:00pm UTC](https://discuss.elastic.co/t/winlogbeat-sending-data-to-default-index/294210 "2022-01-13T16:00:28Z")
Trying to setup winlogbeat but it seems to be sending documents only to default index - winlogbeat-7\* instead of the one I explicity mentioned in the winlogbeat.yml. I must be missing something basic but can't figure out… --- ## [Cisco module in FIlbeat - General doubt](https://discuss.elastic.co/t/cisco-module-in-filbeat-general-doubt/294212)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 2\ **Last updated:** [January 13, 2022, 2:41pm UTC](https://discuss.elastic.co/t/cisco-module-in-filbeat-general-doubt/294212 "2022-01-13T14:41:10Z")
I have to enable multiple filesets in the Cisco Module of Filebeat. Is that possible? Can I set a document\_type for each fileset such as ASA, IOS, NEXUS, etc while configuring the modules? It is required for me to fil… --- ## [Grok error with filebeat's nginx module while parsing default nginx logs](https://discuss.elastic.co/t/grok-error-with-filebeats-nginx-module-while-parsing-default-nginx-logs/294286)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 13, 2022, 2:25pm UTC](https://discuss.elastic.co/t/grok-error-with-filebeats-nginx-module-while-parsing-default-nginx-logs/294286 "2022-01-13T14:25:59Z")
Hi, I am trying to setup filebeat in a kubernetes cluster. I only want to gather logs from specific pods. I decided to run filebeat as daemonset and use the autodiscover and hints. So I can decide by setting pod annotat… --- ## [Exiting: 1 error: error loading config file: invalid config: yaml: line 13: did not find expected key](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-13-did-not-find-expected-key/294162)
**Author:** [@awis](https://discuss.elastic.co/u/awis)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 1:18pm UTC](https://discuss.elastic.co/t/exiting-1-error-error-loading-config-file-invalid-config-yaml-line-13-did-not-find-expected-key/294162 "2022-01-13T13:18:03Z")
Hi there, I'm trying to connect Filebeat Snort module with my Elasticsearch and when i run command .\\filebeat.exe setup -e on Windows 10 Pro VM, I got this error. This is my configuration for filebeat.yml filebeat.in… --- ## [Metricbeat error while enabling windows metrics](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245)
**Author:** [@inmar](https://discuss.elastic.co/u/inmar)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 8:41am UTC](https://discuss.elastic.co/t/metricbeat-error-while-enabling-windows-metrics/294245 "2022-01-13T08:41:06Z")
Hi I am running ES stack on linux ubuntu inside windows hyper-v VM. I installed metricbeat with deb package, enabled system metrics everything worked well. I want to add windows metrics to be collected in the ES. Whe… --- ## [(another) Custome Index Name for Filebeat](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 8:44pm UTC](https://discuss.elastic.co/t/another-custome-index-name-for-filebeat/293283 "2022-01-12T20:44:44Z")
First: Happy New Year! Second: I have seen various other posts on this topic, but they always seem to timeout before getting to an answer. I an running ELK 7.13.4 I have an Elasticsearch that ingests data from multipl… --- ## [Does Heartbeat have feature like Logstash pipeline?](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793)
**Author:** [@Ray\_Lin](https://discuss.elastic.co/u/Ray_Lin)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 8:30pm UTC](https://discuss.elastic.co/t/does-heartbeat-have-feature-like-logstash-pipeline/292793 "2022-01-12T20:30:19Z")
Hi, I am trying to monitor a healthcheck url but it has to first call a token API to get the token then pass the token value to the next healthcheck API which I actually want to monitor. In the past, I'm using Logstash… --- ## [Wrong response code sent by heartbeat](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132)
**Author:** [@Fosco](https://discuss.elastic.co/u/Fosco)\ **Replies:** 1\ **Last updated:** [January 12, 2022, 8:29pm UTC](https://discuss.elastic.co/t/wrong-response-code-sent-by-heartbeat/294132 "2022-01-12T20:29:03Z")
Hello, I am using heartbeat to retrieve the code 200 from a website, but for the moment the website is returning a 500 code. But heartbeat is returning 200.. I am using the 7.10.2 version of heartbeat (on the 7.9.2 it'… --- ## [Run multiple queries to MySQL](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154)
