# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=238 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 239 --- ## [Autodiscover drop default filebeat index](https://discuss.elastic.co/t/autodiscover-drop-default-filebeat-index/237237)
**Author:** [@Shiny\_Hou](https://discuss.elastic.co/u/Shiny_Hou)\ **Replies:** 9\ **Last updated:** [June 19, 2020, 6:05am UTC](https://discuss.elastic.co/t/autodiscover-drop-default-filebeat-index/237237 "2020-06-19T06:05:14Z")
I don't want need filbeat-version-%{+yyyy.MM.dd} Index, my config don't have the config ， but the container log still input to filbeat-version-%{+yyyy.MM.dd} --- filebeat.autodiscover: providers: - type… --- ## [How does winlogbeat handle different OS languages](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 11:44pm UTC](https://discuss.elastic.co/t/how-does-winlogbeat-handle-different-os-languages/233437 "2020-06-18T23:44:07Z")
Hello, We use QRadar's wincollect for collecting windows event logs. During the process of windows server integration and since we might have different languages depend on the location (English, spanish or french) we en… --- ## [Winlogbeat Service won't start error 1067](https://discuss.elastic.co/t/winlogbeat-service-wont-start-error-1067/236688)
**Author:** [@richard.andersson](https://discuss.elastic.co/u/richard.andersson)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 9:24pm UTC](https://discuss.elastic.co/t/winlogbeat-service-wont-start-error-1067/236688 "2020-06-18T21:24:42Z")
Hi, Version we have tested with winlogbeat-7.7.1 and winlogbeat-6.8.10 and winlogbeat-7.6.0 and winlogbeat-6.5.0 OS: Windows Server 2016. We have problem to start winlogbeat Service with error 1067 We have test start… --- ## [Filebeat delay to harvest after restart](https://discuss.elastic.co/t/filebeat-delay-to-harvest-after-restart/236889)
**Author:** [@b0nete](https://discuss.elastic.co/u/b0nete)\ **Replies:** 8\ **Last updated:** [June 18, 2020, 5:42pm UTC](https://discuss.elastic.co/t/filebeat-delay-to-harvest-after-restart/236889 "2020-06-18T17:42:25Z")
Hi, i go to tell about my problem. I have one server with filebeat installed, an this use logstash.output to send logs to graylog. This work, but my problem is that i have a 15/20min delay after apply config changes and… --- ## [Dissect processor issue](https://discuss.elastic.co/t/dissect-processor-issue/237278)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 5:31pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278 "2020-06-18T17:31:48Z")
v7.2 When setting target\_prefix to "" (empty string) the output from the dissector does not appear in console. When I set it to anything else, including a single whitespace, it does appear. Any suggestions ? --- ## [Compile OSS Beats](https://discuss.elastic.co/t/compile-oss-beats/237679)
**Author:** [@magneton](https://discuss.elastic.co/u/magneton)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 4:44pm UTC](https://discuss.elastic.co/t/compile-oss-beats/237679 "2020-06-18T16:44:08Z")
Dear Sirs, I have successfully compiled beats from https://github.com/elastic/beats on a Pine64 arm64 device. However, it will not connect to my elasticsearch. I think the verion produced is not the OSS version. Can s… --- ## [Metricbeat & zabbix](https://discuss.elastic.co/t/metricbeat-zabbix/237515)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 3:38pm UTC](https://discuss.elastic.co/t/metricbeat-zabbix/237515 "2020-06-18T15:38:43Z")
which one is better for large computer center (10,000+) linux system? we have zabbix running at this time with alerting and few more stuff with it. tested metricbeat with few system, just system level stuff and index b… --- ## [Mage build from x-pack/metricbeat fails](https://discuss.elastic.co/t/mage-build-from-x-pack-metricbeat-fails/237664)
**Author:** [@RaoulDuke-Esq](https://discuss.elastic.co/u/RaoulDuke-Esq)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 3:17pm UTC](https://discuss.elastic.co/t/mage-build-from-x-pack-metricbeat-fails/237664 "2020-06-18T15:17:06Z")
Building from beats/metricbeat works just fine but building from x-pack/metricbeat fails go version go1.14.3 darwin/amd64 in ....../beats/x-pack/metricbeat GOOS=linux GOARCH=arm mage build \>\> build: Building metricbe… --- ## [After windows update Filebeat service stops immediately](https://discuss.elastic.co/t/after-windows-update-filebeat-service-stops-immediately/233331)
