# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=337 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 338 --- ## [Functionbeat 7.2.0 with kinesis base64 message](https://discuss.elastic.co/t/functionbeat-7-2-0-with-kinesis-base64-message/189768)
**Author:** [@Inbloo](https://discuss.elastic.co/u/Inbloo)\ **Replies:** 3\ **Last updated:** [July 15, 2019, 9:51am UTC](https://discuss.elastic.co/t/functionbeat-7-2-0-with-kinesis-base64-message/189768 "2019-07-15T09:51:00Z")
Hi We are trying to send data from AWS kinesis to elasticsearch with functionbeat 7.2.0 (last released version). Kinesis is storing message data in base64 encoding. Functionbeat will implement https://www.elastic.co/gu… --- ## [Disable automatic fields appended to fields.yml](https://discuss.elastic.co/t/disable-automatic-fields-appended-to-fields-yml/189108)
**Author:** [@Florck](https://discuss.elastic.co/u/Florck)\ **Replies:** 1\ **Last updated:** [July 15, 2019, 7:17am UTC](https://discuss.elastic.co/t/disable-automatic-fields-appended-to-fields-yml/189108 "2019-07-15T07:17:07Z")
Dear all, I've tried to upgrade on of our beat to v7.x of libbeat. I've got the surprise that in the generated fields.yml, there are very lot of automatically generated fields that we don't need from the following cate… --- ## [Filebeat not working properly](https://discuss.elastic.co/t/filebeat-not-working-properly/190344)
**Author:** [@ugangster](https://discuss.elastic.co/u/ugangster)\ **Replies:** 0\ **Last updated:** [July 13, 2019, 11:32am UTC](https://discuss.elastic.co/t/filebeat-not-working-properly/190344 "2019-07-13T11:32:11Z")
Filebeats not working properly. It showing below error:Failed to publish events: temporary bulk send failure Check dropbox link: https://www.dropbox.com/sh/i2e6hx9k4nisp5p/AACA06YMYkLue18r41ePpprsa?dl=0 Error 1: { i… --- ## [For anyone struggling in changing the index name of your beats, I've got a solution finally](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176)
**Author:** [@Choosue](https://discuss.elastic.co/u/Choosue)\ **Replies:** 1\ **Last updated:** [July 12, 2019, 4:11pm UTC](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176 "2019-07-12T16:11:50Z")
First of all My elasticsearch version: 7.2.0 My kibana version: not important but it is 7.2.0 My packetbeat version: 8.0.0 (current master branch) Since my goal is to adding new features to packetbeat, so I downloaded… --- ## [Is auditbeat dependent on auditd？](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd/189053)
**Author:** [@nezha\_song](https://discuss.elastic.co/u/nezha_song)\ **Replies:** 1\ **Last updated:** [July 12, 2019, 3:14pm UTC](https://discuss.elastic.co/t/is-auditbeat-dependent-on-auditd/189053 "2019-07-12T15:14:04Z")
auditd often creats a lot of disk IO, will it be reduced by auditbeat? --- ## [Unable to start Metric beat on Kubenetes](https://discuss.elastic.co/t/unable-to-start-metric-beat-on-kubenetes/190076)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [July 12, 2019, 2:50pm UTC](https://discuss.elastic.co/t/unable-to-start-metric-beat-on-kubenetes/190076 "2019-07-12T14:50:43Z")
I am trying to start the metric beat with https://github.com/elastic/beats/blob/master/deploy/kubernetes/metricbeat-kubernetes.yaml file but it failing with below error. any help will be appriciated. Version Elk - 7.2 … --- ## [No results found in Kibana sample dashboards for Filebeat](https://discuss.elastic.co/t/no-results-found-in-kibana-sample-dashboards-for-filebeat/189350)
**Author:** [@tng](https://discuss.elastic.co/u/tng)\ **Replies:** 7\ **Last updated:** [July 12, 2019, 9:32am UTC](https://discuss.elastic.co/t/no-results-found-in-kibana-sample-dashboards-for-filebeat/189350 "2019-07-12T09:32:31Z")
Hello, I installed ELK 7.2 and Filebeat on the same host running on Debian 9 and I installed only Filebeat on another host running on Centos 7 . I enabled the Filebeat system module on both hosts and Logstash system log… --- ## [Metricbeat cannot create index](https://discuss.elastic.co/t/metricbeat-cannot-create-index/190103)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [July 12, 2019, 9:01am UTC](https://discuss.elastic.co/t/metricbeat-cannot-create-index/190103 "2019-07-12T09:01:59Z")
