# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=252 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 253 --- ## [Cant start Filebeat after installing newer version](https://discuss.elastic.co/t/cant-start-filebeat-after-installing-newer-version/231374)
**Author:** [@Deny7](https://discuss.elastic.co/u/Deny7)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 3:36pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-after-installing-newer-version/231374 "2020-05-06T15:36:50Z")
OS: Centos 7 Hi, I just uninstalled Filebeat 6.6.2 and installed newest version 7.6.2 - filebeat-oss-7.6.2-i686.rpm. Starting service gives me error which will log only to /etc/log/messages not to /etc/log/filebeat - th… --- ## [Not sending to index with brew](https://discuss.elastic.co/t/not-sending-to-index-with-brew/231253)
**Author:** [@MikeHarness](https://discuss.elastic.co/u/MikeHarness)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 4:22am UTC](https://discuss.elastic.co/t/not-sending-to-index-with-brew/231253 "2020-05-06T04:22:57Z")
Solved, I think. I removed via Brew, and re-installed. Seems to be working now. I'm using brew to run Packetbeat as a service. If I do this, nothing gets added to the ES index. If I interactively run it (sudo packetbea… --- ## [Metricbeat 7.6 backward compatibility](https://discuss.elastic.co/t/metricbeat-7-6-backward-compatibility/230971)
**Author:** [@Rohan\_Tiwarri](https://discuss.elastic.co/u/Rohan_Tiwarri)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 3:28pm UTC](https://discuss.elastic.co/t/metricbeat-7-6-backward-compatibility/230971 "2020-05-06T15:28:23Z")
Is metricbeat 7.6 backward compatible with Elasticsearch/Kibana 6.8? --- ## [Collect Metric of specific process using metricbeat](https://discuss.elastic.co/t/collect-metric-of-specific-process-using-metricbeat/231335)
**Author:** [@aman97](https://discuss.elastic.co/u/aman97)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 12:08pm UTC](https://discuss.elastic.co/t/collect-metric-of-specific-process-using-metricbeat/231335 "2020-05-06T12:08:46Z")
Hello Everyone, I am using metricbeat to collect system metrics. Now, I want to capture data of only specific process, csrss.exe how can I achieve this I have tried some ways but it's not working for me module: sys… --- ## [How to wirte pipiline.yaml file for filebeat nginx module for access log?](https://discuss.elastic.co/t/how-to-wirte-pipiline-yaml-file-for-filebeat-nginx-module-for-access-log/231326)
**Author:** [@Shreeram\_Silwal](https://discuss.elastic.co/u/Shreeram_Silwal)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 11:00am UTC](https://discuss.elastic.co/t/how-to-wirte-pipiline-yaml-file-for-filebeat-nginx-module-for-access-log/231326 "2020-05-06T11:00:48Z")
i have a custom log format and generated a grok pattern for that which looks like: 120.89.102.147 - - \[05/May/2020:06:35:58 +0000\] "GET /api/licensing/info HTTP/1.1" 200 343 "https://kibana-qa.unation.com/app/kibana" … --- ## [Doubts about IIS and SQL Server metrics](https://discuss.elastic.co/t/doubts-about-iis-and-sql-server-metrics/231320)
**Author:** [@ruben.crespo.cano](https://discuss.elastic.co/u/ruben.crespo.cano)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 10:43am UTC](https://discuss.elastic.co/t/doubts-about-iis-and-sql-server-metrics/231320 "2020-05-06T10:43:44Z")
To whom it may concern. I will like to solve several questions related about the granularity and the capacity of getting metrics from the Microsoft stack, that is, MSSQL Server & Internet Information Services (IIS). Aft… --- ## [Filebeat setup issue: Ping request failed in https only environment](https://discuss.elastic.co/t/filebeat-setup-issue-ping-request-failed-in-https-only-environment/229651)
**Author:** [@SamuelBramm](https://discuss.elastic.co/u/SamuelBramm)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 10:33am UTC](https://discuss.elastic.co/t/filebeat-setup-issue-ping-request-failed-in-https-only-environment/229651 "2020-05-06T10:33:59Z")
Hi, I think I have stumbled upon a bug/feature when setting up filebeat or any other beat in my environment. I initially opened this as an issue at the github beats repository but was told that this was the right place … --- ## [Filebeat read new file daily](https://discuss.elastic.co/t/filebeat-read-new-file-daily/231288)
