# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=136 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 137 --- ## [Packetbeat Processors - Dropping fields from nested objects in an array](https://discuss.elastic.co/t/packetbeat-processors-dropping-fields-from-nested-objects-in-an-array/282988)
**Author:** [@yotamgod](https://discuss.elastic.co/u/yotamgod)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 11:21am UTC](https://discuss.elastic.co/t/packetbeat-processors-dropping-fields-from-nested-objects-in-an-array/282988 "2021-09-01T11:21:30Z")
I recently started working with Packetbeat. For my use-case, I only need some specific fields (to the point where if I could, I would completely rewrite the mapping, but am leaving that as a last resort). I tried remov… --- ## [Can not achive namespace annotations from OKD (kubernetes)](https://discuss.elastic.co/t/can-not-achive-namespace-annotations-from-okd-kubernetes/283032)
**Author:** [@hollden](https://discuss.elastic.co/u/hollden)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 11:18am UTC](https://discuss.elastic.co/t/can-not-achive-namespace-annotations-from-okd-kubernetes/283032 "2021-09-01T11:18:44Z")
Good day! I'am trying to collect namespace annotations from OKD cluster without any success, while namespace labels is colleted perfectly. Node annotations are not getting either. My config: filebeatConfig: fileb… --- ## [Sending output to two indices](https://discuss.elastic.co/t/sending-output-to-two-indices/282909)
**Author:** [@proxymoxy](https://discuss.elastic.co/u/proxymoxy)\ **Replies:** 2\ **Last updated:** [September 1, 2021, 10:24am UTC](https://discuss.elastic.co/t/sending-output-to-two-indices/282909 "2021-09-01T10:24:12Z")
Hi, I am in the process of implementing Filebeat/Elasticsearch (not using logstash) to index my logs and create some graphics in Kibana. I have set up the system module in Filebeat which works fine and sends the logs to… --- ## [Is there any solution for just checking the file availability？](https://discuss.elastic.co/t/is-there-any-solution-for-just-checking-the-file-availability/282668)
**Author:** [@lpf86731782](https://discuss.elastic.co/u/lpf86731782)\ **Replies:** 6\ **Last updated:** [September 1, 2021, 9:44am UTC](https://discuss.elastic.co/t/is-there-any-solution-for-just-checking-the-file-availability/282668 "2021-09-01T09:44:05Z")
the system receives a bunch of files daily, monitoring the file availability and size is important for the service quality. No need to check the file content though. Is there any proper way to achieve this with ELK? --- ## [Newbie qn: ingesting netflow](https://discuss.elastic.co/t/newbie-qn-ingesting-netflow/283000)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 1\ **Last updated:** [September 1, 2021, 9:38am UTC](https://discuss.elastic.co/t/newbie-qn-ingesting-netflow/283000 "2021-09-01T09:38:42Z")
Hi all, I'm a newbie in ELK, and would like to send Netflow data to ElasticSearch via Filebeat (both on the same server). I'm starting to read all the documentation and configuration guides, but I'm a bit confused about… --- ## [Error establishing direct connection to mongo node at \[ip:port\]. Error output: no reachable servers](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434)
**Author:** [@devopshulk](https://discuss.elastic.co/u/devopshulk)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434 "2021-09-01T06:59:26Z")
Hi, I am using MongoDB with a replica set. When I am trying to create a metricbeat MongoDB module am not sure How to give a URL. I don't understand how to solve it. when uncommenting the ssl.verification\_mode: 'none' th… --- ## [GKE cos\_containerd node make filebeat unable to sending logs out](https://discuss.elastic.co/t/gke-cos-containerd-node-make-filebeat-unable-to-sending-logs-out/282961)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 8:33pm UTC](https://discuss.elastic.co/t/gke-cos-containerd-node-make-filebeat-unable-to-sending-logs-out/282961 "2021-08-31T20:33:58Z")
