# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=339 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 340 --- ## [Metricbeat period](https://discuss.elastic.co/t/metricbeat-period/189300)
**Author:** [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\ **Replies:** 1\ **Last updated:** [July 8, 2019, 1:13pm UTC](https://discuss.elastic.co/t/metricbeat-period/189300 "2019-07-08T13:13:51Z")
HI, Required some info regarding period in metricbeat.yml file period: 10s by default right but why i am getting multiple documents instead of 1 document for each 10s ? If it is not the case then how i can control, t… --- ## [Filebeat fails to start with add\_kubernetes\_metadata](https://discuss.elastic.co/t/filebeat-fails-to-start-with-add-kubernetes-metadata/188825)
**Author:** [@Adam\_Wong](https://discuss.elastic.co/u/Adam_Wong)\ **Replies:** 1\ **Last updated:** [July 8, 2019, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-with-add-kubernetes-metadata/188825 "2019-07-08T13:11:20Z")
When starting filebeat using add\_kubernetes\_metadata, the beat will report an error like this and stop: 2019-07-02T19:32:29.785+0800 INFO instance/beat.go:279 Setup Beat: filebeat; Version: 7.0.0-alpha1 2019-07-02T19:32… --- ## [Filebeat is using too much cpu](https://discuss.elastic.co/t/filebeat-is-using-too-much-cpu/187978)
**Author:** [@biello](https://discuss.elastic.co/u/biello)\ **Replies:** 5\ **Last updated:** [July 8, 2019, 10:20am UTC](https://discuss.elastic.co/t/filebeat-is-using-too-much-cpu/187978 "2019-07-08T10:20:54Z")
I didn't set the scan\_frequency option(which means leave as default 10s), why does it still use that much cpu? Here is the log from filebeat: 2019-06-28T14:30:52.034+0800 INFO \[monitoring\] log/log.go:144 Non-zero met… --- ## [Configure Zeek module with the sample dashboard](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951)
**Author:** [@Merril](https://discuss.elastic.co/u/Merril)\ **Replies:** 2\ **Last updated:** [July 8, 2019, 8:07am UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951 "2019-07-08T08:07:43Z")
Hi all, I am struggling to set up visualisation for Zeek (Bro) logs with Kibana. The Zeek module included with filebeat apparently comes with a sample dashboard seen here. I am struggling to see the sample dashboard and… --- ## [Journalbeat bug: operation stops forever when disk is full for a moment](https://discuss.elastic.co/t/journalbeat-bug-operation-stops-forever-when-disk-is-full-for-a-moment/188584)
**Author:** [@Trolldemorted](https://discuss.elastic.co/u/Trolldemorted)\ **Replies:** 2\ **Last updated:** [July 8, 2019, 6:51am UTC](https://discuss.elastic.co/t/journalbeat-bug-operation-stops-forever-when-disk-is-full-for-a-moment/188584 "2019-07-08T06:51:45Z")
Since you want me to post here before opening an issue, here we go: Today one of our servers' disk was full. The situation has been resolved, but journalbeat does not resume operation: root@mainvm:/services/EnoEngine# … --- ## [Indexing simple json at filebeats 7.2](https://discuss.elastic.co/t/indexing-simple-json-at-filebeats-7-2/188613)
**Author:** [@taka-h](https://discuss.elastic.co/u/taka-h)\ **Replies:** 2\ **Last updated:** [July 7, 2019, 10:45pm UTC](https://discuss.elastic.co/t/indexing-simple-json-at-filebeats-7-2/188613 "2019-07-07T22:45:24Z")
I'd like to store some JSON log file to Elasticsearch and index log easily. filebeat.inputs: - type: log enabled: true paths: - /var/log/sample/\*.log json.keys\_under\_root: true json.add\_error\_key: true setu… --- ## [Filebeat incorrect timestamp](https://discuss.elastic.co/t/filebeat-incorrect-timestamp/189009)
**Author:** [@Marct](https://discuss.elastic.co/u/Marct)\ **Replies:** 2\ **Last updated:** [July 6, 2019, 6:00pm UTC](https://discuss.elastic.co/t/filebeat-incorrect-timestamp/189009 "2019-07-06T18:00:33Z")
Hi, Very new to Elastic and all things ELK... I have started a trail instance of Cloud ES on version 7.2.0, I am testing the panw filebeat module to ship my firewall logs to ES. I have followed what I though to be the… --- ## ["json\_error": "Error decoding JSON: invalid character 'S' looking for beginning of value](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 10:20pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124 "2019-07-05T22:20:01Z")