**Author:** [@lioaslan](https://discuss.elastic.co/u/lioaslan)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 8:08am UTC](https://discuss.elastic.co/t/filebeat-read-new-file-daily/231288 "2020-05-06T08:08:10Z")
Hi, I'm new to ELK Stack. I have a task build a analysis log, input is .log file. I try to read the guide but I can't find out how to make Filebeat read file everyday. My file will be remove and create again at 0 am. T… --- ## [Filebeat Inconsistent Log Shipping](https://discuss.elastic.co/t/filebeat-inconsistent-log-shipping/231231)
**Author:** [@Dominic\_Evert](https://discuss.elastic.co/u/Dominic_Evert)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 8:01am UTC](https://discuss.elastic.co/t/filebeat-inconsistent-log-shipping/231231 "2020-05-06T08:01:02Z")
After a cluster crash, my ingest rates have been inconsistent from a filebeat to kafka to logstash data flow. Restarting filebeat seems to return it to a normal rate of log ingest for about 40 minutes, then it proceeds t… --- ## [Filebeat is not sending the entries that it missed when having issue with ulimit](https://discuss.elastic.co/t/filebeat-is-not-sending-the-entries-that-it-missed-when-having-issue-with-ulimit/231056)
**Author:** [@Shambu\_Pujar](https://discuss.elastic.co/u/Shambu_Pujar)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 7:52am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-entries-that-it-missed-when-having-issue-with-ulimit/231056 "2020-05-06T07:52:36Z")
Filebeat had issue with low open limits which was defaulted to 1024. It his this issue probably due to issue with elasticsearch having problem and connection wasn't established After fixing the ulimit 'ulimit -n 65536' … --- ## [Journabeat (7.6) processors is ignored \[Solved\]](https://discuss.elastic.co/t/journabeat-7-6-processors-is-ignored-solved/231140)
**Author:** [@LaraSlim](https://discuss.elastic.co/u/LaraSlim)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 7:35am UTC](https://discuss.elastic.co/t/journabeat-7-6-processors-is-ignored-solved/231140 "2020-05-06T07:35:51Z")
Journalbeat installation on Linux with default configuration. Output is configured to external Logstash. Everything works fine except drop\_event processors. Changes applied to journalbeat.yml: #=======================… --- ## [How can I setup file offset state with filebeat source code?](https://discuss.elastic.co/t/how-can-i-setup-file-offset-state-with-filebeat-source-code/231084)
**Author:** [@thangld](https://discuss.elastic.co/u/thangld)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-can-i-setup-file-offset-state-with-filebeat-source-code/231084 "2020-05-06T02:22:00Z")
I'm trying to import filebeat source code to read text from file. I understand that filebeat saves offset to filesystem so when it restarts, it won't read text from beginning of the file. How can I implement this functio… --- ## [Unable to build custom beat without github](https://discuss.elastic.co/t/unable-to-build-custom-beat-without-github/231221)
**Author:** [@visasimbu](https://discuss.elastic.co/u/visasimbu)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-build-custom-beat-without-github/231221 "2020-05-05T21:03:07Z")
Step 1: I have cloned beat (https://github.com/elastic/beats) and added my custom logic. My custom logic has update in the given file (src\\github.com\\somegithub\\iibbeat\\beater\\iibbeat.go) and I have added new folder(mqsi… --- ## [Receiving unwanted information from system module](https://discuss.elastic.co/t/receiving-unwanted-information-from-system-module/231168)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 2:03pm UTC](https://discuss.elastic.co/t/receiving-unwanted-information-from-system-module/231168 "2020-05-05T14:03:38Z")
Hello I'm currently using Metricbeat to retrieve system information on my server, here's a sample of my metricbeat.yml : #-------------------------------- System Module -------------------------------- - module: system… --- ## [Kafka module error](https://discuss.elastic.co/t/kafka-module-error/230956)
**Author:** [@Leo-ljr](https://discuss.elastic.co/u/Leo-ljr)\ **Replies:** 12\ **Last updated:** [May 5, 2020, 11:52am UTC](https://discuss.elastic.co/t/kafka-module-error/230956 "2020-05-05T11:52:32Z")
Hi all, I try to use the producer, consumer and broker metricset for Kafka. But when I use one of them I have this error: 2020-05-04T11:06:25.118Z INFO instance/beat.go:445 metricbeat stopped. 2020-05-04T11:06:25.118Z … --- ## [Multiline settings for external config files](https://discuss.elastic.co/t/multiline-settings-for-external-config-files/231018)