Hello I am trying to add metricbeat to the elasticsearch but it does not seam to be able to create the index. I've tried loading the data manually and I get the following error message. { "error": { "root\_cause": … --- ## [Metricbeat collect jvm used heap memory](https://discuss.elastic.co/t/metricbeat-collect-jvm-used-heap-memory/189955)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [July 12, 2019, 8:16am UTC](https://discuss.elastic.co/t/metricbeat-collect-jvm-used-heap-memory/189955 "2019-07-12T08:16:48Z")
Hi, I'm using Metricbeat to collect fields with elasticsearch module. I'm using v.6.8 Currently I cannot find any field related the used heap memory value. is it correct? --- ## [Possible to get Throughput value direct from metricbeat-Kafka?](https://discuss.elastic.co/t/possible-to-get-throughput-value-direct-from-metricbeat-kafka/189752)
**Author:** [@Pikapi](https://discuss.elastic.co/u/Pikapi)\ **Replies:** 1\ **Last updated:** [July 12, 2019, 4:25am UTC](https://discuss.elastic.co/t/possible-to-get-throughput-value-direct-from-metricbeat-kafka/189752 "2019-07-12T04:25:42Z")
I am trying to get the count of throughput coming to Kafka. The throughput is literally rows and rows of records. --- ## [Error on create a custom metricbeat](https://discuss.elastic.co/t/error-on-create-a-custom-metricbeat/188537)
**Author:** [@fdmsantos](https://discuss.elastic.co/u/fdmsantos)\ **Replies:** 2\ **Last updated:** [July 12, 2019, 4:22am UTC](https://discuss.elastic.co/t/error-on-create-a-custom-metricbeat/188537 "2019-07-12T04:22:20Z")
Hello, I'm trying create a beat based on metricbeat. I have the following errors: grep: ../libbeat/docs/version.asciidoc: No such file or directory and: cp: cannot stat 'module/\*/\_meta/kibana/\*': No such file or dir… --- ## [Filebeat is not sending logs to elastic search](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099)
**Author:** [@pmilton](https://discuss.elastic.co/u/pmilton)\ **Replies:** 1\ **Last updated:** [July 12, 2019, 12:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099 "2019-07-12T00:53:28Z")
Hi, I am new to ELK stack and I am trying to setup ELK stack for logging in Azure. I completed the setup at filebeat and it is running. \[elkclient1@elkclient1 /\]$ sudo service filebeat restart Restarting filebeat (via… --- ## [Auditbeat - SIEM](https://discuss.elastic.co/t/auditbeat-siem/187853)
**Author:** [@cob](https://discuss.elastic.co/u/cob)\ **Replies:** 5\ **Last updated:** [July 12, 2019, 12:46am UTC](https://discuss.elastic.co/t/auditbeat-siem/187853 "2019-07-12T00:46:12Z")
Hello All, I'm currently playing with and testing out the SIEM plugin. However, as soon as I feed it Auditbeat data, I seem to get a message error which I'm not really sure about. I thought that the SIEM would work nati… --- ## [Apache kafka heartbeat creation](https://discuss.elastic.co/t/apache-kafka-heartbeat-creation/190016)
**Author:** [@Neha\_Chaturvedi](https://discuss.elastic.co/u/Neha_Chaturvedi)\ **Replies:** 5\ **Last updated:** [July 11, 2019, 6:01pm UTC](https://discuss.elastic.co/t/apache-kafka-heartbeat-creation/190016 "2019-07-11T18:01:40Z")
Hi Team , I am unable to create heartbeat monitors for the apache kafka endpoints. Can some one please help me out. heartbeat.yml type: http urls: \["http://localhost:9092"\] schedule: '\*/10 \* \* \* \* \* \*' Logs in ki… --- ## [Dropping logon events for computer accounts not working](https://discuss.elastic.co/t/dropping-logon-events-for-computer-accounts-not-working/190061)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 4:08pm UTC](https://discuss.elastic.co/t/dropping-logon-events-for-computer-accounts-not-working/190061 "2019-07-11T16:08:44Z")
Hi, I'm working at the moment correlating windows Logon and Special Logon events (4624 and 4672) . I want to drop the events 4624 event when event\_data.TargetUserName ends with $ because is a computer-related account j… --- ## [Metricbeats stops on agents](https://discuss.elastic.co/t/metricbeats-stops-on-agents/189440)
