# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=320 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 321 --- ## [Host.id is not unique](https://discuss.elastic.co/t/host-id-is-not-unique/196487)
**Author:** [@navigator182](https://discuss.elastic.co/u/navigator182)\ **Replies:** 4\ **Last updated:** [September 6, 2019, 2:39am UTC](https://discuss.elastic.co/t/host-id-is-not-unique/196487 "2019-09-06T02:39:55Z")
I am running auditbeat with more than 300 hosts, but there is 50 hosts showing at "\[Visualize\]Host Count \[Auditbeat System\] ECS". I find that the host.id is not unique. it's same on filebeat. How is it happened?auditbeat… --- ## [Filebeat 6.5 uninstall windows](https://discuss.elastic.co/t/filebeat-6-5-uninstall-windows/198322)
**Author:** [@sunny1](https://discuss.elastic.co/u/sunny1)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 10:54pm UTC](https://discuss.elastic.co/t/filebeat-6-5-uninstall-windows/198322 "2019-09-05T22:54:17Z")
Hello Team, I tried to uninstall filebeat 6.5 service using the powershell script uninstall-service-filebeat.ps1 but after it ran successfully i can still see the filebeat service and able to start stop. How do i remove… --- ## [Windows Embedded support?](https://discuss.elastic.co/t/windows-embedded-support/198207)
**Author:** [@imehl](https://discuss.elastic.co/u/imehl)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 8:00pm UTC](https://discuss.elastic.co/t/windows-embedded-support/198207 "2019-09-05T20:00:43Z")
Hi, I know that Windows Embedded / IoT is not listed under https://www.elastic.co/support/matrix But are there any experiences if it works on Windows Embedded? Thanks --- ## [Hello World for filebeat](https://discuss.elastic.co/t/hello-world-for-filebeat/197953)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 7\ **Last updated:** [September 5, 2019, 6:51pm UTC](https://discuss.elastic.co/t/hello-world-for-filebeat/197953 "2019-09-05T18:51:19Z")
I am attempting to do a 'hello-world' with filebeat by reading from a file and outputing to stdout or another file. I find that filebeat does not detect any changes to the log files. What would a hello-world look like? … --- ## [Cannot retrieve license. Connection refused](https://discuss.elastic.co/t/cannot-retrieve-license-connection-refused/197563)
**Author:** [@jbuenostein89](https://discuss.elastic.co/u/jbuenostein89)\ **Replies:** 10\ **Last updated:** [September 5, 2019, 6:20pm UTC](https://discuss.elastic.co/t/cannot-retrieve-license-connection-refused/197563 "2019-09-05T18:20:18Z")
Getting an error while trying to retrieve the license. I confirmed in Kibana that we have an active basic license. We are running everything locally. 2019-08-30T17:28:10.007Z DEBUG \[license-manager\] lic… --- ## [Filebeats creating the incorrect datatype in index](https://discuss.elastic.co/t/filebeats-creating-the-incorrect-datatype-in-index/196849)
**Author:** [@mbradsher](https://discuss.elastic.co/u/mbradsher)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 5:40pm UTC](https://discuss.elastic.co/t/filebeats-creating-the-incorrect-datatype-in-index/196849 "2019-09-05T17:40:07Z")
I find this perplexing but it seems as though filebeats has decided to take an input that is always a text object with no numerals in it and index it as a date object. As a result the filebeats data is rejected by ES be… --- ## [Packetbeat installation fails on Windows](https://discuss.elastic.co/t/packetbeat-installation-fails-on-windows/196820)
**Author:** [@thebeaoliveira](https://discuss.elastic.co/u/thebeaoliveira)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 4:58pm UTC](https://discuss.elastic.co/t/packetbeat-installation-fails-on-windows/196820 "2019-09-05T16:58:26Z")
I am trying to install Packetbeat on a Windows server, but I am getting the following error: Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET request to http://localhost:5601/api/status fail… --- ## [Filebeat, Logstash issue](https://discuss.elastic.co/t/filebeat-logstash-issue/198283)