**Author:** [@moderable](https://discuss.elastic.co/u/moderable)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 1:03pm UTC](https://discuss.elastic.co/t/multiline-settings-for-external-config-files/231018 "2020-05-05T13:03:17Z")
Hi, My multiline config in filebeat.yml works fine but recently I broke the file into two, one file contains some static paths (the regular filebeat.yml) and one contains some dynamic paths that are updated at a set int… --- ## [Filebeat haproxy module timezone issues](https://discuss.elastic.co/t/filebeat-haproxy-module-timezone-issues/231150)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-timezone-issues/231150 "2020-05-05T12:40:46Z")
Hello, Is there still a timezone bug with the haproxy Filebeat module? I have the same issue as https://discuss.elastic.co/t/filebeat-haproxy-module-timezone-issue/220144 - module: haproxy log: enabled: true … --- ## [Module with custom input?](https://discuss.elastic.co/t/module-with-custom-input/231097)
**Author:** [@hazcod](https://discuss.elastic.co/u/hazcod)\ **Replies:** 4\ **Last updated:** [May 5, 2020, 11:43am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097 "2020-05-05T11:43:03Z")
Hi, Is there a method to use module parsing with your own custom input declaration? e.g. - module: checkpoint access: input: - type: syslog protocol.tcp: host: "0.0.0.0:8001" tls: certificate: foo key: bar --- ## [Filebeat used for k8s autodiscovery and file logs sending duplicated events](https://discuss.elastic.co/t/filebeat-used-for-k8s-autodiscovery-and-file-logs-sending-duplicated-events/230706)
**Author:** [@Chexpir](https://discuss.elastic.co/u/Chexpir)\ **Replies:** 3\ **Last updated:** [May 5, 2020, 11:24am UTC](https://discuss.elastic.co/t/filebeat-used-for-k8s-autodiscovery-and-file-logs-sending-duplicated-events/230706 "2020-05-05T11:24:55Z")
Hi! I can see "duplicated events" is a very common issue, but I cannot find the solution for the problem I have, that looks like a very generic one IMHO. I am using filebeat in a kubernetes cluster (taking care of kube… --- ## [GenerateCustomBeat returns error for missing github.com/elastic/beats/v7](https://discuss.elastic.co/t/generatecustombeat-returns-error-for-missing-github-com-elastic-beats-v7/223785)
**Author:** [@andrew-expanse](https://discuss.elastic.co/u/andrew-expanse)\ **Replies:** 19\ **Last updated:** [May 5, 2020, 10:19am UTC](https://discuss.elastic.co/t/generatecustombeat-returns-error-for-missing-github-com-elastic-beats-v7/223785 "2020-05-05T10:19:23Z")
Hi all, I'm attempting to create a new custom beat but am hitting some errors when using the mage GenerateCustomBeat command. mage GenerateCustomBeat Enter the beat name \[examplebeat\]: testbeat Enter your github name \[… --- ## [\[metricset prometheus collector\] Multiple match query](https://discuss.elastic.co/t/metricset-prometheus-collector-multiple-match-query/230804)
**Author:** [@Roy\_Zhang](https://discuss.elastic.co/u/Roy_Zhang)\ **Replies:** 4\ **Last updated:** [May 5, 2020, 8:42am UTC](https://discuss.elastic.co/t/metricset-prometheus-collector-multiple-match-query/230804 "2020-05-05T08:42:17Z")
Dear Metricbeat experts, I am using metricset prometheus collector and using the following query to scrape data from prometheus. And I found only the last query ('match\[\]': '{job="jobC"}') take effect. Can I use multip… --- ## [Kibana only shows log on filebeat or logstash restart](https://discuss.elastic.co/t/kibana-only-shows-log-on-filebeat-or-logstash-restart/229993)
**Author:** [@gia.g](https://discuss.elastic.co/u/gia.g)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 7:19am UTC](https://discuss.elastic.co/t/kibana-only-shows-log-on-filebeat-or-logstash-restart/229993 "2020-05-05T07:19:38Z")
Goodmorning, i tried to search for this type of problem for few days but i didn't find anything. The infrastructure is like this :slight\_smile: 1 server with Wazuh-manager and Filebeat installed 1 server with Logstas… --- ## [Control volume of data sent via filebeat](https://discuss.elastic.co/t/control-volume-of-data-sent-via-filebeat/231078)
