# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=158 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 159 --- ## [Drop\_event processor not working](https://discuss.elastic.co/t/drop-event-processor-not-working/272786)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 2\ **Last updated:** [May 12, 2021, 3:31pm UTC](https://discuss.elastic.co/t/drop-event-processor-not-working/272786 "2021-05-12T15:31:04Z")
I have a proccessor to drop some events for a user. here is my config: processors: - drop\_event: when: and: - or: - equals.event.code: 4658 - equals.event.code: 4656 - equals.even… --- ## [Searching Does not Return Results - Challenge](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/271116)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 2\ **Last updated:** [May 12, 2021, 2:58pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/271116 "2021-05-12T14:58:15Z")
I posted a search question Searching Does not Return Results - Challenge - #7 by Gary\_Blackwell, but it was the wrong forum. I have not had time to learn the scripting someone in the forum requested that I learn. I hav… --- ## [Is this registered\_domain processor's problem?](https://discuss.elastic.co/t/is-this-registered-domain-processors-problem/272819)
**Author:** [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\ **Replies:** 0\ **Last updated:** [May 12, 2021, 2:32pm UTC](https://discuss.elastic.co/t/is-this-registered-domain-processors-problem/272819 "2021-05-12T14:32:58Z")
I am using the winlogbeat-sysmon.js without modifying. But some domain have wrong result like attached image. I think there is no problem with the public suffix list. What is solution? Thank you. --- ## [Unable to Install Filebeat . Need some help in fixing installation issue](https://discuss.elastic.co/t/unable-to-install-filebeat-need-some-help-in-fixing-installation-issue/272574)
**Author:** [@vishnu\_rao](https://discuss.elastic.co/u/vishnu_rao)\ **Replies:** 3\ **Last updated:** [May 12, 2021, 11:53am UTC](https://discuss.elastic.co/t/unable-to-install-filebeat-need-some-help-in-fixing-installation-issue/272574 "2021-05-12T11:53:38Z")
I am trying to install filebeat on IBM Clould Kubernetes Service , but the demonset does not start for the filebeat.. seeing below error. Request you to help fixing the issue. Warning FailedCreate DaemonSet Error … --- ## [Doubt about Elasticsearch module of Filebeat on container \[7.9.2\]](https://discuss.elastic.co/t/doubt-about-elasticsearch-module-of-filebeat-on-container-7-9-2/272189)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 11\ **Last updated:** [May 12, 2021, 8:53am UTC](https://discuss.elastic.co/t/doubt-about-elasticsearch-module-of-filebeat-on-container-7-9-2/272189 "2021-05-12T08:53:09Z")
Hi, everyone I have been testing with Elasticsearch module of Filebeat in order to have information about Elasticsearch. I work with Kubernetes and I have created a deployment with Filebeat. Here are you are my Filebea… --- ## [Regarding XPack Metric Collection with Beats](https://discuss.elastic.co/t/regarding-xpack-metric-collection-with-beats/272650)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [May 11, 2021, 8:38am UTC](https://discuss.elastic.co/t/regarding-xpack-metric-collection-with-beats/272650 "2021-05-11T08:38:28Z")
Hi, I have configured metricbeat on a logstash instance to send xpack metrics to a remote elasticsearch cluster. The metrics are being shipped and indexed and are accessible via the kibana monitoring view. However, they… --- ## [Metricbeat-\* vs metrics-\*](https://discuss.elastic.co/t/metricbeat-vs-metrics/272612)
**Author:** [@muhdiekuh](https://discuss.elastic.co/u/muhdiekuh)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 7:06pm UTC](https://discuss.elastic.co/t/metricbeat-vs-metrics/272612 "2021-05-11T19:06:51Z")
I noticed that these days there are index patterns & dashboards for both metricbeat-\* and metrics-\*. What's that about? I'm using logstash to ingest the data into elasticsearch, so my data goes into the metricbeat-\* ind… --- ## [Filebeat 7.12 is collecting the events very slowly](https://discuss.elastic.co/t/filebeat-7-12-is-collecting-the-events-very-slowly/272579)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 8:52am UTC](https://discuss.elastic.co/t/filebeat-7-12-is-collecting-the-events-very-slowly/272579 "2021-05-11T08:52:30Z")
