# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607)
**Author:** [@Jeya\_Pradeen1](https://discuss.elastic.co/u/Jeya_Pradeen1)\ **Replies:** 4\ **Last updated:** [January 8, 2026, 9:08pm UTC](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607 "2026-01-08T21:08:20Z")
We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license. Blackduck scanning tools detect elastic… --- ## [Filebeat clients unable to publish events to logstash](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592)
**Author:** [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\ **Replies:** 31\ **Last updated:** [December 31, 2025, 2:42am UTC](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592 "2025-12-31T02:42:21Z")
Hi all, I had a filebeat to logstash setup running successfully for the past months where both services where running on the same host. I recently moved filebeat to it's own server in a different zone. I am able to hit … --- ## [Can not modify my fleet server and agent configuration on ECK](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265)
**Author:** [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)\ **Replies:** 12\ **Last updated:** [December 30, 2025, 3:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265 "2025-12-30T03:42:12Z")
I deployed eck-operator on my microk8s system. Then I used eck-operator to deploy Elasticsearch and Kibana. Next, I wanted to deploy Fleet and its agent. I added the configuration to Kibana (as shown in Figure 1). A… --- ## [Auditbeat Exclusion of Process](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243)
**Author:** [@testtest](https://discuss.elastic.co/u/testtest)\ **Replies:** 2\ **Last updated:** [December 27, 2025, 1:31pm UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243 "2025-12-27T13:31:27Z")
Hi All, Could someone help me with exclude any process executable related to this path /usr/local/manageengine/uems\_agent/bin/\* (I can see a lot of incoming logs related to /usr/local/manageengine/uems\_agent/bin/dcpa… --- ## [Auditbeat javascript processor error with v9.2.3](https://discuss.elastic.co/t/auditbeat-javascript-processor-error-with-v9-2-3/384188)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 2\ **Last updated:** [December 19, 2025, 12:48am UTC](https://discuss.elastic.co/t/auditbeat-javascript-processor-error-with-v9-2-3/384188 "2025-12-19T00:48:04Z")
Any idea what could be wrong with my processor? Version: 9.2.3 Operating System: ubuntu 22.04 LTS Steps to Reproduce: Processor listed below Setting up auditbeat on a new host encountered an error with a config I know… --- ## [Bearer Authorization in Custom API integration](https://discuss.elastic.co/t/bearer-authorization-in-custom-api-integration/375105)
**Author:** [@tsturg15](https://discuss.elastic.co/u/tsturg15)\ **Replies:** 4\ **Last updated:** [December 18, 2025, 6:57pm UTC](https://discuss.elastic.co/t/bearer-authorization-in-custom-api-integration/375105 "2025-12-18T18:57:48Z")
I am working with an API that only provides Bearer token's. Is it possible to create a custom API integration using this API if they only provide bearer authorization through the headers and not basic, digest, or Oauth2? … --- ## [Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [December 12, 2025, 7:25am UTC](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768 "2025-12-12T07:25:47Z")
harvester\_buffer\_size: 5368709120 message\_max\_bytes: 5368709120 multiline.max\_lines: 5368709120 i configured above configuration in filebet after am getting below issue mp":"2025-11-30T05:04:30.546-0500","log.logger":"… --- ## [Filebeat registry not working for filestream input](https://discuss.elastic.co/t/filebeat-registry-not-working-for-filestream-input/383758)
**Author:** [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\ **Replies:** 1\ **Last updated:** [December 10, 2025, 8:35am UTC](https://discuss.elastic.co/t/filebeat-registry-not-working-for-filestream-input/383758 "2025-12-10T08:35:36Z")
I found some of the filebeat instances in our production environment resend logfiles and suspected the registry as the root cause. Trying to dig into it I got really confused about the registry, maybe someone can help m… --- ## [Filebeat filestream input has inconsistent tag output when using "take\_over"](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900)