Hi All We are using GKE , however after 1.19 version gke side will default select cos\_containerd as their new node image type( for remove the docker stuff) We afraid the docker version node will remove in future time … --- ## [Metricbeat socket stats - metricbeat](https://discuss.elastic.co/t/metricbeat-socket-stats-metricbeat/282936)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 3:06pm UTC](https://discuss.elastic.co/t/metricbeat-socket-stats-metricbeat/282936 "2021-08-31T15:06:13Z")
hi - trying to enable metricbeat socket stats on linux server (VM). Tried following the documentation steps, but still don't see the socket stats sent to elastic. We are running metricbeat as root and so permissions is n… --- ## [Metricbeat on Openshift not really supported?](https://discuss.elastic.co/t/metricbeat-on-openshift-not-really-supported/282054)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 5\ **Last updated:** [August 31, 2021, 1:41pm UTC](https://discuss.elastic.co/t/metricbeat-on-openshift-not-really-supported/282054 "2021-08-31T13:41:16Z")
Hi folks, any of you running metricbeat on openshift to collect state metrics? It looks like it is not supported to collect state metrics of DeploymentConfigs and ReplicationContollers. Anyone ran into this issue? How … --- ## [\[Functionbeat\] Logstash output not uploading logs](https://discuss.elastic.co/t/functionbeat-logstash-output-not-uploading-logs/282900)
**Author:** [@BaronWhite](https://discuss.elastic.co/u/BaronWhite)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 10:24am UTC](https://discuss.elastic.co/t/functionbeat-logstash-output-not-uploading-logs/282900 "2021-08-31T10:24:13Z")
Hello, I'm trying to configure the logstash output on Functionbeat 1.14.0, I found this thread saying this is not supported, however it's two years old and the docs don't mention it: The lambda was setup with .\\functi… --- ## [Metricbeat Error event](https://discuss.elastic.co/t/metricbeat-error-event/282896)
**Author:** [@Yash\_Agrawal](https://discuss.elastic.co/u/Yash_Agrawal)\ **Replies:** 0\ **Last updated:** [August 31, 2021, 9:21am UTC](https://discuss.elastic.co/t/metricbeat-error-event/282896 "2021-08-31T09:21:29Z")
Metricbeat sends an error event when the service is not reachable. How can i configure my metricbeat so that it gives me an update everytime a process is down. (A "process" not a service in the system module) --- ## [Wrong details parsing - Windows event-log](https://discuss.elastic.co/t/wrong-details-parsing-windows-event-log/282841)
**Author:** [@Go0La](https://discuss.elastic.co/u/Go0La)\ **Replies:** 0\ **Last updated:** [August 30, 2021, 4:21pm UTC](https://discuss.elastic.co/t/wrong-details-parsing-windows-event-log/282841 "2021-08-30T16:21:48Z")
Hello friends, In some alerts Elastic shows the full log but in others i get for example not the user name but the user SID (not as the eventViewer log). Suggestions to fix? Uploaded a picture. --- ## [Multiline logs](https://discuss.elastic.co/t/multiline-logs/282835)
**Author:** [@111360](https://discuss.elastic.co/u/111360)\ **Replies:** 2\ **Last updated:** [August 31, 2021, 7:19am UTC](https://discuss.elastic.co/t/multiline-logs/282835 "2021-08-31T07:19:34Z")
In filebeat config: multiline.type: pattern multiline.pattern: '^\[' multiline.negate: true multiline.match: after From Manage multiline messages | Filebeat Reference \[7.14\] | Elastic and test log ''' \[beat-logstas… --- ## [Heartbeat uptime service sample dashboard](https://discuss.elastic.co/t/heartbeat-uptime-service-sample-dashboard/282759)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 7\ **Last updated:** [August 31, 2021, 2:48am UTC](https://discuss.elastic.co/t/heartbeat-uptime-service-sample-dashboard/282759 "2021-08-31T02:48:43Z")
Hi friends I really need your help. I have few service for few instances. I need visualize 1 instance how many service is up and how many was down. U can use table. But I wish to have like graph but I really no idea how… --- ## [PCAP data with Packetbeat](https://discuss.elastic.co/t/pcap-data-with-packetbeat/282854)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 0\ **Last updated:** [August 30, 2021, 9:37pm UTC](https://discuss.elastic.co/t/pcap-data-with-packetbeat/282854 "2021-08-30T21:37:46Z")