**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Replies:** 6\ **Last updated:** [July 11, 2019, 4:01pm UTC](https://discuss.elastic.co/t/metricbeats-stops-on-agents/189440 "2019-07-11T16:01:53Z")
HI I have installed Metricbeats 7.2 and filebeats on different windows and linux server. I see metric beats process stops on windows servers with out any error log. Can you please guide how trace whats causing this to … --- ## [Docker-compose](https://discuss.elastic.co/t/docker-compose/190051)
**Author:** [@darkiron](https://discuss.elastic.co/u/darkiron)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 2:59pm UTC](https://discuss.elastic.co/t/docker-compose/190051 "2019-07-11T14:59:35Z")
I uses small docker-compose.yml as host, I want add docker-image of filebeat to send nginx log to Elsatic et Kibana. I try some things on localhost (in production i many server in use ...) Docker-compose as based on : … --- ## [Slow to stop metricbeat Windows service](https://discuss.elastic.co/t/slow-to-stop-metricbeat-windows-service/188466)
**Author:** [@tomkirk](https://discuss.elastic.co/u/tomkirk)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 2:31pm UTC](https://discuss.elastic.co/t/slow-to-stop-metricbeat-windows-service/188466 "2019-07-11T14:31:21Z")
Hello, I'm installing metricbeat as a Windows service. I'm not using the supplied powershell files but rather doing it via WinSVC in C/C++. This start up and runs fine. When I want to update the files I'm stopping the … --- ## [Filebeat not sending metadata to Graylog even I included add\_kubernetes\_metadata](https://discuss.elastic.co/t/filebeat-not-sending-metadata-to-graylog-even-i-included-add-kubernetes-metadata/186080)
**Author:** [@Sai\_Sanaka](https://discuss.elastic.co/u/Sai_Sanaka)\ **Replies:** 5\ **Last updated:** [July 11, 2019, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-metadata-to-graylog-even-i-included-add-kubernetes-metadata/186080 "2019-07-11T13:41:52Z")
Hi I have Filebeat setup to pull logs from Kubernetes which is not working. Little background: I have Graylog running with mongo and elastic search on a single server. I have a beats plugin "graylog-plugin-beats-2.4.7"… --- ## [Can't modify the default index name](https://discuss.elastic.co/t/cant-modify-the-default-index-name/190000)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 12:39pm UTC](https://discuss.elastic.co/t/cant-modify-the-default-index-name/190000 "2019-07-11T12:39:45Z")
Hi, I am just trying to setup FileBeat to push logs from file to ElasticSearch Index. Here is my config. I'm expecting the data to be indexed to dummy-2019.07.11, but No matter what I change, Data is always being indexe… --- ## [Status of filebeat is showing as it is not in running state](https://discuss.elastic.co/t/status-of-filebeat-is-showing-as-it-is-not-in-running-state/189764)
**Author:** [@Ajay\_Singh1](https://discuss.elastic.co/u/Ajay_Singh1)\ **Replies:** 3\ **Last updated:** [July 11, 2019, 12:35pm UTC](https://discuss.elastic.co/t/status-of-filebeat-is-showing-as-it-is-not-in-running-state/189764 "2019-07-11T12:35:43Z")
when i am checking status of mine filebeat it is showing its not in running state why is this happening? --- ## [Can't get my filebeat to work](https://discuss.elastic.co/t/cant-get-my-filebeat-to-work/189803)
**Author:** [@brianna](https://discuss.elastic.co/u/brianna)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 11:53am UTC](https://discuss.elastic.co/t/cant-get-my-filebeat-to-work/189803 "2019-07-11T11:53:28Z")
I'm new to ELK and I cannot figure out how to get my filebeat to successfully send logs to logstash -\> elasticsearch -\> kibana filebeat config filebeat.inputs: type: log enabled: true paths: C:\\Users\\smithbrianna\\… --- ## [\[metricbeat\] Unable to ship monitoring information on Windows machine](https://discuss.elastic.co/t/metricbeat-unable-to-ship-monitoring-information-on-windows-machine/189956)