**Author:** [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 3:47pm UTC](https://discuss.elastic.co/t/filebeat-logstash-issue/198283 "2019-09-05T15:47:44Z")
Hey guys, My environment - Dev Master nodes (Elasticsearch & Logstash are installed) x 2 Kibana node (Only Kibana) x 1 All m servers are on CentOS7 Before you ask I can reach my master nodes Both nodes see eachothe… --- ## [Filebeat 7.3.1 NGINX pipeline not inserting processed data](https://discuss.elastic.co/t/filebeat-7-3-1-nginx-pipeline-not-inserting-processed-data/198213)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 9:42am UTC](https://discuss.elastic.co/t/filebeat-7-3-1-nginx-pipeline-not-inserting-processed-data/198213 "2019-09-05T09:42:17Z")
Hi, I'm currently testing the Filebeat 7.3.1 NGINX module for processing access logs. The logs are inserted into ES but not processed via the ingest pipeline. For example fields like source.ip, url.original, http.reques… --- ## [How to build Logstash cluster for DB inputs](https://discuss.elastic.co/t/how-to-build-logstash-cluster-for-db-inputs/198211)
**Author:** [@bala2](https://discuss.elastic.co/u/bala2)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 10:00am UTC](https://discuss.elastic.co/t/how-to-build-logstash-cluster-for-db-inputs/198211 "2019-09-05T10:00:23Z")
Currently we got a requirement, where two logstash with JDBC input plugin needs to be configured with same DB queries.One logstash will be active all time, if that logstash instance goes down another instance should star… --- ## [Input docker: multiple multiline.pattern](https://discuss.elastic.co/t/input-docker-multiple-multiline-pattern/198216)
**Author:** [@ml\_docker\_captain](https://discuss.elastic.co/u/ml_docker_captain)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 9:53am UTC](https://discuss.elastic.co/t/input-docker-multiple-multiline-pattern/198216 "2019-09-05T09:53:59Z")
I'm new to ELK(with beats) and have more conceptual question. My inputs config looks like filebeat.inputs: - type: container combine\_partial: true paths: - /var/lib/docker/containers/\*/\*.log multiline.pattern: '… --- ## [Service does not start - 1 error: 1 error: failed to create audit client: failed to create audit client: audit not supported by kernel: protocol not supported](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045)
**Author:** [@monmac](https://discuss.elastic.co/u/monmac)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 9:27am UTC](https://discuss.elastic.co/t/service-does-not-start-1-error-1-error-failed-to-create-audit-client-failed-to-create-audit-client-audit-not-supported-by-kernel-protocol-not-supported/198045 "2019-09-05T09:27:53Z")
Service does not start, no error information in the log. Please help auditbeat -e -c auditbeat.yml -d "publish" \>\> WARN \[cfgwarn\] host/host.go:167 BETA: The system/host dataset is beta WARN \[cfgwar… --- ## [File Permission denied: Filebeat 6.6.0 on Windows](https://discuss.elastic.co/t/file-permission-denied-filebeat-6-6-0-on-windows/198205)
**Author:** [@vavdoshka](https://discuss.elastic.co/u/vavdoshka)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 9:23am UTC](https://discuss.elastic.co/t/file-permission-denied-filebeat-6-6-0-on-windows/198205 "2019-09-05T09:23:15Z")
Hi All, I know that the filebeat does not require an exclusive lock on the file, but I faced with a not clear behavior on a windows machine with running filebeat as a windows service. I have a log file (SomeTextFile.lo… --- ## [Metricbeat Kubernetes event module](https://discuss.elastic.co/t/metricbeat-kubernetes-event-module/198186)
**Author:** [@baymax\_zhao](https://discuss.elastic.co/u/baymax_zhao)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-event-module/198186 "2019-09-05T07:41:00Z")
Metricbeat watch kubernetes event .run for a while, An eof error occurred this issue happen in alibaba cloud Container Service, but in aws cloud had not happend kubernetes module config: 79 kubernetes.yml: |- 80 … --- ## [Filebeat 7.3.0 froze parsing multiline json](https://discuss.elastic.co/t/filebeat-7-3-0-froze-parsing-multiline-json/198162)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 6:20am UTC](https://discuss.elastic.co/t/filebeat-7-3-0-froze-parsing-multiline-json/198162 "2019-09-05T06:20:22Z")
