# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=251 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 252 --- ## [Filebeats can't connect to Logstash (servier misbehaving](https://discuss.elastic.co/t/filebeats-cant-connect-to-logstash-servier-misbehaving/231684)
**Author:** [@konart](https://discuss.elastic.co/u/konart)\ **Replies:** 1\ **Last updated:** [May 8, 2020, 9:21am UTC](https://discuss.elastic.co/t/filebeats-cant-connect-to-logstash-servier-misbehaving/231684 "2020-05-08T09:21:03Z")
Hi! I'm running Elastic stack in k8s and have no luck in pairing filebeat with logstash logstash config: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/logstash-core/lib/jars/postgr… --- ## [Azure storage metricset - elasticsearch receiving partial data](https://discuss.elastic.co/t/azure-storage-metricset-elasticsearch-receiving-partial-data/231498)
**Author:** [@Yotamloe](https://discuss.elastic.co/u/Yotamloe)\ **Replies:** 1\ **Last updated:** [May 8, 2020, 8:44am UTC](https://discuss.elastic.co/t/azure-storage-metricset-elasticsearch-receiving-partial-data/231498 "2020-05-08T08:44:56Z")
Hi i'm using metricbeat 7.6.2. I'm using Azure metricset to monitor all storage namespaces \[blob, file ,queue, table\]. This is my metricbeat Azure configuration: metricbeat.modules: - module: azure metricsets: - sto… --- ## [How to get the value of a key in the created field using add\_fields processor?](https://discuss.elastic.co/t/how-to-get-the-value-of-a-key-in-the-created-field-using-add-fields-processor/230718)
**Author:** [@musician](https://discuss.elastic.co/u/musician)\ **Replies:** 4\ **Last updated:** [May 8, 2020, 1:11am UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-a-key-in-the-created-field-using-add-fields-processor/230718 "2020-05-08T01:11:22Z")
Hello, I am using metricbeat 7.6.2 on Windows 2012. I have the following system.yml: - module: system period: 10s metricsets: - cpu - memory - process processes: \['^metricbeat.exe$'\] processors: … --- ## [Auditbeat failed to create audit client & failed to get audit status: operation not permitted](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417)
**Author:** [@Luis\_Pereira1](https://discuss.elastic.co/u/Luis_Pereira1)\ **Replies:** 4\ **Last updated:** [May 7, 2020, 11:07pm UTC](https://discuss.elastic.co/t/auditbeat-failed-to-create-audit-client-failed-to-get-audit-status-operation-not-permitted/231417 "2020-05-07T23:07:58Z")
Hello, I'm trying to get my Auditbeat running and I keep getting this error: Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted My Auditbeat config looks li… --- ## [Winlogbeat service unable to start - error 1053 - "service did not responded to start"](https://discuss.elastic.co/t/winlogbeat-service-unable-to-start-error-1053-service-did-not-responded-to-start/231629)
**Author:** [@derekmizak](https://discuss.elastic.co/u/derekmizak)\ **Replies:** 7\ **Last updated:** [May 7, 2020, 10:39pm UTC](https://discuss.elastic.co/t/winlogbeat-service-unable-to-start-error-1053-service-did-not-responded-to-start/231629 "2020-05-07T22:39:36Z")
Hi, I cant start winlogbeat - getting error 1053 - "service did not responded to start" When testing config and connection all is OK. I did set up the option to do not verify tls. No other errors found. I would appre… --- ## [Filebeat S3 issue](https://discuss.elastic.co/t/filebeat-s3-issue/230441)
**Author:** [@cbeprem](https://discuss.elastic.co/u/cbeprem)\ **Replies:** 4\ **Last updated:** [May 7, 2020, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-s3-issue/230441 "2020-05-07T21:53:49Z")
Hi team , I am trying to ingest logs from S3 using filebeat and SQS. It works fine when the format is logss/source/year2020/month04/day10/hour08/2020-04-10.log but the original format for some logs is as below and … --- ## [System diskio module is not capturing all expected fields](https://discuss.elastic.co/t/system-diskio-module-is-not-capturing-all-expected-fields/231596)
