# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=146 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 147 --- ## [Fleet requires insecure flag to enroll](https://discuss.elastic.co/t/fleet-requires-insecure-flag-to-enroll/277395)
**Author:** [@Jukocross](https://discuss.elastic.co/u/Jukocross)\ **Replies:** 1\ **Last updated:** [July 6, 2021, 3:53pm UTC](https://discuss.elastic.co/t/fleet-requires-insecure-flag-to-enroll/277395 "2021-07-06T15:53:11Z")
I tried setting up TLS with reference to Encrypt traffic in a self-managed cluster | Fleet User Guide \[7.13\] | Elastic. However, I faced Error: fail to enroll: fail to execute request to fleet-server: x509: certificate… --- ## [I have100 microservices on single server so Can I collect all services logs using single filebeat?](https://discuss.elastic.co/t/i-have100-microservices-on-single-server-so-can-i-collect-all-services-logs-using-single-filebeat/277917)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 2\ **Last updated:** [July 6, 2021, 1:26pm UTC](https://discuss.elastic.co/t/i-have100-microservices-on-single-server-so-can-i-collect-all-services-logs-using-single-filebeat/277917 "2021-07-06T13:26:00Z")
I have100 microservices on single server so Can I collect all services logs using single filebeat ?? --- ## [Metricbeat error starting](https://discuss.elastic.co/t/metricbeat-error-starting/277851)
**Author:** [@yassoukoin](https://discuss.elastic.co/u/yassoukoin)\ **Replies:** 2\ **Last updated:** [July 6, 2021, 1:03pm UTC](https://discuss.elastic.co/t/metricbeat-error-starting/277851 "2021-07-06T13:03:46Z")
Hello, I configured metricbeat on my serveur and when I enabled system.yml file and restart service's i got this error (fetching data for metricset beat.stats). see below the error snapchat Need Help Thanks. --- ## [Agent stuck on "Updating" when enrolling](https://discuss.elastic.co/t/agent-stuck-on-updating-when-enrolling/277703)
**Author:** [@greggailly](https://discuss.elastic.co/u/greggailly)\ **Replies:** 4\ **Last updated:** [July 6, 2021, 11:26am UTC](https://discuss.elastic.co/t/agent-stuck-on-updating-when-enrolling/277703 "2021-07-06T11:26:18Z")
Hi everybody, After updating our stack to version 7.13.2 we have been experiencing problems when trying to enroll agents to Fleet. Since fleet-server was introduced we added it to our stack and behind our reverse proxy… --- ## [Filebeat configuration file troubles](https://discuss.elastic.co/t/filebeat-configuration-file-troubles/277952)
**Author:** [@111489](https://discuss.elastic.co/u/111489)\ **Replies:** 0\ **Last updated:** [July 6, 2021, 11:20am UTC](https://discuss.elastic.co/t/filebeat-configuration-file-troubles/277952 "2021-07-06T11:20:03Z")
Hello, I have installed elasticsearch, kibana and filebeat on kubernetes cluster version 7.6.1 within separate namespace. My main goal was gather logs from other two namespaces within this cluster. But still I have tro… --- ## [How to make filebeat ship the missed logs of a period?](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 3\ **Last updated:** [July 6, 2021, 10:30am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-the-missed-logs-of-a-period/277873 "2021-07-06T10:30:24Z")
Hi! I have an index retrieving data from logstash (which gets its data from filebeat itself). There are some logs that were missed by filebeat (because filebeat was installed later on the node) and the dashboards are not… --- ## [Agent randomly stops sending data but still checks in to fleet](https://discuss.elastic.co/t/agent-randomly-stops-sending-data-but-still-checks-in-to-fleet/277704)
**Author:** [@greggailly](https://discuss.elastic.co/u/greggailly)\ **Replies:** 3\ **Last updated:** [July 6, 2021, 9:05am UTC](https://discuss.elastic.co/t/agent-randomly-stops-sending-data-but-still-checks-in-to-fleet/277704 "2021-07-06T09:05:15Z")
Hi everybody, In case it might be related, the agents were enrolled according to the procedure described in the following topic https://discuss.elastic.co/t/agent-stuck-on-updating-when-enrolling/277703 as enroll proces… --- ## [Configure Filebeats on Docker to read logs in Widnows Directory (C:/LogsESB/\*/\*.log)](https://discuss.elastic.co/t/configure-filebeats-on-docker-to-read-logs-in-widnows-directory-c-logsesb-log/277924)