**Author:** [@mike.guthrie](https://discuss.elastic.co/u/mike.guthrie)\ **Replies:** 2\ **Last updated:** [December 9, 2025, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900 "2025-12-09T18:17:36Z")
We recently upgraded from beats 7.x and moved to beats 8.x. When we moved from input type of log to filestream, all of our logstash routing broke because the tags are inconsistent in the events. We are using the take\_ove… --- ## [Filebeat occasionally loses logs: Dropping event: no topic could be selected (Kubernetes + Kafka)](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685)
**Author:** [@ruizengyang](https://discuss.elastic.co/u/ruizengyang)\ **Replies:** 9\ **Last updated:** [December 8, 2025, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685 "2025-12-08T16:01:51Z")
Hi everyone, I’ve been troubleshooting an issue for the last few days and would like to confirm whether this behavior is expected or if there is a workaround. Problem When Filebeat starts on a Kubernetes node (DaemonS… --- ## [Debian 13 and Beats 8.x](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870)
**Author:** [@d3jolly](https://discuss.elastic.co/u/d3jolly)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 5:50pm UTC](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870 "2025-12-04T17:50:40Z")
Hi, According to the Support Matrix, Beats on Debian 13 (at least Filebeat and Metricbeat, since e.g. Auditbeat doesn’t list anything past Debian 10) should be v9.2.x Potential issues when running unofficially supporte… --- ## [Filebeat 9.2.1multiline pattern not grouping MariaDB slow query logs](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643)
**Author:** [@Amanuel\_Genetu](https://discuss.elastic.co/u/Amanuel_Genetu)\ **Replies:** 2\ **Last updated:** [December 3, 2025, 10:36am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643 "2025-12-03T10:36:40Z")
I am trying to collect MariaDB slow query logs with Filebeat and group each query as a single event. My logs look like this: SET timestamp=1764062324; SELECT TABLE\_NAME FROM information\_schema.TABLES WHERE TABLE\_SCHE… --- ## [Autodiscover with filters not working](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716)
**Author:** [@kifkoman](https://discuss.elastic.co/u/kifkoman)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 3:42pm UTC](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716 "2025-12-01T15:42:40Z")
Hi, I am trying to set filebeat with autodiscover based on labels present in the pod. Below is my config \`\`yaml logging.level: debug logging.selectors: \["autodiscover", "kubernetes", "container"\] filebeat.autodiscov… --- ## [\[indices:admin/create\] is unauthorized for user Elastic Stack](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767)
**Author:** [@frahmn](https://discuss.elastic.co/u/frahmn)\ **Replies:** 17\ **Last updated:** [November 30, 2025, 9:19pm UTC](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767 "2025-11-30T21:19:30Z")
I have read through many articles and am not able to solve this issue for me. I’m trying to generate a new api key that has rights over creating indicies using filebeat. I have tried doing this through the superuser acco… --- ## [Filebeat is not able to read the message event if the attachment is more than 2 GBin the log file](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 4\ **Last updated:** [November 30, 2025, 5:27pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765 "2025-11-30T17:27:51Z")
Filebeat is not able to read the message event if the attachment is more than 2 GB in in request contact the log file. --- ## [Winlogbeat 9.2.1 Fails to Ingest Specific Windows Application Event (Winlogon Event ID 6000)](https://discuss.elastic.co/t/winlogbeat-9-2-1-fails-to-ingest-specific-windows-application-event-winlogon-event-id-6000/383593)