**Author:** [@cbril](https://discuss.elastic.co/u/cbril)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 7:32pm UTC](https://discuss.elastic.co/t/system-diskio-module-is-not-capturing-all-expected-fields/231596 "2020-05-07T19:32:50Z")
I am running metricbeat 7.6.2 on Windows server 2012. I am trying to capture these disk I/O fields with the system module: system.diskio.iostat.busy system.diskio.iostat.queue.avg\_size It appears that only these fiel… --- ## [Journalbeat and Filebeat store the same messages, how should that be handled?](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 7:15pm UTC](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436 "2020-05-07T19:15:10Z")
Journald and syslog can contain the exact same data at times. For example, running ansible generates lots of "echo BECOME-SUCCESS-\< random string \>" messages. I can find the exact same messages in both my journalbeat-\* … --- ## [Can I run Auditbeat as a non-root user?](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 3:22pm UTC](https://discuss.elastic.co/t/can-i-run-auditbeat-as-a-non-root-user/230380 "2020-05-07T15:22:28Z")
Hi I'm setting up the Beats. For each one I followed the following process: Created and user called elastic in the host Created a systemd unit file like this: \[Unit\] Description=Auditbeat After=syslog.target ne… --- ## [Auditbeat and dynamic variables - is it real?](https://discuss.elastic.co/t/auditbeat-and-dynamic-variables-is-it-real/229317)
**Author:** [@eee71](https://discuss.elastic.co/u/eee71)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 3:06pm UTC](https://discuss.elastic.co/t/auditbeat-and-dynamic-variables-is-it-real/229317 "2020-05-07T15:06:07Z")
Hello, can i use dynamic variables with auditbeat? When i am typing any command (auditd module) i have to check one variable to prepare right audit event + add this variable to event. For all executing commands. I lost … --- ## [Auditbeat file integrity doesn't scans shares](https://discuss.elastic.co/t/auditbeat-file-integrity-doesnt-scans-shares/229444)
**Author:** [@ormaman](https://discuss.elastic.co/u/ormaman)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 3:00pm UTC](https://discuss.elastic.co/t/auditbeat-file-integrity-doesnt-scans-shares/229444 "2020-05-07T15:00:07Z")
auditbeat file integrity doesn't scans shares nor mount points I tried to mount windows share to a windows machine with a auditbeat on it mapped to Z: The auditbeat does not recognizing changes there moreover i tried … --- ## [Private IP GeoIP](https://discuss.elastic.co/t/private-ip-geoip/225927)
**Author:** [@dshepard](https://discuss.elastic.co/u/dshepard)\ **Replies:** 4\ **Last updated:** [May 7, 2020, 2:12pm UTC](https://discuss.elastic.co/t/private-ip-geoip/225927 "2020-05-07T14:12:06Z")
Does anyone have a working config for assigning GeoIP data to private subnets wtih winlogbeat? --- ## [Filebeat write errors](https://discuss.elastic.co/t/filebeat-write-errors/230257)
**Author:** [@Marcus\_Simonsen](https://discuss.elastic.co/u/Marcus_Simonsen)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-write-errors/230257 "2020-05-07T13:01:01Z")
In terms of filebeat monitoring: What is the difference between libbeat.output VS libbeat.pipeline? Is a non-zero libbeat.output.failed a cause for concern? Are we losing data? We are using Filebeat 7.4.1 in producti… --- ## [Start with custom logs](https://discuss.elastic.co/t/start-with-custom-logs/228804)
**Author:** [@\_mslo](https://discuss.elastic.co/u/_mslo)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 11:54am UTC](https://discuss.elastic.co/t/start-with-custom-logs/228804 "2020-05-07T11:54:48Z")
Hi All, I'm starting with custom logs. Currently I put logs without any additional processing of log lines. My first problem is that I want search for "ERROR" but my logs look like: timestamp ERROR example message tim… --- ## [Configuring Metricbeat Oracle Module](https://discuss.elastic.co/t/configuring-metricbeat-oracle-module/231198)
**Author:** [@rakesh15](https://discuss.elastic.co/u/rakesh15)\ **Replies:** 6\ **Last updated:** [May 7, 2020, 11:48am UTC](https://discuss.elastic.co/t/configuring-metricbeat-oracle-module/231198 "2020-05-07T11:48:55Z")
Hi, I'm trying to configure Metricbeat Oracle Module on my system but getting logon denied error upon starting Metricbeat. Error Message: 2020-05-05T16:45:30.988Z INFO module/wrapper.go:259 Error fetching … --- ## [Custom Metric Beat Packaging Issue](https://discuss.elastic.co/t/custom-metric-beat-packaging-issue/231348)