**Author:** [@DockerEngineer](https://discuss.elastic.co/u/DockerEngineer)\ **Replies:** 0\ **Last updated:** [July 6, 2021, 8:06am UTC](https://discuss.elastic.co/t/configure-filebeats-on-docker-to-read-logs-in-widnows-directory-c-logsesb-log/277924 "2021-07-06T08:06:27Z")
Hello Community, I need your help to understand how we can configure Filebeat running on Docker to read a Windows Directory path, I am attaching my Docker compose and Filebeat Yaml file. Thanks for your help. Filebeat… --- ## [Winlogbeat Secrets Key Store](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 2\ **Last updated:** [July 6, 2021, 5:37am UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457 "2021-07-06T05:37:53Z")
Hi there! (Reference link that I used for what I tried: Secrets keystore for secure settings) Here's with I did to setup my Winlogbeat's communication with Elasticsearch, with the use of an API key (instead of credenti… --- ## [Change default filebeat index name](https://discuss.elastic.co/t/change-default-filebeat-index-name/277646)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 1\ **Last updated:** [July 6, 2021, 3:45am UTC](https://discuss.elastic.co/t/change-default-filebeat-index-name/277646 "2021-07-06T03:45:33Z")
Hi! I am using the Suricata filebeat module to send Suricata logs directly to ES. I am using all the default filebeat indexes. I want to change the default index and index patterns names to be suricata instead of fileb… --- ## [Authorization headers leaked on failed config check](https://discuss.elastic.co/t/authorization-headers-leaked-on-failed-config-check/277662)
**Author:** [@nefta-kanilmaz-by](https://discuss.elastic.co/u/nefta-kanilmaz-by)\ **Replies:** 1\ **Last updated:** [July 6, 2021, 3:42am UTC](https://discuss.elastic.co/t/authorization-headers-leaked-on-failed-config-check/277662 "2021-07-06T03:42:40Z")
Hi everyone, I am using the heartbeat hint based auto discovery feature. I have configured a HTTP monitor and added headers (including the authorization part) to the heartbeat.yml. When the auto discover config check f… --- ## [Problems getting filebeat to connect to logstash container running in kubernetes](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754)
**Author:** [@RyanCherry](https://discuss.elastic.co/u/RyanCherry)\ **Replies:** 3\ **Last updated:** [July 6, 2021, 12:48am UTC](https://discuss.elastic.co/t/problems-getting-filebeat-to-connect-to-logstash-container-running-in-kubernetes/277754 "2021-07-06T00:48:30Z")
Hi there, I have used the helm chart to install logstash onto my kubernetes cluster, however I am having problems getting filebeat to send logs to logstash. Filebeat is running on a windows server as a service on that s… --- ## [ILM and custom index names](https://discuss.elastic.co/t/ilm-and-custom-index-names/277563)
**Author:** [@muhdiekuh](https://discuss.elastic.co/u/muhdiekuh)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 11:25pm UTC](https://discuss.elastic.co/t/ilm-and-custom-index-names/277563 "2021-07-05T23:25:03Z")
Hi, I'm using ILM with filebeat. Right now I'm using the default configuration. I'd like to adjust it a little bit now, but I'm not sure if what I want to do is actually possible. I'd like to have a separate index for … --- ## [Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 7:45pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/277879 "2021-07-05T19:45:55Z")
Hello, Second try.. (Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry) Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, th… --- ## [Metricbeat: "More than one write index" errors in version 7.13.x](https://discuss.elastic.co/t/metricbeat-more-than-one-write-index-errors-in-version-7-13-x/275355)
**Author:** [@bwright1558](https://discuss.elastic.co/u/bwright1558)\ **Replies:** 6\ **Last updated:** [July 5, 2021, 12:03pm UTC](https://discuss.elastic.co/t/metricbeat-more-than-one-write-index-errors-in-version-7-13-x/275355 "2021-07-05T12:03:47Z")
Ever since upgrading the elastic stack from 7.12.1 to 7.13.x, we've been getting frequent hang ups with running metricbeat (or any other beat) due to the following error: 2021-06-08T22:01:05.930Z ERROR \[index-management… --- ## [Metricbeat - collects the dockers memory size which is different from “docker stats”](https://discuss.elastic.co/t/metricbeat-collects-the-dockers-memory-size-which-is-different-from-docker-stats/277830)