I have deployed filebeat 7.12 in my cluster to collect events from kubernetes logs using autodiscover. The events are being collected in NRT (Near Real Time) for all the pods that I wish but stopped collecting only for … --- ## [Beats indexes not being created after upgrading stack from oss-7.9.3 =\> basic-7.12.1](https://discuss.elastic.co/t/beats-indexes-not-being-created-after-upgrading-stack-from-oss-7-9-3-basic-7-12-1/271798)
**Author:** [@danpatdav](https://discuss.elastic.co/u/danpatdav)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 1:55pm UTC](https://discuss.elastic.co/t/beats-indexes-not-being-created-after-upgrading-stack-from-oss-7-9-3-basic-7-12-1/271798 "2021-05-11T13:55:08Z")
First post, so please feel free to let me know how things work around here. :slight\_smile: For the past several months I have been using OSS Elasticsearch + Beats to pull metrics from a few systems. The beats run in d… --- ## [Can't get disk information (Windows) - Metricbeat 7.12.0](https://discuss.elastic.co/t/cant-get-disk-information-windows-metricbeat-7-12-0/270735)
**Author:** [@ruivit](https://discuss.elastic.co/u/ruivit)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 8:42am UTC](https://discuss.elastic.co/t/cant-get-disk-information-windows-metricbeat-7-12-0/270735 "2021-05-11T08:42:28Z")
Hi everyone. After a couple of minutes searching and trying out solutions, I still can't get information about the filesystem and fsstat of, for example of the C drive on my Windows Server. Tried the following … --- ## [Howto ingest from application logs and modules?](https://discuss.elastic.co/t/howto-ingest-from-application-logs-and-modules/272627)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 3:42am UTC](https://discuss.elastic.co/t/howto-ingest-from-application-logs-and-modules/272627 "2021-05-11T03:42:24Z")
We have a system from which we would like to collect the regular system modules. filebeat modules enable system and done. Great. Nothing is out of place. But we have another application that requires an independent ent… --- ## [Filebeat log.json file](https://discuss.elastic.co/t/filebeat-log-json-file/272528)
**Author:** [@shifenglim](https://discuss.elastic.co/u/shifenglim)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 2:41am UTC](https://discuss.elastic.co/t/filebeat-log-json-file/272528 "2021-05-11T02:41:22Z")
My application team tried an experiment for filebeat, They deleted the log file that filebeat was harvesting and each time the log file is deleted, in the directory, a file in the path /data/registry/filebeat/log.json k… --- ## [Configuring analyser for field inside filbeat configuration file](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232)
**Author:** [@bbtl](https://discuss.elastic.co/u/bbtl)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:44pm UTC](https://discuss.elastic.co/t/configuring-analyser-for-field-inside-filbeat-configuration-file/270232 "2021-05-10T16:44:13Z")
Hi I am currently using filbeat to send logs to ELK stack. However, one of the fields has a syslog structure and I would like to force filbeat to use a whitespace analyser and I would also like to have the .raw version … --- ## [Okta Module drops a lot of debugContext information from events](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:18pm UTC](https://discuss.elastic.co/t/okta-module-drops-a-lot-of-debugcontext-information-from-events/272588 "2021-05-10T14:18:41Z")
I recently noticed that the Okta module (mainly the Elastic pipeline) drops a good amount of data from the debugData field when moving it from json.debugContext to okta.debug\_context, and was wondering if this is intende… --- ## [Upgrade Agents Offline](https://discuss.elastic.co/t/upgrade-agents-offline/272585)