**Author:** [@nabeel\_ahmed](https://discuss.elastic.co/u/nabeel_ahmed)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 10:08am UTC](https://discuss.elastic.co/t/custom-metric-beat-packaging-issue/231348 "2020-05-07T10:08:53Z")
Hello, I created a new beat based on metricbeat. I have followed the instructions and able to build and debug beat successfully . All works as expected. When i try to package the beat using "make release", the generat… --- ## [Metricbeat vs k8s Clusterwide Stats Collection by a ServiceAccount](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 9:14am UTC](https://discuss.elastic.co/t/metricbeat-vs-k8s-clusterwide-stats-collection-by-a-serviceaccount/231309 "2020-05-07T09:14:49Z")
Attempting to grasp how to collect various stats from a k8s cluster as a newbie k8s admin... Got a Linux host running a k8s cluster with a metricbeat running collecting various modules.d/system.yml datasets, would like … --- ## [Filebat -\> Logstash parsing](https://discuss.elastic.co/t/filebat-logstash-parsing/231457)
**Author:** [@ClubG](https://discuss.elastic.co/u/ClubG)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 9:12am UTC](https://discuss.elastic.co/t/filebat-logstash-parsing/231457 "2020-05-07T09:12:31Z")
Hi, I'm using this ELK stack: It all works perfectly with default dashboards if I send logs from filebeat and metricbeat directly to elastic. filebeat -\> elastic -\> kibana metricbeat -\> elastic -\> kibana now I wa… --- ## [Metricbeat-Kubernetes](https://discuss.elastic.co/t/metricbeat-kubernetes/230807)
**Author:** [@Aanand\_Kumar](https://discuss.elastic.co/u/Aanand_Kumar)\ **Replies:** 1\ **Last updated:** [May 7, 2020, 8:21am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes/230807 "2020-05-07T08:21:16Z")
Hi All Kindly help me to fetch kubernetes cluster info with Metricbeat, kindly share the correct configuration YAML for /etc/Metricbeat/modules.d/kubernetes.yml. Thank --- ## [How to collect metrics of windows processes using metricbeat](https://discuss.elastic.co/t/how-to-collect-metrics-of-windows-processes-using-metricbeat/231359)
**Author:** [@aman97](https://discuss.elastic.co/u/aman97)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 8:08am UTC](https://discuss.elastic.co/t/how-to-collect-metrics-of-windows-processes-using-metricbeat/231359 "2020-05-07T08:08:37Z")
Hi Everyone, I am working on metricbeat but seems it didn't collect metrics of windows processes Kindly provide the solution. --- ## [Is there a way to read extra config during ingest of logs?](https://discuss.elastic.co/t/is-there-a-way-to-read-extra-config-during-ingest-of-logs/231209)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 7:35am UTC](https://discuss.elastic.co/t/is-there-a-way-to-read-extra-config-during-ingest-of-logs/231209 "2020-05-07T07:35:30Z")
So I was wondering if there's a way that when you read a log file, that somehow there's an extra config in that "folder" that could potentially tell filebeat how to ingest the files? Currently the config is global in fi… --- ## [\[Kubernetes Autodiscover 7.6.2\] Error creating runner from config: No paths were defined for input accessing config](https://discuss.elastic.co/t/kubernetes-autodiscover-7-6-2-error-creating-runner-from-config-no-paths-were-defined-for-input-accessing-config/229829)
**Author:** [@scriptdb](https://discuss.elastic.co/u/scriptdb)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 7:18am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-7-6-2-error-creating-runner-from-config-no-paths-were-defined-for-input-accessing-config/229829 "2020-05-07T07:18:43Z")
Hello, I'm running filebeat 7.6.2 on AKS with the following configuration: filebeatConfig: filebeat.yml: | filebeat.autodiscover: providers: - type: kubernetes hints.enabled: false … --- ## [Question abaut privelege for filebeat write role](https://discuss.elastic.co/t/question-abaut-privelege-for-filebeat-write-role/231173)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 6:23am UTC](https://discuss.elastic.co/t/question-abaut-privelege-for-filebeat-write-role/231173 "2020-05-07T06:23:41Z")