Hi Team, I started with ELK 7.3.0 for SIEM feature. I now need to integrate Cloudflare logs which is in JSON format. I'm pretty sure that beats can do that. I have installed filebeat rpm package What I have done so fa… --- ## [How to avoid creating the dynamic fields in Kibana upon json decode of a specific field in the filebeat processor?](https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158)
**Author:** [@rahul\_mohan](https://discuss.elastic.co/u/rahul_mohan)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-avoid-creating-the-dynamic-fields-in-kibana-upon-json-decode-of-a-specific-field-in-the-filebeat-processor/198158 "2019-09-05T06:09:42Z")
Hello, I have an application deployed on IBM K8. It logs on the console. Logs range from simple json to nested json. I use the custom template with fields.yml for the fields in the ES-Kibana. Here is my filebeat prosp… --- ## [How to include specified docker containers in Filebeat?](https://discuss.elastic.co/t/how-to-include-specified-docker-containers-in-filebeat/197753)
**Author:** [@zhaozhiming](https://discuss.elastic.co/u/zhaozhiming)\ **Replies:** 2\ **Last updated:** [September 5, 2019, 1:46am UTC](https://discuss.elastic.co/t/how-to-include-specified-docker-containers-in-filebeat/197753 "2019-09-05T01:46:59Z")
Hi All, I have a problem struggle some days and I find many Filebeat documents but I can't find the correct answer. I want to make Filebeat only fetch the logs of the specified docker containers. I try the processor and… --- ## [Heartbeat i/o timeout](https://discuss.elastic.co/t/heartbeat-i-o-timeout/197402)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 1:34am UTC](https://discuss.elastic.co/t/heartbeat-i-o-timeout/197402 "2019-09-05T01:34:45Z")
ECE 2.3 RHEL 7.6 (Maipo) Redis server v=5.0.3 I'm having trouble with an application of ours connecting to Heartbeat. From what I've researched Redis should be listening on ports 6379, 6380, 16379 and 16380, which Re… --- ## [Can not collector docker container event](https://discuss.elastic.co/t/can-not-collector-docker-container-event/195875)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 1\ **Last updated:** [September 5, 2019, 1:34am UTC](https://discuss.elastic.co/t/can-not-collector-docker-container-event/195875 "2019-09-05T01:34:04Z")
i wannt collector docker container application heartbeat , but it does not work, that is my config heartbeat.autodiscover: providers: - type: docker templates: config: - type: http … --- ## [Kubernetes autodiscover template not working](https://discuss.elastic.co/t/kubernetes-autodiscover-template-not-working/198130)
**Author:** [@rodriguez-facundo](https://discuss.elastic.co/u/rodriguez-facundo)\ **Replies:** 0\ **Last updated:** [September 5, 2019, 12:40am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-template-not-working/198130 "2019-09-05T00:40:32Z")
I'm trying to use kuberntes autodiscover templating to collect metrics from a subset of pods, but I am not able to get output unless I remove the template and set hint.enabled=true // metricbeat.yaml providers: … --- ## [Does setup.template.append\_fields work for multifields?](https://discuss.elastic.co/t/does-setup-template-append-fields-work-for-multifields/198125)
**Author:** [@mbradsher](https://discuss.elastic.co/u/mbradsher)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 11:46pm UTC](https://discuss.elastic.co/t/does-setup-template-append-fields-work-for-multifields/198125 "2019-09-04T23:46:21Z")
Hello, I am attempting apply the experimental index template feature, setup.template.append\_fields, inside a filebeat config in order to set up a multifield datatype. This is an appealing feature because we don't want t… --- ## [Configure Logstash to Output Nagios Beats to NSCA - Nagios logs?](https://discuss.elastic.co/t/configure-logstash-to-output-nagios-beats-to-nsca-nagios-logs/197418)
**Author:** [@safehouse](https://discuss.elastic.co/u/safehouse)\ **Replies:** 4\ **Last updated:** [September 4, 2019, 7:26pm UTC](https://discuss.elastic.co/t/configure-logstash-to-output-nagios-beats-to-nsca-nagios-logs/197418 "2019-09-04T19:26:12Z")
In this post https://discuss.elastic.co/t/questions-about-self-monitoring-systems-blog-post/43542 there is mention of pushing data to Nagios using beats, which is very interesting. I have tested the checknagiosbeat plug… --- ## [Problems parsing Cisco ASA logs using filebeat](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326)
