# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=258 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 259 --- ## [About Mac system cannot be cross-compiled into windows](https://discuss.elastic.co/t/about-mac-system-cannot-be-cross-compiled-into-windows/227458)
**Author:** [@aixic](https://discuss.elastic.co/u/aixic)\ **Replies:** 2\ **Last updated:** [April 17, 2020, 12:13pm UTC](https://discuss.elastic.co/t/about-mac-system-cannot-be-cross-compiled-into-windows/227458 "2020-04-17T12:13:57Z")
hello， When I use the mac system to compile, pcap is undefined. Is there any way to solve it? --- ## [Custom field not appearing in o/p for IIS.yml module](https://discuss.elastic.co/t/custom-field-not-appearing-in-o-p-for-iis-yml-module/227663)
**Author:** [@imti283](https://discuss.elastic.co/u/imti283)\ **Replies:** 3\ **Last updated:** [April 17, 2020, 11:38am UTC](https://discuss.elastic.co/t/custom-field-not-appearing-in-o-p-for-iis-yml-module/227663 "2020-04-17T11:38:30Z")
Hi, I am using IIS module in filebeat to ship logs to my logstash. As, I have multiple environment and sites, i am trying to add custom field in iis.yml module to make my logstash work easy and create index based on env… --- ## [Configure AWS Log Group Subscriptions without Triggers in Functionbeat.yml file](https://discuss.elastic.co/t/configure-aws-log-group-subscriptions-without-triggers-in-functionbeat-yml-file/228169)
**Author:** [@PhilipMortiboy](https://discuss.elastic.co/u/PhilipMortiboy)\ **Replies:** 3\ **Last updated:** [April 17, 2020, 11:42am UTC](https://discuss.elastic.co/t/configure-aws-log-group-subscriptions-without-triggers-in-functionbeat-yml-file/228169 "2020-04-17T11:42:39Z")
We're attempting to configure a Functionbeat that subscribes to multiple CloudWatch Log Groups across our stacks. These stacks are created dynamically through independent CI/CD pipelines, so we'd like the responsibility … --- ## [Functionbeat - deployment to multiple environments](https://discuss.elastic.co/t/functionbeat-deployment-to-multiple-environments/228476)
**Author:** [@Vaidotas](https://discuss.elastic.co/u/Vaidotas)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 8:35am UTC](https://discuss.elastic.co/t/functionbeat-deployment-to-multiple-environments/228476 "2020-04-17T08:35:26Z")
I couldn't find this in documentation, so was hoping someone will be able to clarify. What is expected flow of deployment of Functionbeat to multiple environments? Specific problem scenario I want to deploy it to mult… --- ## [Winlogbeat loses some events from Microsoft-IIS-Logging/Logs](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513)
**Author:** [@Ret](https://discuss.elastic.co/u/Ret)\ **Replies:** 1\ **Last updated:** [April 17, 2020, 7:10am UTC](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513 "2020-04-17T07:10:27Z")
Hi all, Issue: winlogbeat loses windows events from Microsoft-IIS-Logging/Logs Scenario: I collect the logs of the IIS in Windows Events. Then I send them to the elasticsearch with winlogbetat. But for some reason, wi… --- ## [Index creation time missing in \`index\` metricset](https://discuss.elastic.co/t/index-creation-time-missing-in-index-metricset/228139)
**Author:** [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Replies:** 3\ **Last updated:** [April 17, 2020, 6:40am UTC](https://discuss.elastic.co/t/index-creation-time-missing-in-index-metricset/228139 "2020-04-17T06:40:43Z")
Hi, I'm trying to build a dashboard to gather all the metrics of my Elastic Stack environment using metricbeat data. Using the index metricset in metribeat I've seen that there are missing information as index\_creation… --- ## [Provide Back EC2 Tags as metadata](https://discuss.elastic.co/t/provide-back-ec2-tags-as-metadata/228386)
**Author:** [@sheldonh](https://discuss.elastic.co/u/sheldonh)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 5:39pm UTC](https://discuss.elastic.co/t/provide-back-ec2-tags-as-metadata/228386 "2020-04-16T17:39:58Z")
I'm used to telegraf and influxdb structure, so perhaps this is a beginner issue. I found a related issue: https://discuss.elastic.co/t/filebeat-and-ec2-tags/98737 However, I didn't see any solution. I currently modifi… --- ## [Filebeat compatibility issue for Oracle Enterprise Linux environment (OEL)](https://discuss.elastic.co/t/filebeat-compatibility-issue-for-oracle-enterprise-linux-environment-oel/228358)