**Author:** [@vPilot](https://discuss.elastic.co/u/vPilot)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/run-multiple-queries-to-mysql/293154 "2022-01-12T16:12:04Z")
I have my mysql.yml file configured to run two separate queries for collecting both processlist details and replication details: - module: mysql metricsets: - status - query queries: - query: … --- ## [Metricbeat on Fleet 20-30% CPU](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 4\ **Last updated:** [January 12, 2022, 4:09pm UTC](https://discuss.elastic.co/t/metricbeat-on-fleet-20-30-cpu/293972 "2022-01-12T16:09:24Z")
Hello, I'm having 20% of CPU usage in a brand fresh Ubuntu installation. I'm running under Fleet so I'm not sure where to start/debug. Any advice? Thanks! --- ## [Filebeat: Microsoft Module seems to be acquiring the same events for a period of time](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179)
**Author:** [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-module-seems-to-be-acquiring-the-same-events-for-a-period-of-time/294179 "2022-01-12T15:15:05Z")
I am testing the Filebeat Microsoft Module using the eicar test files from Download Anti Malware Testfile – Eicar. I download one of the files. Then, Windows Defender AV "prevents" the infection (and generates events fr… --- ## [Filebeat : Split the multiline json(array of json object) from message field to separate fields](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 2\ **Last updated:** [January 12, 2022, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-split-the-multiline-json-array-of-json-object-from-message-field-to-separate-fields/294134 "2022-01-12T13:08:05Z")
I need to use filebeat to push my json data into Elasticsearch, but I'm having trouble decoding my json fields into separate fields extracted from the message field. Filebeat version : 7.16.2 Filebeat.yml filebeat.inp… --- ## [Elastic Agent -\> Oracle Metrics / Oracle Logs via Filebeat to Logstash to Elasticsearch](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elastic-agent-oracle-metrics-oracle-logs-via-filebeat-to-logstash-to-elasticsearch/294159 "2022-01-12T12:18:25Z")
Hello, i am preparing to switch my beat infrastructure to Elastic-agent. I notices that there is no real integration for oracle-metrics, is that correct or what do i have to do to use oracle-metric-module within elastic… --- ## [Metricbeat showing wrong usage of memory](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147)
**Author:** [@lalchand\_rajak](https://discuss.elastic.co/u/lalchand_rajak)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 11:11am UTC](https://discuss.elastic.co/t/metricbeat-showing-wrong-usage-of-memory/294147 "2022-01-12T11:11:10Z")
when I am using free -h command on server it's showing something else and metricbeat showing something else, attaching both snapshots. --- ## [Customization winlogbeat 7.16.2 on windows server](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110)
**Author:** [@holpa](https://discuss.elastic.co/u/holpa)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 5:28am UTC](https://discuss.elastic.co/t/customization-winlogbeat-7-16-2-on-windows-server/294110 "2022-01-12T05:28:01Z")
Hello. Tell me how to set it up correctly. There is a server srvlog, it collects all logs from domain controllers (forward event). How to configure WinLogbeat to send logs received by this server? My config now: winlo… --- ## [About filebeat config error](https://discuss.elastic.co/t/about-filebeat-config-error/294119)
**Author:** [@yanwencheng](https://discuss.elastic.co/u/yanwencheng)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 8:03am UTC](https://discuss.elastic.co/t/about-filebeat-config-error/294119 "2022-01-12T08:03:08Z")
filebeat config setup.kibana.then setup i get console error sudo filebeat setup Index setup finished. Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana… --- ## [Functionbeat 7.16.2 parses quoted strings with periods as objects](https://discuss.elastic.co/t/functionbeat-7-16-2-parses-quoted-strings-with-periods-as-objects/294097)
**Author:** [@cafuego](https://discuss.elastic.co/u/cafuego)\ **Replies:** 0\ **Last updated:** [January 12, 2022, 1:16am UTC](https://discuss.elastic.co/t/functionbeat-7-16-2-parses-quoted-strings-with-periods-as-objects/294097 "2022-01-12T01:16:44Z")
We maintain a set of billing tags on our AWS resources that are prefixed with "cost.". The 7.16.2 version of functionbeat errors out on those tags, despite me quoting the tag strings in the yaml file, it interprets them … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=111) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=113)