**Author:** [@banksmt](https://discuss.elastic.co/u/banksmt)\ **Replies:** 1\ **Last updated:** [November 22, 2025, 8:37am UTC](https://discuss.elastic.co/t/winlogbeat-9-2-1-fails-to-ingest-specific-windows-application-event-winlogon-event-id-6000/383593 "2025-11-22T08:37:15Z")
We are experiencing an issue where Winlogbeat successfully ingests all Windows log channels (Application/System/Security/Sysmon) except for one very specific event type: Microsoft-Windows-Winlogon — Event ID 6000 ("The … --- ## [Error creating runner from config: can not convert 'object' into 'string' accessing 'diskio.include\_devices.0'](https://discuss.elastic.co/t/error-creating-runner-from-config-can-not-convert-object-into-string-accessing-diskio-include-devices-0/383533)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 21, 2025, 1:17pm UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-can-not-convert-object-into-string-accessing-diskio-include-devices-0/383533 "2025-11-21T13:17:35Z")
Hello, As I noticed a lot of ”Could not return any performance counter values for \\.\\Y: .Error: Incorrect function.” For the diskio dataset, I tried setting: But this results in: Error creating runner from config… --- ## [Filebeat running as non-root user to read docker container logs](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540)
**Author:** [@MrHedgehog](https://discuss.elastic.co/u/MrHedgehog)\ **Replies:** 0\ **Last updated:** [November 19, 2025, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540 "2025-11-19T16:23:22Z")
Environment: Rocky Linux 9.6. Filebeat 8.19.7 (tar.gz install). Docker version 29.0.2 (API 1.52). SELinux enabled (but no difference with it in permissive mode) With filebeat (tar.gz install) running as a non-root user … --- ## [How to Resolve Filebeat File Reading and Ingest Target Warning Issues](https://discuss.elastic.co/t/how-to-resolve-filebeat-file-reading-and-ingest-target-warning-issues/383506)
**Author:** [@siva0030](https://discuss.elastic.co/u/siva0030)\ **Replies:** 1\ **Last updated:** [November 18, 2025, 4:36pm UTC](https://discuss.elastic.co/t/how-to-resolve-filebeat-file-reading-and-ingest-target-warning-issues/383506 "2025-11-18T16:36:33Z")
Hello Team, I am currently using the Filebeat configuration shown below. Recently, Filebeat has started logging frequent warning messages such as “\[points to an already known ingest target\]”. I noticed that if I do not… --- ## [Looking for a reliably stable Metricbeat version for Windows Server 2008 / 2008 R2](https://discuss.elastic.co/t/looking-for-a-reliably-stable-metricbeat-version-for-windows-server-2008-2008-r2/383457)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 4\ **Last updated:** [November 16, 2025, 6:33pm UTC](https://discuss.elastic.co/t/looking-for-a-reliably-stable-metricbeat-version-for-windows-server-2008-2008-r2/383457 "2025-11-16T18:33:19Z")
Hi everyone, I’m looking for advice on which Metricbeat version is known to run reliably on Windows Server 2003, Windows server 2008 and Windows Server 2008 R2. I’m fully aware that these operating systems are EOL and … --- ## [Regarding FileBeats Configuration Issues](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358)
**Author:** [@RainZ](https://discuss.elastic.co/u/RainZ)\ **Replies:** 3\ **Last updated:** [November 14, 2025, 12:17pm UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358 "2025-11-14T12:17:55Z")
I have set up an ELK server currently in the testing phase. I deployed a Filebeats instance on a Windows Server to collect logs from Application, Security, System, and Windows PowerShell. However, my Logstash is only cap… --- ## [Easier acces to information regarding the default fields sent by all the Beats](https://discuss.elastic.co/t/easier-acces-to-information-regarding-the-default-fields-sent-by-all-the-beats/383290)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 1\ **Last updated:** [November 7, 2025, 5:08pm UTC](https://discuss.elastic.co/t/easier-acces-to-information-regarding-the-default-fields-sent-by-all-the-beats/383290 "2025-11-07T17:08:19Z")
Hi there, I have a quick suggestion to improve the documentation of all the beats. Why don’t you add a section explaining the default fields that are expected of the beats, in the documentation? I don’t have to work of… --- ## [Missing metrics documentation](https://discuss.elastic.co/t/missing-metrics-documentation/383047)