**Author:** [@rkcharlie](https://discuss.elastic.co/u/rkcharlie)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 3:41pm UTC](https://discuss.elastic.co/t/filebeat-compatibility-issue-for-oracle-enterprise-linux-environment-oel/228358 "2020-04-16T15:41:33Z")
Hello Team, We have configured Filebeat in Oracle Enterprise Linux environment. As per Elastic support matrix, OEL doesn't support beats. We have noticed that, OEL environment Filebeat output is not matching with Windo… --- ## [Decode json data from Kubernetes Pods](https://discuss.elastic.co/t/decode-json-data-from-kubernetes-pods/228297)
**Author:** [@malcolm666](https://discuss.elastic.co/u/malcolm666)\ **Replies:** 1\ **Last updated:** [April 16, 2020, 1:17pm UTC](https://discuss.elastic.co/t/decode-json-data-from-kubernetes-pods/228297 "2020-04-16T13:17:51Z")
Hi! I have a question about parsing JSON log messages produced by Kubernetes deployments in filebeat 7.6.2. I read this article but it doesn't help. I have such ConfigMap: apiVersion: v1 kind: ConfigMap metadata: na… --- ## [Monitor Websites from Multiple locations](https://discuss.elastic.co/t/monitor-websites-from-multiple-locations/228275)
**Author:** [@haneefh](https://discuss.elastic.co/u/haneefh)\ **Replies:** 1\ **Last updated:** [April 16, 2020, 12:03pm UTC](https://discuss.elastic.co/t/monitor-websites-from-multiple-locations/228275 "2020-04-16T12:03:29Z")
Hi I am trying to setup http monitors using heartbeat for websites from multiple locations. I am using add\_observer\_metadata to do this , but would it be possible to monitor a site from multiple locations using this fea… --- ## [Packebeat dashboard on kibana error](https://discuss.elastic.co/t/packebeat-dashboard-on-kibana-error/228307)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 11:31am UTC](https://discuss.elastic.co/t/packebeat-dashboard-on-kibana-error/228307 "2020-04-16T11:31:24Z")
Hey there, I have to VM's, on one packetbeat, the other kibana. When i try to load it's dashboard it give the error code Exciting: error connecting to kibana : fail to get the kibana version : HTTP GET request to http:… --- ## [Udp 127.0.0.1:2055: bind: address already in use in 7.6 netflow module](https://discuss.elastic.co/t/udp-127-0-0-1-bind-address-already-in-use-in-7-6-netflow-module/228222)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 3\ **Last updated:** [April 16, 2020, 9:49am UTC](https://discuss.elastic.co/t/udp-127-0-0-1-bind-address-already-in-use-in-7-6-netflow-module/228222 "2020-04-16T09:49:36Z")
Hi, i've upgraded filebead from 7.5.2 to 7.6.2 and now filebeat constantly complain: 2020-04-16T02:38:48.587+0300 INFO crawler/crawler.go:72 Loading Inputs: 2 2020-04-16T02:38:48.587+0300 INFO inp… --- ## [Winlog.computer\_name](https://discuss.elastic.co/t/winlog-computer-name/228190)
**Author:** [@bca](https://discuss.elastic.co/u/bca)\ **Replies:** 1\ **Last updated:** [April 16, 2020, 7:17am UTC](https://discuss.elastic.co/t/winlog-computer-name/228190 "2020-04-16T07:17:40Z")
I'm relatively new to this field and looking for information on what I should look for when troubleshooting specific winlog.\_ or event.\_ data. Where would be the best place to look? I've already gone through the Export F… --- ## [Filebeat not Generating Service Logs in Windows 10](https://discuss.elastic.co/t/filebeat-not-generating-service-logs-in-windows-10/228245)
**Author:** [@oneoneonepig](https://discuss.elastic.co/u/oneoneonepig)\ **Replies:** 3\ **Last updated:** [April 16, 2020, 7:11am UTC](https://discuss.elastic.co/t/filebeat-not-generating-service-logs-in-windows-10/228245 "2020-04-16T07:11:53Z")
Filebeat is not generating service logs. It was installed using the script ".\\install-service-filebeat.ps1" It was generating logs few hours ago, it stops generating logs after I deleted the "logs" directory. All conf… --- ## [Azure Module Error](https://discuss.elastic.co/t/azure-module-error/227210)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 13\ **Last updated:** [April 16, 2020, 6:20am UTC](https://discuss.elastic.co/t/azure-module-error/227210 "2020-04-16T06:20:13Z")
Using version 7.6.1 I am getting an error when starting filebeat with the azure module enabled. Any ideas what could be causing this? Thank you. 2020-04-08T21:35:17.140-0500 INFO \[azure-eventhub input\] azureeven… --- ## [Metricbeat does not respect on output.file.permissions](https://discuss.elastic.co/t/metricbeat-does-not-respect-on-output-file-permissions/227325)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [April 16, 2020, 6:19am UTC](https://discuss.elastic.co/t/metricbeat-does-not-respect-on-output-file-permissions/227325 "2020-04-16T06:19:53Z")