Hi, I do not understand documentation fragment https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html about privilege for filebeat write role Cluster cluster:admin/ingest/pipeline/get Check for … --- ## [AIX and Solaris Beat Agent](https://discuss.elastic.co/t/aix-and-solaris-beat-agent/228035)
**Author:** [@darkwingzero](https://discuss.elastic.co/u/darkwingzero)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 5:57am UTC](https://discuss.elastic.co/t/aix-and-solaris-beat-agent/228035 "2020-05-07T05:57:26Z")
Hi Elastic Partners, What are the option to crawl and ship logs from AIX and solaris Os to logstash? Thank you! --- ## [Filebeat Multiline Start End pattern](https://discuss.elastic.co/t/filebeat-multiline-start-end-pattern/229442)
**Author:** [@kishore419](https://discuss.elastic.co/u/kishore419)\ **Replies:** 3\ **Last updated:** [May 7, 2020, 2:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-start-end-pattern/229442 "2020-05-07T02:53:08Z")
Hello Team, I have to parse following log content using filebeat-multiline feature. Log file: Start value1 End completed other data Start Value1 End completed i want to capture the multline start with 'Start value… --- ## [Help with heartbeat setup of locations](https://discuss.elastic.co/t/help-with-heartbeat-setup-of-locations/227555)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 8\ **Last updated:** [May 6, 2020, 11:01pm UTC](https://discuss.elastic.co/t/help-with-heartbeat-setup-of-locations/227555 "2020-05-06T23:01:02Z")
I have about 30 sites I would like to ping with heartbeat. I'm confused about how best to add the geo location and other info for each site. Do I add each site to its own yaml file or is there a simple way to do it all… --- ## [Filebeat v7.6.2 didn't send log to output](https://discuss.elastic.co/t/filebeat-v7-6-2-didnt-send-log-to-output/231406)
**Author:** [@lishiji56](https://discuss.elastic.co/u/lishiji56)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 8:49pm UTC](https://discuss.elastic.co/t/filebeat-v7-6-2-didnt-send-log-to-output/231406 "2020-05-06T20:49:05Z")
Filebeat can't send any log to logstash. No error can be found from the debug mode. Any one knows what is the issue? Here is the filebeat.yml configuration: filebeat.inputs: type: log tags: \["test1"\] document\_type:… --- ## [Redis Module: Redis Cluster in Metricbeat](https://discuss.elastic.co/t/redis-module-redis-cluster-in-metricbeat/228836)
**Author:** [@Md\_Saidur\_Rahman](https://discuss.elastic.co/u/Md_Saidur_Rahman)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 8:32pm UTC](https://discuss.elastic.co/t/redis-module-redis-cluster-in-metricbeat/228836 "2020-05-06T20:32:58Z")
How to add Redis cluster for monitoring in the host section of /etc/metricbeat/modules.d/redis.yml file? Please be informed that I'm using single-node Redis cluster in different ports. --- ## [MySQL module: Configuration](https://discuss.elastic.co/t/mysql-module-configuration/229299)
**Author:** [@Md\_Saidur\_Rahman](https://discuss.elastic.co/u/Md_Saidur_Rahman)\ **Replies:** 22\ **Last updated:** [May 6, 2020, 8:31pm UTC](https://discuss.elastic.co/t/mysql-module-configuration/229299 "2020-05-06T20:31:39Z")
I've configured mysql moduld for MariaDB but didn't get any log in kibana dashboard. Configuration and Dashboards attached bellow: MySQL module configuration: module: mysql #metricsets: status galera\_status period:… --- ## [Problems with custom beat plugin](https://discuss.elastic.co/t/problems-with-custom-beat-plugin/231389)
**Author:** [@Cody\_Swanson](https://discuss.elastic.co/u/Cody_Swanson)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 6:23pm UTC](https://discuss.elastic.co/t/problems-with-custom-beat-plugin/231389 "2020-05-06T18:23:49Z")
Hello! I'm trying to build a custom output plugin for beats to connect to AWS Kinesis based on https://github.com/s12v/awsbeats. With this plugin, I'm trying to use go modules via a new go.mod file in the root of the p… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=250) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=252)