**Author:** [@udbv](https://discuss.elastic.co/u/udbv)\ **Replies:** 3\ **Last updated:** [June 18, 2020, 2:56pm UTC](https://discuss.elastic.co/t/after-windows-update-filebeat-service-stops-immediately/233331 "2020-06-18T14:56:19Z")
Hello Situation - After applying May updates on windows filebeat service is stopped after 1-second execution. There are no errors in logs and the same trouble with version 7.7. I couldn't find any useful info in system… --- ## [How to change inbuilt modules index name with the same fields?](https://discuss.elastic.co/t/how-to-change-inbuilt-modules-index-name-with-the-same-fields/237444)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 6\ **Last updated:** [June 18, 2020, 2:02pm UTC](https://discuss.elastic.co/t/how-to-change-inbuilt-modules-index-name-with-the-same-fields/237444 "2020-06-18T14:02:19Z")
I want to change default filebeat-\* index name to zeek-\* with the same fields as configured in the zeek.yml, Until now I have changed ''' hosts: \["localhost:9200"\] protocol: "http" index: "zeek-%{+yyyy.MM.dd}" setup… --- ## [Add nfsiostat to metricbeat](https://discuss.elastic.co/t/add-nfsiostat-to-metricbeat/235499)
**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 11:28am UTC](https://discuss.elastic.co/t/add-nfsiostat-to-metricbeat/235499 "2020-06-18T11:28:49Z")
Hi, I'm looking to get our nfsiostat information in metricbeat, but the documentation is bit overwhelming. I would like to use the diskio logic, but I'm not sure this is the right way to go, because: diskio is using h… --- ## [How can I split up my message log lines in separate tabs/fields?](https://discuss.elastic.co/t/how-can-i-split-up-my-message-log-lines-in-separate-tabs-fields/237531)
**Author:** [@Roger\_Payne](https://discuss.elastic.co/u/Roger_Payne)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 11:22am UTC](https://discuss.elastic.co/t/how-can-i-split-up-my-message-log-lines-in-separate-tabs-fields/237531 "2020-06-18T11:22:15Z")
Hello All, Yesterday, I set up ELK so I can send my routers syslogs to make it easier to view. I've completed this by installing a ubuntu server with rsyslogd, ELK and beats from a few online how to's. Next I sent the l… --- ## [DNS Logs: Packetbeat or Filebeat?](https://discuss.elastic.co/t/dns-logs-packetbeat-or-filebeat/237519)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 7:08am UTC](https://discuss.elastic.co/t/dns-logs-packetbeat-or-filebeat/237519 "2020-06-18T07:08:42Z")
I need to implement internal DNS logging and I'm trying to determine which is better filebeat or packetbeat. This is a Windows DNS server and the logs can be written to a local file which we can read with filebeat or we … --- ## [How to get kubernetes node label in elasticsearch - metricbeat?](https://discuss.elastic.co/t/how-to-get-kubernetes-node-label-in-elasticsearch-metricbeat/237553)
**Author:** [@abhishek\_acharya](https://discuss.elastic.co/u/abhishek_acharya)\ **Replies:** 0\ **Last updated:** [June 18, 2020, 3:01am UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-node-label-in-elasticsearch-metricbeat/237553 "2020-06-18T03:01:20Z")
Hi there, I have assigned a label to my node using kubectl command. now i want this metadata information in elasticsearch metricbeat field, but i am unable to get this! Also I have checked in my monitoring-template.yam… --- ## [Filebeat IIS Access logs not parsing but Error logs are](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-iis-access-logs-not-parsing-but-error-logs-are/237345 "2020-06-17T14:08:26Z")
I have enabled Filebeat module for IIS logging for IIS 7.5 but I'm not seeing the access logs parsed. The error logs are getting parsed just fine but the access log don't and give me an error.message of "Provided Grok ex… --- ## [What does socket.include\_localhost in auditbeat do?](https://discuss.elastic.co/t/what-does-socket-include-localhost-in-auditbeat-do/237432)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 12:41pm UTC](https://discuss.elastic.co/t/what-does-socket-include-localhost-in-auditbeat-do/237432 "2020-06-17T12:41:56Z")