Hi, my metricbeat config for file output is this: output.file: # Boolean flag to enable or disable the output module. enabled: True # Configure JSON encoding #codec.json: # Pretty-print JSON event #pret… --- ## [Netflow module (7.6): only one of two exporters is being parsed](https://discuss.elastic.co/t/netflow-module-7-6-only-one-of-two-exporters-is-being-parsed/228226)
**Author:** [@bortok](https://discuss.elastic.co/u/bortok)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 12:21am UTC](https://discuss.elastic.co/t/netflow-module-7-6-only-one-of-two-exporters-is-being-parsed/228226 "2020-04-16T00:21:50Z")
I'm having trouble with receiving netflow from two different exporters by Filebeats Netflow module, ver 7.6. While one works just fine, the other one is completely ignored. I don't see any errors when it comes to parsing… --- ## [Problem with log processing](https://discuss.elastic.co/t/problem-with-log-processing/227911)
**Author:** [@Vlad\_Piratov](https://discuss.elastic.co/u/Vlad_Piratov)\ **Replies:** 3\ **Last updated:** [April 15, 2020, 1:01pm UTC](https://discuss.elastic.co/t/problem-with-log-processing/227911 "2020-04-15T13:01:56Z")
Version 7.6.2 Data is processed incorrectly. All dashboards are empty (I created a user for this, used sudo commands, and so on) Configured filebeat as follows: filebeat - \> Logstash - \> Elasticsearch. I tried differe… --- ## [How to find filebeat docker image with zero vulnarabilties.the current image of filebeat from elastic is have valnarabilties](https://discuss.elastic.co/t/how-to-find-filebeat-docker-image-with-zero-vulnarabilties-the-current-image-of-filebeat-from-elastic-is-have-valnarabilties/228072)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 10:09am UTC](https://discuss.elastic.co/t/how-to-find-filebeat-docker-image-with-zero-vulnarabilties-the-current-image-of-filebeat-from-elastic-is-have-valnarabilties/228072 "2020-04-15T10:09:53Z")
my requirement is that i want filebeat alpine os based docker image .so i found from a third party but it not works .so suggest me how to solve my problem. the vulnarability found by snyk report --- ## [Filter system logons](https://discuss.elastic.co/t/filter-system-logons/225001)
**Author:** [@kickon](https://discuss.elastic.co/u/kickon)\ **Replies:** 10\ **Last updated:** [April 15, 2020, 10:01am UTC](https://discuss.elastic.co/t/filter-system-logons/225001 "2020-04-15T10:01:50Z")
hello, in new version of 7.6.1 I have issue with filtering system logons which occur in events 4624 and 4634. I tried this one with some modification https://github.com/HASecuritySolutions/Logstash/blob/master/winlogb… --- ## [Error initializing publisher: 2 errors: open /etc/filebeat/cert.pem: no such file or directory](https://discuss.elastic.co/t/error-initializing-publisher-2-errors-open-etc-filebeat-cert-pem-no-such-file-or-directory/227096)
**Author:** [@lsambolino](https://discuss.elastic.co/u/lsambolino)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 9:38am UTC](https://discuss.elastic.co/t/error-initializing-publisher-2-errors-open-etc-filebeat-cert-pem-no-such-file-or-directory/227096 "2020-04-15T09:38:57Z")
Hi, When trying to deploy filebeat 7.6.2 by a Kubernetes 1.13 manifest file, containers are unable to spawn up correctly and they produce the following error: 2020-04-08T09:59:12.044Z ERROR instance/beat.go:93… --- ## [Problem when using pipeline with filebeat (Not LogStash::Event.new)](https://discuss.elastic.co/t/problem-when-using-pipeline-with-filebeat-not-logstash-event-new/228069)
**Author:** [@nb03briceno](https://discuss.elastic.co/u/nb03briceno)\ **Replies:** 0\ **Last updated:** [April 15, 2020, 9:34am UTC](https://discuss.elastic.co/t/problem-when-using-pipeline-with-filebeat-not-logstash-event-new/228069 "2020-04-15T09:34:47Z")
Hello everyone, I'm really concerned about a problem that I'm getting in my work. We developed an algorithm that allows us to create a new event in logstash each time that a certain pattern is matched, yet it is not wor… --- ## [Adding metadata with autodiscover is not working](https://discuss.elastic.co/t/adding-metadata-with-autodiscover-is-not-working/227942)