**Author:** [@candlerb](https://discuss.elastic.co/u/candlerb)\ **Replies:** 8\ **Last updated:** [September 4, 2019, 3:54pm UTC](https://discuss.elastic.co/t/problems-parsing-cisco-asa-logs-using-filebeat/195326 "2019-09-04T15:54:35Z")
I am testing ASA syslog parsing with filebeat 7.3.0. Using tcpdump I have captured some real packets generated by a Cisco ASA (running firmware 9.6) to make this easy to reproduce. I have a trivial filebeat configurati… --- ## [Two filebeat service on same window server](https://discuss.elastic.co/t/two-filebeat-service-on-same-window-server/197923)
**Author:** [@deemanu](https://discuss.elastic.co/u/deemanu)\ **Replies:** 2\ **Last updated:** [September 4, 2019, 3:00pm UTC](https://discuss.elastic.co/t/two-filebeat-service-on-same-window-server/197923 "2019-09-04T15:00:47Z")
Hello All , Could you please help me to know how to run to two filebeat services ( instances) on same windows server ? i have two instances -one is running as a service but when i try to run another it is stopping othe… --- ## [FileBeat Debug Logging not Working?](https://discuss.elastic.co/t/filebeat-debug-logging-not-working/198012)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 1\ **Last updated:** [September 4, 2019, 9:08am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-not-working/198012 "2019-09-04T09:08:33Z")
According to the docs filebeat -e -d "publish" should publish debug information about each event it sends (say to LogStash). This is not the case (Windows, ELK+FB 7.3). filebeat.exe -c filebeat.dev.yml -e -d "publish" O… --- ## [Connected clients with metricbeat](https://discuss.elastic.co/t/connected-clients-with-metricbeat/197788)
**Author:** [@cristianaxion](https://discuss.elastic.co/u/cristianaxion)\ **Replies:** 2\ **Last updated:** [September 4, 2019, 7:17am UTC](https://discuss.elastic.co/t/connected-clients-with-metricbeat/197788 "2019-09-04T07:17:53Z")
Hi, Can someone help me by telling me how several clients connect to metricbeat on machines with different ip? --- ## [Setup.template.name ignored](https://discuss.elastic.co/t/setup-template-name-ignored/197982)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 6:10am UTC](https://discuss.elastic.co/t/setup-template-name-ignored/197982 "2019-09-04T06:10:54Z")
Hi, I got the config below but filebeat is ignoring the custom name I want to set for the index and instead puts everything into filebeat-\*. I followed the Docs but apparently that information is incorrect. If have als… --- ## [Confusion on the Create Beat instruction](https://discuss.elastic.co/t/confusion-on-the-create-beat-instruction/197981)
**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 5:52am UTC](https://discuss.elastic.co/t/confusion-on-the-create-beat-instruction/197981 "2019-09-04T05:52:16Z")
According to this url: https://www.elastic.co/guide/en/beats/devguide/master/newbeat-generate.html Now create a directory under $GOPATH for your repository and change to the new directory: mkdir ${GOPATH}/src/github.co… --- ## [Failed to create new beat](https://discuss.elastic.co/t/failed-to-create-new-beat/197978)
**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 5:32am UTC](https://discuss.elastic.co/t/failed-to-create-new-beat/197978 "2019-09-04T05:32:34Z")
After creating the beat, I got the error below according to the instruction from this link: https://www.elastic.co/guide/en/beats/devguide/7.3/setting-up-beat.html \[root@elk infabeat\]# make setup mkdir -p vendor/github… --- ## [How to change the field type in the fields.yml on fly](https://discuss.elastic.co/t/how-to-change-the-field-type-in-the-fields-yml-on-fly/197968)
**Author:** [@rahul\_mohan](https://discuss.elastic.co/u/rahul_mohan)\ **Replies:** 0\ **Last updated:** [September 4, 2019, 2:53am UTC](https://discuss.elastic.co/t/how-to-change-the-field-type-in-the-fields-yml-on-fly/197968 "2019-09-04T02:53:20Z")
Hello, I am using the default fields.yml that comes with filebeat. However, I want to change the type of a field "message" from "text" to "object". But, I don't want to create a new fields.yml with this change. Can i… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=319) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=321)