Hello, I was deploying Auditbeat on several servers and noticed that our couchdb server was having some performance issues after deployment. It turned out that there were way too many localhost socket connections being t… --- ## [Metricbeat MongoDB SCRAM-SHA-256 authentication](https://discuss.elastic.co/t/metricbeat-mongodb-scram-sha-256-authentication/237471)
**Author:** [@drjackal](https://discuss.elastic.co/u/drjackal)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 12:20pm UTC](https://discuss.elastic.co/t/metricbeat-mongodb-scram-sha-256-authentication/237471 "2020-06-17T12:20:55Z")
I am looking into using the metricbeat mongodb module. Our MongoDB Enterprise deployment uses SCRAM-SHA-256 authentication and I have not been able to get metricbeat to use this authentication schema. Does anybody know i… --- ## [Customizing message field for Ecs logging method of java applications](https://discuss.elastic.co/t/customizing-message-field-for-ecs-logging-method-of-java-applications/237133)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 10:51am UTC](https://discuss.elastic.co/t/customizing-message-field-for-ecs-logging-method-of-java-applications/237133 "2020-06-17T10:51:41Z")
Hi Team, I am using the filebeat latest version 7.7.1 to ship the data of my java application from my logfile to elasticsearch ecs logging method. Data is available in elasticsearch and i am able to track down the logs… --- ## [Filebeat log collection stops when the container is restarted](https://discuss.elastic.co/t/filebeat-log-collection-stops-when-the-container-is-restarted/236596)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 10:11am UTC](https://discuss.elastic.co/t/filebeat-log-collection-stops-when-the-container-is-restarted/236596 "2020-06-17T10:11:18Z")
We collect the logs of the container of Tomcat on Kubernetes with the container of Filebeat. After restarting the Tomcat container, the log collection instance is updated, but the log collection instance is It seems th… --- ## [Office 365 Filebeat Module Error](https://discuss.elastic.co/t/office-365-filebeat-module-error/237158)
**Author:** [@khaag](https://discuss.elastic.co/u/khaag)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 8:44am UTC](https://discuss.elastic.co/t/office-365-filebeat-module-error/237158 "2020-06-17T08:44:40Z")
Hello We're trying to setup the office 365 module in filebeat. After editing the o365.yml file we are getting the following error: ERROR instance/beat.go:932 Exiting: Error while initializing input: o365audit: reading… --- ## [Metricbeat Not Outputting to Logstash](https://discuss.elastic.co/t/metricbeat-not-outputting-to-logstash/236412)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 8:44am UTC](https://discuss.elastic.co/t/metricbeat-not-outputting-to-logstash/236412 "2020-06-17T08:44:01Z")
I have Metricbeat installed on a new server and can't get it to output to Logstash. I can configure it to output directly to Elasticsearch. I even can get Filebeat running on the same server to output to Logstash but not… --- ## [Metricbeat elb and lambda metricset of aws module](https://discuss.elastic.co/t/metricbeat-elb-and-lambda-metricset-of-aws-module/237170)
**Author:** [@Rahul12](https://discuss.elastic.co/u/Rahul12)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 8:42am UTC](https://discuss.elastic.co/t/metricbeat-elb-and-lambda-metricset-of-aws-module/237170 "2020-06-17T08:42:11Z")
Hi, I am trying to fetch elb and lambda metricset of aws module but I am getting error - Error creating runner from config: 1 error: metricset 'aws/elb' not found I am using Metricbeat 7.1.1 version. Please see the b… --- ## [Visualize Average Response Time of the system using metricbeat data](https://discuss.elastic.co/t/visualize-average-response-time-of-the-system-using-metricbeat-data/236836)
**Author:** [@Mayank\_Damani](https://discuss.elastic.co/u/Mayank_Damani)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 8:35am UTC](https://discuss.elastic.co/t/visualize-average-response-time-of-the-system-using-metricbeat-data/236836 "2020-06-17T08:35:00Z")
Hello, I want to visualize Average Response Time of my System using MetricBeat data. I am just going through all the system fields in the metricbeat documentation but not getting any idea how to achieve my objective. Th… --- ## [Suport for wait stats/spin locks/latch waits](https://discuss.elastic.co/t/suport-for-wait-stats-spin-locks-latch-waits/237209)