**Author:** [@Mario\_Albo\_Soria](https://discuss.elastic.co/u/Mario_Albo_Soria)\ **Replies:** 0\ **Last updated:** [April 14, 2020, 2:52pm UTC](https://discuss.elastic.co/t/adding-metadata-with-autodiscover-is-not-working/227942 "2020-04-14T14:52:08Z")
Hi everybody, I'm trying to add docker and host metadata with autodiscover because I need docker.container.name and host.ip fields to correctly index my logs. I'm using autodiscover option because I only need to harves… --- ## [Filebeat 7.6 Kubernetes \[ Openshift \] - Missing labels](https://discuss.elastic.co/t/filebeat-7-6-kubernetes-openshift-missing-labels/227912)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 6:35am UTC](https://discuss.elastic.co/t/filebeat-7-6-kubernetes-openshift-missing-labels/227912 "2020-04-15T06:35:32Z")
Hi! We're trying to run Filebeat on Openshift. We want to create indices based on project-labels. Let's say we have a project label called "system-name". Multiple projects could have the same "system-name" because they … --- ## [Multiline Java Stack Trace parsing doesn't work](https://discuss.elastic.co/t/multiline-java-stack-trace-parsing-doesnt-work/227783)
**Author:** [@ramokarahasan](https://discuss.elastic.co/u/ramokarahasan)\ **Replies:** 4\ **Last updated:** [April 15, 2020, 6:08am UTC](https://discuss.elastic.co/t/multiline-java-stack-trace-parsing-doesnt-work/227783 "2020-04-15T06:08:18Z")
I'm reviewing and trying: https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html and also followed: https://discuss.elastic.co/t/filebeat-multiline-java-stack-trace/150003 I've deployed the late… --- ## [File is inactive: Closing because close\_inactive of 15m0s reached](https://discuss.elastic.co/t/file-is-inactive-closing-because-close-inactive-of-15m0s-reached/227885)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 2\ **Last updated:** [April 15, 2020, 2:46am UTC](https://discuss.elastic.co/t/file-is-inactive-closing-because-close-inactive-of-15m0s-reached/227885 "2020-04-15T02:46:44Z")
Hi Team, frequently fIlebeat is stopped suddenly and can see below error in logs. please help on this. File is inactive: Closing because close\_inactive of 5m0s reached 2020-04-14T02:56:12.960-0500 INFO log/harve… --- ## [Error monitoring Windows folders recursively](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008)
**Author:** [@FatalGlitch](https://discuss.elastic.co/u/FatalGlitch)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 11:24pm UTC](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008 "2020-04-14T23:24:42Z")
Auditbeat 6.8.7 I'm trying to use the FIM module to monitor C:\\Windows in recursive, and when I do this, I just get an error as below: WARN \[file\_integrity\] file\_integrity/eventreader\_fsnotify.go:150 fsnotify watcher e… --- ## [Date and time incorrect with filebeat](https://discuss.elastic.co/t/date-and-time-incorrect-with-filebeat/227987)
**Author:** [@andywt123](https://discuss.elastic.co/u/andywt123)\ **Replies:** 0\ **Last updated:** [April 14, 2020, 7:24pm UTC](https://discuss.elastic.co/t/date-and-time-incorrect-with-filebeat/227987 "2020-04-14T19:24:19Z")
I am running a brand new install of elasticsearch. I have noticed that some of the systems have the date and time reported incorrectly for some not all log entries. I ran timedatectl on the Rhel instance and it is correc… --- ## [AWS ElasticSearch Service MetricBeats](https://discuss.elastic.co/t/aws-elasticsearch-service-metricbeats/227028)
**Author:** [@vennemp](https://discuss.elastic.co/u/vennemp)\ **Replies:** 6\ **Last updated:** [April 14, 2020, 4:44pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-service-metricbeats/227028 "2020-04-14T16:44:53Z")
I am trying to set up MetricBeats with AWS hosted ElasticSearch service. However, in the metricbeats.yml file it asks for a user name and password.. and there isn't a user name and password in AWS ElasticSearch/Kibana f… --- ## [Missing files after filebeat compile](https://discuss.elastic.co/t/missing-files-after-filebeat-compile/227855)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 2\ **Last updated:** [April 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/missing-files-after-filebeat-compile/227855 "2020-04-14T12:50:26Z")
When I clone the v7.6.2 tagged branch: git clone --single-branch --branch v7.6.2 https://github.com/elastic/beats ${GOPATH}/src/github.com/elastic/beats And do a mage package in the x-pack/filebeat directory, everythin… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=257) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=259)