**Author:** [@scottdfedorov](https://discuss.elastic.co/u/scottdfedorov)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 2:05pm UTC](https://discuss.elastic.co/t/upgrade-agents-offline/272585 "2021-05-10T14:05:44Z")
The docs are clear that Fleet: Requires internet access for Kibana to download integration packages and No proxy support in Elastic Agent However, it appears that each Agent also requires internet access in order… --- ## [Error calling pipeline when setting the document ID in beats](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560)
**Author:** [@Francisco\_Peralta\_Gu](https://discuss.elastic.co/u/Francisco_Peralta_Gu)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 1:30pm UTC](https://discuss.elastic.co/t/error-calling-pipeline-when-setting-the-document-id-in-beats/272560 "2021-05-10T13:30:29Z")
Hi. I'm facing issues when I try to set the document id in filebeat to avoid duplicates: I have a filebeat configuration as following: filebeat.inputs: - type: log paths: - /dumps-json/wsdumps/\*\* … --- ## [Filebeat slowness issue due to Continuously keeping 200+ open files](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876)
**Author:** [@rohitguptaggg](https://discuss.elastic.co/u/rohitguptaggg)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 11:45am UTC](https://discuss.elastic.co/t/filebeat-slowness-issue-due-to-continuously-keeping-200-open-files/271876 "2021-05-10T11:45:05Z")
Hi team, Suffering with issue of filebeat (version 7.0.1) slowness.Our application is generating logs in different file locations and after reaching the log file size to 2 gb, it is generating another new file after ren… --- ## [Metricbeat suddenly stops reporting](https://discuss.elastic.co/t/metricbeat-suddenly-stops-reporting/272563)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 10:58am UTC](https://discuss.elastic.co/t/metricbeat-suddenly-stops-reporting/272563 "2021-05-10T10:58:19Z")
I have a weird situation going on I have a group of windows servers, all running metricbeat (7.10.0) and using the IIS module to monitor IIS statistics. They all send to a central redis that collects the data, which th… --- ## [Error Uploading Template to Elasticsearch](https://discuss.elastic.co/t/error-uploading-template-to-elasticsearch/272275)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 8:58am UTC](https://discuss.elastic.co/t/error-uploading-template-to-elasticsearch/272275 "2021-05-10T08:58:58Z")
Hi. I'm adding the 7.12.1 template to our elasticsearch cluster. However, I'm getting this error: Exiting: error loading template: could not load template. Elasticsearch returned: couldn't load template: 400 Bad Reques… --- ## [Elastic Agent Ingest Manager Error 7.12.1](https://discuss.elastic.co/t/elastic-agent-ingest-manager-error-7-12-1/271711)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 0\ **Last updated:** [April 29, 2021, 7:50pm UTC](https://discuss.elastic.co/t/elastic-agent-ingest-manager-error-7-12-1/271711 "2021-04-29T19:50:25Z")
I have a issue similar to this one: \[Ingest Manager\] Unable to collect logs on machines with timezone set · Issue #24229 · elastic/beats · GitHub I am running docker 7.12.1 elasticsearch and Kibana. I am using elastic-a… --- ## [GeoIP from dns.ip\_resolved](https://discuss.elastic.co/t/geoip-from-dns-ip-resolved/272520)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 7:20am UTC](https://discuss.elastic.co/t/geoip-from-dns-ip-resolved/272520 "2021-05-10T07:20:25Z")
Hey guys! I'm using my raspberry pi as a network scanner, I would like to create a map dashboard in kibana which contains the destinations geo location FROM dns resolved IPs. Home network, there are only private IPs, s… --- ## [Installation of filebeat in Docker multi container server](https://discuss.elastic.co/t/installation-of-filebeat-in-docker-multi-container-server/272540)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 6:32am UTC](https://discuss.elastic.co/t/installation-of-filebeat-in-docker-multi-container-server/272540 "2021-05-10T06:32:54Z")