**Author:** [@Brett\_Shearer](https://discuss.elastic.co/u/Brett_Shearer)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 8:33am UTC](https://discuss.elastic.co/t/suport-for-wait-stats-spin-locks-latch-waits/237209 "2020-06-17T08:33:37Z")
It seems that metric beat is currently playing catchup on more mature Microsoft SQL monitoring tools. Are you working on building out capabilities such as monitoring wait stats, or are you hoping for pull requests that … --- ## [How to Build a FileBeat "Cluster"](https://discuss.elastic.co/t/how-to-build-a-filebeat-cluster/237419)
**Author:** [@zchaistudy](https://discuss.elastic.co/u/zchaistudy)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 8:09am UTC](https://discuss.elastic.co/t/how-to-build-a-filebeat-cluster/237419 "2020-06-17T08:09:24Z")
I am planning to make a log storage system. At present, log information is reported to Kafka through http reporting (the logs are all in json format). I plan to read data from Kafka through Logstash or Filebeat and push … --- ## [\[Metricbeat\]\[Prometheus\] Metricbeat 7.7 rate not stored when use\_types and rate\_counters option is set to true](https://discuss.elastic.co/t/metricbeat-prometheus-metricbeat-7-7-rate-not-stored-when-use-types-and-rate-counters-option-is-set-to-true/236251)
**Author:** [@Jose\_Vargas](https://discuss.elastic.co/u/Jose_Vargas)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 7:49am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-metricbeat-7-7-rate-not-stored-when-use-types-and-rate-counters-option-is-set-to-true/236251 "2020-06-17T07:49:15Z")
Hi all, I am trying out the Metricbeat Prometheus collector module with the two new options in 7.7; use\_types and rate\_counters; https://www.elastic.co/guide/en/beats/metricbeat/7.7/metricbeat-metricset-prometheus-colle… --- ## [Set 2 shard and 1 replica for filebeat template](https://discuss.elastic.co/t/set-2-shard-and-1-replica-for-filebeat-template/237411)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 7:25am UTC](https://discuss.elastic.co/t/set-2-shard-and-1-replica-for-filebeat-template/237411 "2020-06-17T07:25:23Z")
Hi! By default when I use the filebeat installation in my kubernetes clusters it automatically creates a 1 shard and 1 replica template for me, is it possible to change that to use 2 shards and 1 replica in filebeat con… --- ## [Logstash is not reading the data from the filebeats](https://discuss.elastic.co/t/logstash-is-not-reading-the-data-from-the-filebeats/236636)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 4\ **Last updated:** [June 16, 2020, 6:52pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-the-data-from-the-filebeats/236636 "2020-06-16T18:52:17Z")
I am trying to load the data into logstash which is read by the file beat, but logstash is unable to read the data. Here are my filebeat debug data that are being generated while running it. 2020-06-11T13:01:41.607+053… --- ## [Metricbeat / php-fpm by fast-cgi protocol and multi pools](https://discuss.elastic.co/t/metricbeat-php-fpm-by-fast-cgi-protocol-and-multi-pools/237307)
**Author:** [@Claude\_Brassel](https://discuss.elastic.co/u/Claude_Brassel)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 5:39pm UTC](https://discuss.elastic.co/t/metricbeat-php-fpm-by-fast-cgi-protocol-and-multi-pools/237307 "2020-06-16T17:39:37Z")
Hi I have multiple php servers that host only the php-fpm process, is they're any way to get metric beat extracting metrics from the php-fpm status page accessing it only by fast-cgi protocol ? And by the way how does … --- ## [Journalbeat exits with success](https://discuss.elastic.co/t/journalbeat-exits-with-success/236988)
**Author:** [@chrissound](https://discuss.elastic.co/u/chrissound)\ **Replies:** 6\ **Last updated:** [June 16, 2020, 10:11am UTC](https://discuss.elastic.co/t/journalbeat-exits-with-success/236988 "2020-06-16T10:11:09Z")
\[root@XenonKiloCranberry:~\]# /nix/store/lfcgbj5s5iwd4fa6dcs2lmrkryy03a9s-journalbeat-6.8.3-bin/bin/journalbeat -c /nix/store/9g135rj3vz502l03iy08567nyl22iirm-journalbeat.yml -path.data /var/lib/journalbeat/data -path.log… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=237) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=239)