**Author:** [@s.pawluk.krd](https://discuss.elastic.co/u/s.pawluk.krd)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 11:50am UTC](https://discuss.elastic.co/t/metricbeat-unable-to-ship-monitoring-information-on-windows-machine/189956 "2019-07-11T11:50:52Z")
2019-07-11T11:35:51.886+0200 ERROR \[elasticsearch.node\_stats\] node\_stats/node\_stats.go:72 1 error: failure to apply node schema: 1 error: key \`os.cpu.load\_average\` not found Monitored stack version: 7.0.1 Metricbe… --- ## [Alternative for Filebeat](https://discuss.elastic.co/t/alternative-for-filebeat/189996)
**Author:** [@dilipchiru](https://discuss.elastic.co/u/dilipchiru)\ **Replies:** 0\ **Last updated:** [July 11, 2019, 11:43am UTC](https://discuss.elastic.co/t/alternative-for-filebeat/189996 "2019-07-11T11:43:52Z")
Hi , Please any body know to push the log files from one server to another server .Where that another server having the ELK stack to monitor the data Note : I don't want to use the Filebeat because it spikes more CPU P… --- ## [Custom filebeat to attach data on outgoing stream](https://discuss.elastic.co/t/custom-filebeat-to-attach-data-on-outgoing-stream/189403)
**Author:** [@swapnil.bordiya](https://discuss.elastic.co/u/swapnil.bordiya)\ **Replies:** 3\ **Last updated:** [July 11, 2019, 11:43am UTC](https://discuss.elastic.co/t/custom-filebeat-to-attach-data-on-outgoing-stream/189403 "2019-07-11T11:43:16Z")
I have a server with multiple log sources. To make better sense out of logs we need to put additional info by querying some data sources from a DB server and attach on the filebeats outgoing data stream. Is there anyway… --- ## [Kubernetes: Querying for pod failed with error: kubernetes api: Failure 404 pods](https://discuss.elastic.co/t/kubernetes-querying-for-pod-failed-with-error-kubernetes-api-failure-404-pods/188497)
**Author:** [@shinerrs](https://discuss.elastic.co/u/shinerrs)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 10:48am UTC](https://discuss.elastic.co/t/kubernetes-querying-for-pod-failed-with-error-kubernetes-api-failure-404-pods/188497 "2019-07-11T10:48:47Z")
Hi, I have the following config: # Kubernetes API server # (when running metricbeat as a pod) - module: kubernetes enabled: true metricsets: - apiserver hosts: \["localhost:8080"\] Metricbeat is run as a daemo… --- ## [Auditbeat vs Winlogbeat](https://discuss.elastic.co/t/auditbeat-vs-winlogbeat/189406)
**Author:** [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 8:46am UTC](https://discuss.elastic.co/t/auditbeat-vs-winlogbeat/189406 "2019-07-11T08:46:50Z")
Hi There, Today i tested install auditbeat on windows with default configuration. It seem like it works with few questions and notes. delivered dashboards are not so usable. I foud that user related audits are comple… --- ## [Does metricbeat apache module gather information from /server-status?](https://discuss.elastic.co/t/does-metricbeat-apache-module-gather-information-from-server-status/189886)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 5:34am UTC](https://discuss.elastic.co/t/does-metricbeat-apache-module-gather-information-from-server-status/189886 "2019-07-11T05:34:57Z")
Does metricbeat apache module gather information from /server-status?? This is because i have my /server-status disabled and unable to obtain any server information via metricbeat. --- ## [Include\_lines before multiline](https://discuss.elastic.co/t/include-lines-before-multiline/189844)
**Author:** [@Umaigenomu](https://discuss.elastic.co/u/Umaigenomu)\ **Replies:** 1\ **Last updated:** [July 10, 2019, 7:37pm UTC](https://discuss.elastic.co/t/include-lines-before-multiline/189844 "2019-07-10T19:37:19Z")
Hello, From reading the docs, I realized that whenever multiline and include\_lines (or exclude) are both set, filebeat processes the multiline part before including/excluding any lines. That seems a bit counterintuitive… --- ## [Metricbeat-rabbitmq problem](https://discuss.elastic.co/t/metricbeat-rabbitmq-problem/189443)
**Author:** [@Chris\_Shim](https://discuss.elastic.co/u/Chris_Shim)\ **Replies:** 3\ **Last updated:** [July 10, 2019, 6:13pm UTC](https://discuss.elastic.co/t/metricbeat-rabbitmq-problem/189443 "2019-07-10T18:13:07Z")
Excuse me. How can I get the "Client-provided name" using Metricbeat ? Regards [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=336) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=338)