**Author:** [@kim.ae](https://discuss.elastic.co/u/kim.ae)\ **Replies:** 1\ **Last updated:** [November 5, 2025, 4:57pm UTC](https://discuss.elastic.co/t/missing-metrics-documentation/383047 "2025-11-05T16:57:10Z")
I am trying to evaluate performance of filebeat instalation in a K8S, for that I was able to export filebeat metrics to prometheus. I was unable to find any comprehensive documentation regarding the metrics, so I am not… --- ## [Filebeat Dynamic Output File Path Configuration Issue](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871)
**Author:** [@jiwanging](https://discuss.elastic.co/u/jiwanging)\ **Replies:** 2\ **Last updated:** [November 4, 2025, 8:57pm UTC](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871 "2025-11-04T20:57:09Z")
I'm trying to configure Filebeat to dynamically output files to paths and filenames that map to the original source paths and filenames. For example: Source path to collect: /root/filebeat/log/source\_log/\*.log Desired … --- ## [Struggling to set up multiple namespaces for a single Beats data stream](https://discuss.elastic.co/t/struggling-to-set-up-multiple-namespaces-for-a-single-beats-data-stream/383212)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [November 4, 2025, 4:27pm UTC](https://discuss.elastic.co/t/struggling-to-set-up-multiple-namespaces-for-a-single-beats-data-stream/383212 "2025-11-04T16:27:54Z")
Dear community In Elastic Fleet you can set a namespace for an integration so you can have multiple data streams for a single type of index template without having to duplicate settings (ILM policy, index template, comp… --- ## [Problem using chain within httpjson input](https://discuss.elastic.co/t/problem-using-chain-within-httpjson-input/362893)
**Author:** [@nidworkx](https://discuss.elastic.co/u/nidworkx)\ **Replies:** 2\ **Last updated:** [October 29, 2025, 2:19am UTC](https://discuss.elastic.co/t/problem-using-chain-within-httpjson-input/362893 "2025-10-29T02:19:17Z")
Dear community, as soon as we configure a chain task within the httpjson input we receive the following error {"function":"github.com/elastic/beats/v7/x-pack/filebeat/input/httpjson.run.func1","file.name":"httpjson/inp… --- ## [ECK Filebeat, ID duplicate for containers in the same namespace as Filebeat](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016)
**Author:** [@kee8veiN](https://discuss.elastic.co/u/kee8veiN)\ **Replies:** 3\ **Last updated:** [October 28, 2025, 4:36pm UTC](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016 "2025-10-28T16:36:11Z")
Hello team. I encountered a problem (ECK installation) with Beats/Filebeat (autodiscover Kubernetes mode), {"log.level":"error","@timestamp":"2025-10-27T11:34:59.854Z","log.logger":"input","log.origin":{"function":"git… --- ## [SASL\_PLAINTEXT AND SASL\_SSL ISSUE](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 10:32am UTC](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043 "2025-10-28T10:32:16Z")
Kafka Output Configuration (unified for both sources) output.kafka: hosts: \["xxxxxxx:19094"\] # Updated to use the SSL-enabled broker topic: 'npc-raw-msg' key: '%{\[UUID\]}' codec.format: string: '%{\[message\]}' parti… --- ## [Add 'process.args\_count' to Windows Security ingest pipeline](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903)
**Author:** [@elkn00b](https://discuss.elastic.co/u/elkn00b)\ **Replies:** 1\ **Last updated:** [October 28, 2025, 12:26am UTC](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903 "2025-10-28T00:26:45Z")
Hello All, We’ve had this fix in place for a while, but I noticed when checking open issues that an enhancement request existed to add process.args\_count to the Elastic Agent integrations. I’ve reviewed the code for bo… --- ## [Exporting logs from Azure storage account to Logstash using Filebeat in Kubernetes](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926)
**Author:** [@ramakoteswar](https://discuss.elastic.co/u/ramakoteswar)\ **Replies:** 0\ **Last updated:** [October 23, 2025, 2:45pm UTC](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926 "2025-10-23T14:45:20Z")
I wan to export the logs from Azure storage account to a Logstash. Seems like ELK doesn’t provide any plugin to export data from storage account to Logstash directly. They provide only Filebeat plugin. Because filebeat r… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=1) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=3)