**Author:** [@SperChung-11](https://discuss.elastic.co/u/SperChung-11)\ **Replies:** 0\ **Last updated:** [July 5, 2021, 12:01pm UTC](https://discuss.elastic.co/t/metricbeat-collects-the-dockers-memory-size-which-is-different-from-docker-stats/277830 "2021-07-05T12:01:35Z")
Hi，I have met a problem as follows： i have use metricbeat to collect docker memory, but found that the data of memory (suce as memory usage) was different from the "docker stats", is it right ? metricbeat: 7.6.0 --- ## [Kibana Monitoring with Metricbeat](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 9:44am UTC](https://discuss.elastic.co/t/kibana-monitoring-with-metricbeat/277660 "2021-07-05T09:44:33Z")
Hi, I'm trying to monitor Kibana using metricbeat - pretty standard Im having an issue where Metricbeat is getting a forbidden response from the Kibana URL. I have tested using an curl with the same credentials and it … --- ## [Set up logging settings for filebeat as environment variables](https://discuss.elastic.co/t/set-up-logging-settings-for-filebeat-as-environment-variables/277648)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:30am UTC](https://discuss.elastic.co/t/set-up-logging-settings-for-filebeat-as-environment-variables/277648 "2021-07-05T09:30:00Z")
I've been searching for documentation regarding passing environmental variables to filebeat in order to set up logging, but I wasn't able to find out. Can anyone help me in this respect? I've only been able to find thi… --- ## [How to regulate filebeat memory usages](https://discuss.elastic.co/t/how-to-regulate-filebeat-memory-usages/277653)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:24am UTC](https://discuss.elastic.co/t/how-to-regulate-filebeat-memory-usages/277653 "2021-07-05T09:24:41Z")
I have filebeat deployed in kubernetes with following configuration filebeat.ymlfilebeat.config: inputs: enabled: true path: inputs.d/\*.yml reload.enabled: true reload.period: 10s … --- ## [Metricbeat daemonset modules fails](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/277683)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 9:16am UTC](https://discuss.elastic.co/t/metricbeat-daemonset-modules-fails/277683 "2021-07-05T09:16:14Z")
I have configured following modules for metricbeat daemonset in AWS EKS modulessystem.yml: |- - module: system period: 10s metricsets: - cpu - load - memory - network … --- ## [Unable to start start fleet server](https://discuss.elastic.co/t/unable-to-start-start-fleet-server/277710)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 8:45am UTC](https://discuss.elastic.co/t/unable-to-start-start-fleet-server/277710 "2021-07-05T08:45:54Z")
Hi, I am trying to start fleet server. However, I encounter the following error when starting it: Fleet Server - Error - info fail \[401 Unauthorized\] {"error":{"root\_cause":\[{"type":"security\_exception","reason":"faile… --- ## [Instaall filebeat on Oracle Solaris on SPARC (64-bit) OS](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882)
**Author:** [@Mar-g2021](https://discuss.elastic.co/u/Mar-g2021)\ **Replies:** 3\ **Last updated:** [July 5, 2021, 5:55am UTC](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882 "2021-07-05T05:55:38Z")
Filebeat can be installed or there is another beat that can be installed on Oracle Solaris on SPARC (64-bit) OS version 11.4 to send database logs? --- ## [\[Solved\] Elastic agent as fleet server auto shutdown for no reason in K8S](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724)
**Author:** [@SaigyoujiYuyuko233](https://discuss.elastic.co/u/SaigyoujiYuyuko233)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 9:26am UTC](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724 "2021-07-04T09:26:05Z")
Contextualization I'm trying to run a fleet server using elastic agent in k8s Using docker img: docker.elastic.co/beats/elastic-agent:7.13.2 Elasticsearch Ver: 7.13.2 Kibana Ver: 7.13.2 What happened When the fleet s… --- ## [Heartbeat monitor api login](https://discuss.elastic.co/t/heartbeat-monitor-api-login/275900)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 3\ **Last updated:** [July 2, 2021, 8:12pm UTC](https://discuss.elastic.co/t/heartbeat-monitor-api-login/275900 "2021-07-02T20:12:29Z")