**Author:** [@gajanan8086](https://discuss.elastic.co/u/gajanan8086)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 5:50am UTC](https://discuss.elastic.co/t/control-volume-of-data-sent-via-filebeat/231078 "2020-05-05T05:50:57Z")
Is there a way to control volume of data sent via filebeat? There could be a scenario where a process can spin out of control and generate huge logs/ exceptions. We do not want to send this redundant huge data to elastic… --- ## [Metricbeat does not start service](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059)
**Author:** [@ElAouane](https://discuss.elastic.co/u/ElAouane)\ **Replies:** 18\ **Last updated:** [May 5, 2020, 2:41am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059 "2020-05-05T02:41:33Z")
Hi guys I've been trying to implement kibana in my aws. i have 4 instances in total elasticsearch 2.logstash kibana,filebeat and metricbeat app instance (nginx) i would like, from kibana, be able to display meatricb… --- ## [FreeBSD and filebeat modules?](https://discuss.elastic.co/t/freebsd-and-filebeat-modules/231009)
**Author:** [@Dunuin](https://discuss.elastic.co/u/Dunuin)\ **Replies:** 1\ **Last updated:** [May 4, 2020, 9:54pm UTC](https://discuss.elastic.co/t/freebsd-and-filebeat-modules/231009 "2020-05-04T21:54:03Z")
Hi, I'm using FreeBSD 11.3 (FreeNAS) and installed beats using it's pkg repository. Collecting and sending logs I manually added inputs for works fine, but I don't get the modules to run. I can only find in the documen… --- ## [Metricbeat AWS Module](https://discuss.elastic.co/t/metricbeat-aws-module/229715)
**Author:** [@leogoldim](https://discuss.elastic.co/u/leogoldim)\ **Replies:** 11\ **Last updated:** [May 4, 2020, 6:30pm UTC](https://discuss.elastic.co/t/metricbeat-aws-module/229715 "2020-05-04T18:30:18Z")
Hi everybody, I'm trying to test the Metricbeat with AWS module, but my CloudWatch metrics aren't sent to the ELK stack. Following are my AWS module config: metricbeat.modules: - module: aws period: 12h #credential… --- ## [Connecting filebeat with elasticseach](https://discuss.elastic.co/t/connecting-filebeat-with-elasticseach/226832)
**Author:** [@Daud\_Ahmed](https://discuss.elastic.co/u/Daud_Ahmed)\ **Replies:** 10\ **Last updated:** [May 4, 2020, 5:19pm UTC](https://discuss.elastic.co/t/connecting-filebeat-with-elasticseach/226832 "2020-05-04T17:19:12Z")
I have like 5 elastic nodes in total. One node ingest and coordinating node while two are dedicated master nodes and the other two are dedicated data nodes. I have elasticsearch install on all my five nodes with respect… --- ## [Add new additional field from IIS log](https://discuss.elastic.co/t/add-new-additional-field-from-iis-log/230859)
**Author:** [@coopx](https://discuss.elastic.co/u/coopx)\ **Replies:** 2\ **Last updated:** [May 4, 2020, 12:25pm UTC](https://discuss.elastic.co/t/add-new-additional-field-from-iis-log/230859 "2020-05-04T12:25:31Z")
Hi, I am hoping someone can help me out, I am new to elastic and am testing the Elastic.co hosted service. I have an IIS log that has an additional field at the end, which is an IP address (in bold). 2020-03-31 09:32:… --- ## [Metricbeat: directory size decreases](https://discuss.elastic.co/t/metricbeat-directory-size-decreases/230966)
**Author:** [@Kawther](https://discuss.elastic.co/u/Kawther)\ **Replies:** 0\ **Last updated:** [May 4, 2020, 12:21pm UTC](https://discuss.elastic.co/t/metricbeat-directory-size-decreases/230966 "2020-05-04T12:21:41Z")
Hello, I created graph for disk usage variation: Y-axis : average of system.filesystem.used.bytes X-axis: Date Histogram Split series: system.filesystem.mount\_point I have a test during an hour, after test the size… --- ## [Starting filebeat from java code - filebeat service exit when the java service is closed](https://discuss.elastic.co/t/starting-filebeat-from-java-code-filebeat-service-exit-when-the-java-service-is-closed/230965)
**Author:** [@blumre](https://discuss.elastic.co/u/blumre)\ **Replies:** 0\ **Last updated:** [May 4, 2020, 12:15pm UTC](https://discuss.elastic.co/t/starting-filebeat-from-java-code-filebeat-service-exit-when-the-java-service-is-closed/230965 "2020-05-04T12:15:58Z")
Hi, I'm trying to start filebeat from java code using: Runtime.getRuntime().exec("service filebeat start") The filebeat start successfully but when I kill the java process it also exit I tried: nohup sudo service fi… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=251) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=253)