Hello, I am unable to ship PCAP packets to Packetbeat. I am getting the following error message root@ubuntu:/home/zeekelk/Downloads/PCAP-03-11# packetbeat run -I SAT-03-11-2018\_0145 -t Exiting: Sniffer main loop failed… --- ## [Metricbeat Oracle Module](https://discuss.elastic.co/t/metricbeat-oracle-module/282822)
**Author:** [@nafey1](https://discuss.elastic.co/u/nafey1)\ **Replies:** 2\ **Last updated:** [August 30, 2021, 8:43pm UTC](https://discuss.elastic.co/t/metricbeat-oracle-module/282822 "2021-08-30T20:43:07Z")
I have enabled the Oracle Metricbeat module to monitor my database. The configuration file looks like this: - module: oracle metricsets: \["tablespace", "performance"\] enabled: true period: 10s hosts: \["oracle://… --- ## [Having issues with running auditbeat on ubuntu docker-compose](https://discuss.elastic.co/t/having-issues-with-running-auditbeat-on-ubuntu-docker-compose/282843)
**Author:** [@Techy\_Vince](https://discuss.elastic.co/u/Techy_Vince)\ **Replies:** 3\ **Last updated:** [August 30, 2021, 8:30pm UTC](https://discuss.elastic.co/t/having-issues-with-running-auditbeat-on-ubuntu-docker-compose/282843 "2021-08-30T20:30:35Z")
Hey guys this is my error log Index setup finished. Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://kibana:5601/… --- ## [Can't setup Winlogbeat or Filebeat dashboards for Kibana](https://discuss.elastic.co/t/cant-setup-winlogbeat-or-filebeat-dashboards-for-kibana/281962)
**Author:** [@JulienL](https://discuss.elastic.co/u/JulienL)\ **Replies:** 4\ **Last updated:** [August 30, 2021, 5:11pm UTC](https://discuss.elastic.co/t/cant-setup-winlogbeat-or-filebeat-dashboards-for-kibana/281962 "2021-08-30T17:11:06Z")
Hello! Firstly, sorry for any mistake in my english. I'm not a native english speaker :slight\_smile: Hope can someone help me with this. I have installed and configured ELK with "Basic Security plus HTTPS", I receive … --- ## [Fleet Server x509 Error (GODEBUG=x509ignoreCN=0)](https://discuss.elastic.co/t/fleet-server-x509-error-godebug-x509ignorecn-0/281427)
**Author:** [@morgan.atwood](https://discuss.elastic.co/u/morgan.atwood)\ **Replies:** 4\ **Last updated:** [August 30, 2021, 3:01pm UTC](https://discuss.elastic.co/t/fleet-server-x509-error-godebug-x509ignorecn-0/281427 "2021-08-30T15:01:53Z")
Greeting, Running into a problem with setting up the Fleet server. I have a standalone development server running Kibana, Elasticsearch, and Elastic-agent. Very excited to try out the new agent and security features in… --- ## [Default dashboard for heartbeat not working](https://discuss.elastic.co/t/default-dashboard-for-heartbeat-not-working/282743)
**Author:** [@selin](https://discuss.elastic.co/u/selin)\ **Replies:** 7\ **Last updated:** [August 30, 2021, 2:05pm UTC](https://discuss.elastic.co/t/default-dashboard-for-heartbeat-not-working/282743 "2021-08-30T14:05:02Z")
Hi can I know is there default dashboard for heartbeat? I try enable setup dashboard. But in dashboard section i cant view it. U have any idea --- ## [ELK MetricBeat - Monitor remote mysqlDB](https://discuss.elastic.co/t/elk-metricbeat-monitor-remote-mysqldb/282717)
**Author:** [@ashwin](https://discuss.elastic.co/u/ashwin)\ **Replies:** 4\ **Last updated:** [August 30, 2021, 2:05pm UTC](https://discuss.elastic.co/t/elk-metricbeat-monitor-remote-mysqldb/282717 "2021-08-30T14:05:24Z")
I have installed ELK stack (With metricbeat) on ServerA and want to monitor mysql on ServerB. I added db host details on ServerA mysql.yml metribeat module file (/etc/metricbeat/modules.d/mysql.yml) - module: mysql … --- ## [Metricbeat Kubernetes Module not loading Node Disk I/O status to elasticsearch](https://discuss.elastic.co/t/metricbeat-kubernetes-module-not-loading-node-disk-i-o-status-to-elasticsearch/282828)
**Author:** [@Sowmya](https://discuss.elastic.co/u/Sowmya)\ **Replies:** 0\ **Last updated:** [August 30, 2021, 2:02pm UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-not-loading-node-disk-i-o-status-to-elasticsearch/282828 "2021-08-30T14:02:10Z")
Hi, I need kubernetes Node Disk I/O status metrics from metricbeat to elasticsearch.. Is this can be done by metricbeat or not? Thank You --- ## [Netflow not supported?](https://discuss.elastic.co/t/netflow-not-supported/282410)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [August 30, 2021, 7:54am UTC](https://discuss.elastic.co/t/netflow-not-supported/282410 "2021-08-30T07:54:03Z")