I want to monitor API login endpoint /api/v1/login. When I login using postman I get following response {"id":"###-###-###-###-###","access\_token":"\*\*\*\*","refresh\_token":"\*\*\*\*"} I tried following in heartbeat.yaml refe… --- ## [HTTP JSON input: one array one document](https://discuss.elastic.co/t/http-json-input-one-array-one-document/277327)
**Author:** [@thopic](https://discuss.elastic.co/u/thopic)\ **Replies:** 6\ **Last updated:** [July 2, 2021, 1:19pm UTC](https://discuss.elastic.co/t/http-json-input-one-array-one-document/277327 "2021-07-02T13:19:18Z")
Hello, I am using the HTTP JSON input of Filebeat to query some APIs and get some metrics. The problem is for some of them to send a JSON array instead of a JSON object. If I want to make a count of a specific metric, I… --- ## [Filebeat has big delay to send log to Kafka](https://discuss.elastic.co/t/filebeat-has-big-delay-to-send-log-to-kafka/277589)
**Author:** [@cpotato](https://discuss.elastic.co/u/cpotato)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 6:43pm UTC](https://discuss.elastic.co/t/filebeat-has-big-delay-to-send-log-to-kafka/277589 "2021-07-01T18:43:03Z")
Hi, We have log server running filebeat to send log data to Kafka. The log file is on NFS mounted filesystem. we do logrotate hourly, the size of the file is ~18G at the peak time. we have log time and the time received… --- ## [FileBeat consumes Kafka, every time a FileBeat is started as a consumer, Kafka needs to spend several hours for the rebalancing, and only the first FileBeat will not have the rebalancing](https://discuss.elastic.co/t/filebeat-consumes-kafka-every-time-a-filebeat-is-started-as-a-consumer-kafka-needs-to-spend-several-hours-for-the-rebalancing-and-only-the-first-filebeat-will-not-have-the-rebalancing/277627)
**Author:** [@hadogen](https://discuss.elastic.co/u/hadogen)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 8:56am UTC](https://discuss.elastic.co/t/filebeat-consumes-kafka-every-time-a-filebeat-is-started-as-a-consumer-kafka-needs-to-spend-several-hours-for-the-rebalancing-and-only-the-first-filebeat-will-not-have-the-rebalancing/277627 "2021-07-02T08:56:43Z")
ENV: kafka. 2.12-2.0.1 x 3 filebeat version 7.12.1. x N kafka config file: broker.id=111 listeners=PLAINTEXT://172.30.160.16:9091 advertised.listeners=PLAINTEXT://172.30.160.16:9091 num.network.threads=48 num.io.t… --- ## [Auditbeat not updating record/docs in index](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 1:17am UTC](https://discuss.elastic.co/t/auditbeat-not-updating-record-docs-in-index/277605 "2021-07-02T01:17:20Z")
I have installed Auditbeat and configured it on a RHEL machine. Auditbeat status shows that it is running. However, index for Auditbeat shows zero docs count. Auditd service is disabled. I have deleted and recreated the… --- ## [ILM policy for filebeats through config file](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 8:54pm UTC](https://discuss.elastic.co/t/ilm-policy-for-filebeats-through-config-file/277597 "2021-07-01T20:54:37Z")
I want to setup ILM through filebeat.yml I have following config # ====================== Index Lifecycle Management (ILM) ====================== # Configure index lifecycle management (ILM). These settings cr… --- ## [Filebeat Error on Widows Machine](https://discuss.elastic.co/t/filebeat-error-on-widows-machine/277562)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 1\ **Last updated:** [July 1, 2021, 5:49pm UTC](https://discuss.elastic.co/t/filebeat-error-on-widows-machine/277562 "2021-07-01T17:49:51Z")
How do I troubleshoot the following error? PS C:\\Program Files\\Filebeat\> .\\filebeat.exe -e 2021-07-01T12:20:50.286+0100 ERROR \[syslog\] syslog/input.go:155 Error starting the servererrorlisten tcp 127.0.… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=145) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=147)