Can you please provide the details related to using the filebeat in multi container docker environment - 1 filebeat per container and 1 filebeat for all containers, considering the log monitoring use case. Any pointer to… --- ## [Filebeat cannot setup](https://discuss.elastic.co/t/filebeat-cannot-setup/272305)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 13\ **Last updated:** [May 10, 2021, 3:11am UTC](https://discuss.elastic.co/t/filebeat-cannot-setup/272305 "2021-05-10T03:11:50Z")
i wanna setup my filebeat but i have a report like this \[root@bdi-uat-splunkes filebeat\]# filebeat setup Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch… --- ## [How do I collect the highest disk active time in Resource Monitor?](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 9:27am UTC](https://discuss.elastic.co/t/how-do-i-collect-the-highest-disk-active-time-in-resource-monitor/272398 "2021-05-07T09:27:29Z")
I want to collect the highest disk active time via Metricbeat. I tried to check the data by adding the PhysicalDisk(\_Total)% Disk Time counter in the Performance Monitor Properties. However, when I display the… --- ## [Need to define a role for Filebet and metricbeat for writing to elasticsearch](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 8\ **Last updated:** [May 10, 2021, 12:28am UTC](https://discuss.elastic.co/t/need-to-define-a-role-for-filebet-and-metricbeat-for-writing-to-elasticsearch/272503 "2021-05-10T00:28:26Z")
I am running v7.7 of the stack from a ZIP install on Windows. But I have the same issue with v7.12 running as docker container on a Mac. I've searched and searched and either I don't know what to search for, or I don't… --- ## [WinlogBeat - parsing "message" field](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:06am UTC](https://discuss.elastic.co/t/winlogbeat-parsing-message-field/272497 "2021-05-09T11:06:04Z")
Greetings! I'm using basic setup that uses Winlogbeat with configured sysmon. I'm writing some correlation rules and I would like to detect whether powershell command is suspiciously long. The command itself is in "mes… --- ## [Filebeat processor syntax 7.12.1](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 12\ **Last updated:** [May 9, 2021, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-processor-syntax-7-12-1/271768 "2021-05-09T21:51:40Z")
Hello, I want to add some fields explanation because names that are provided via logs are not self-explaining enough. I guess It's best to do this operation on filebeat level to not use resources during the pipeline pro… --- ## [How can we use the beats-provided Kibana dashboards but use a custom index-pattern name?](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282)
**Author:** [@Husnain](https://discuss.elastic.co/u/Husnain)\ **Replies:** 5\ **Last updated:** [May 9, 2021, 11:26am UTC](https://discuss.elastic.co/t/how-can-we-use-the-beats-provided-kibana-dashboards-but-use-a-custom-index-pattern-name/271282 "2021-05-09T11:26:11Z")
Hii,I am using Filebeat 7.12.0 to ingest netflow flows and store it into elasticsearch.I want to load the example dashboards of filebeat but with an index pattern different than filebeat-\*.How can I do this? I am running… --- ## [Filebeat not pushing log to Logstash](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [May 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-not-pushing-log-to-logstash/272478 "2021-05-08T22:07:11Z")
Hi All, I am using ELK stack 7.6.2. The log does not get pushed from Filebeat to Logstash for some reason. The log /opt/ttcmkts/work/bcdcommoncache/bcd.log is rolling very fast. My logstash conf file looks like bel… --- ## [Functionbeats and Role Name Error](https://discuss.elastic.co/t/functionbeats-and-role-name-error/272454)
**Author:** [@gonrial](https://discuss.elastic.co/u/gonrial)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 10:39pm UTC](https://discuss.elastic.co/t/functionbeats-and-role-name-error/272454 "2021-05-07T22:39:33Z")
I have an error when building a functionbeat lambda to ship other lambdas logs to elastic cloud. The reason is that the name is too long. According to the documentation should be ~20 chars long, but in this case is 16 c… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=157) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=159)