HI there, I´m trying to setup netflow using filebeat and the only thing I can see is this message: filebeat\[2804\]: 2021-08-24T18:10:01.108-0300 WARN \[netflow\] netflow/input.go:242 Error parsi… --- ## [Elastic Agent Error](https://discuss.elastic.co/t/elastic-agent-error/282706)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [August 30, 2021, 7:50am UTC](https://discuss.elastic.co/t/elastic-agent-error/282706 "2021-08-30T07:50:58Z")
Not sure where this goes....move if needed... I am trying out the Elastic Agent. I've downloaded the agent to the server, setup a policy on the fleet server and am copy/pasting the command in Fleet Server to enroll the… --- ## [Elastic Agent Integration Dashboards Not Loading](https://discuss.elastic.co/t/elastic-agent-integration-dashboards-not-loading/282707)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [August 30, 2021, 7:49am UTC](https://discuss.elastic.co/t/elastic-agent-integration-dashboards-not-loading/282707 "2021-08-30T07:49:50Z")
Recently setup Elastic Fleet server, added a policy and intergrations, and deployed the agent to a server. However, the dashboards these integrations are supposed to load do not exist anywhere. How do I get these dashb… --- ## [Dynamic Beat Index with ILM](https://discuss.elastic.co/t/dynamic-beat-index-with-ilm/282725)
**Author:** [@thedanielmatt](https://discuss.elastic.co/u/thedanielmatt)\ **Replies:** 2\ **Last updated:** [August 30, 2021, 1:26am UTC](https://discuss.elastic.co/t/dynamic-beat-index-with-ilm/282725 "2021-08-30T01:26:58Z")
Hello, I could use some help with dynamic indexes. I would like to create separate Filebeat indexes for a specific module, e.g. cisco. Steps I took: Added a "when.equals" condition to my elastic output in filebeats.y… --- ## [Kibana view systemctl status](https://discuss.elastic.co/t/kibana-view-systemctl-status/282691)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 1\ **Last updated:** [August 30, 2021, 1:20am UTC](https://discuss.elastic.co/t/kibana-view-systemctl-status/282691 "2021-08-30T01:20:57Z")
Hi bro and sis How can I monitor systemctl status to see which is stopped and running. I am using kibana and metricbeat --- ## [Filebeat failed to create alias](https://discuss.elastic.co/t/filebeat-failed-to-create-alias/282625)
**Author:** [@Daniel.X](https://discuss.elastic.co/u/Daniel.X)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 4:44am UTC](https://discuss.elastic.co/t/filebeat-failed-to-create-alias/282625 "2021-08-27T04:44:14Z")
Hey there, I'm running the filebeat docker container as a side container in my task definition on a container on AWS Fargate. I'm getting this error when filebeat is started. It used to work before, The only change I ha… --- ## [Multiple azure app insights in metricbeat](https://discuss.elastic.co/t/multiple-azure-app-insights-in-metricbeat/282618)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 0\ **Last updated:** [August 27, 2021, 12:55am UTC](https://discuss.elastic.co/t/multiple-azure-app-insights-in-metricbeat/282618 "2021-08-27T00:55:25Z")
Hi Everyone, I am currently pulling in Azure App Insights data in ELK Stack using Metricbeat, like this module: azure metricsets: - app\_insights enabled: true period: 300s application\_id: '' api\_key: '' … --- ## [Add tags in filebeat modules](https://discuss.elastic.co/t/add-tags-in-filebeat-modules/282750)
**Author:** [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\ **Replies:** 4\ **Last updated:** [August 29, 2021, 6:57pm UTC](https://discuss.elastic.co/t/add-tags-in-filebeat-modules/282750 "2021-08-29T18:57:03Z")
Hi all, I have beats installed on my logstash instance. My idea is to collect multiple logs using filebeat modules -\> send it to logstash on port 5044 -\> send it to elasticsearch. Can I add tags in each of the filebeat… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=135) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=137)