Hello Currently getting the error json\_error": "Error decoding JSON: invalid character 'S' looking for beginning of value Full error "input\_type": "log", "json\_error": "Error decoding JSON: invalid characte… --- ## [\[7.2.0\] Mssql module doesn't exist?](https://discuss.elastic.co/t/7-2-0-mssql-module-doesnt-exist/188875)
**Author:** [@ChamMach](https://discuss.elastic.co/u/ChamMach)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 9:14pm UTC](https://discuss.elastic.co/t/7-2-0-mssql-module-doesnt-exist/188875 "2019-07-05T21:14:03Z")
Hi there, When I want to enable the module "mssql" on my Windows server I have this message : Also, I don't see any mention about this module in the "modules.d" directory. As I can see here the "mssql" module is sup… --- ## [Filebeat not sending logs to listener.logz.io:5015 via haproxy](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-listener-logz-io-5015-via-haproxy/188702)
**Author:** [@Pradeep\_Sathasivam](https://discuss.elastic.co/u/Pradeep_Sathasivam)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 8:47pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-listener-logz-io-5015-via-haproxy/188702 "2019-07-05T20:47:34Z")
Following is the output snippet from my filebeat.yml output: logstash: hosts: \['192.168.200.38:5015'\] where 192.168.200.38:5015 is a haproxy server listening in tcp mode. Following is my haproxy configuration: g… --- ## [Use Keystore in Elastic Cloud](https://discuss.elastic.co/t/use-keystore-in-elastic-cloud/188670)
**Author:** [@ssharaf](https://discuss.elastic.co/u/ssharaf)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 8:45pm UTC](https://discuss.elastic.co/t/use-keystore-in-elastic-cloud/188670 "2019-07-05T20:45:13Z")
I want to ship logs from Google Storage to Elasticsearch and I could find a plugin which does the job. However, it needs a service account key to be stored in Keystore. I use Elastic Cloud and I could not find a page wh… --- ## [Facing delay in logs](https://discuss.elastic.co/t/facing-delay-in-logs/188631)
**Author:** [@Iswarya](https://discuss.elastic.co/u/Iswarya)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 8:38pm UTC](https://discuss.elastic.co/t/facing-delay-in-logs/188631 "2019-07-05T20:38:24Z")
Hi Team, We are not getting the real time logs in kibana. 1.We have tried restarting the filebeat,logstash and elasticsearch. 2.We have changed the communication port between logstash and filebeat. Eventhough Connecti… --- ## [Filebeat docker](https://discuss.elastic.co/t/filebeat-docker/188592)
**Author:** [@Harsha606](https://discuss.elastic.co/u/Harsha606)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 8:12pm UTC](https://discuss.elastic.co/t/filebeat-docker/188592 "2019-07-05T20:12:19Z")
Hi All, I am using official filebeat image, below is my dockerfile. FROM docker.elastic.co/beats/filebeat:7.1.1 COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root RUN mkdir /usr/share/filebeat/fb-configs C… --- ## [Up/Down Monitoring with Elastic](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966)
**Author:** [@Cody\_Jackson](https://discuss.elastic.co/u/Cody_Jackson)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 3:56pm UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966 "2019-07-05T15:56:33Z")
Hey everyone, I'm currently working on migrating the functionality of an old element management system (Solarwinds) to Elastic/Heartbeat for monitoring and alerting of devices when they go down and come back up. I've h… --- ## [Custom index name does not work on metricbeat](https://discuss.elastic.co/t/custom-index-name-does-not-work-on-metricbeat/188977)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 3:30pm UTC](https://discuss.elastic.co/t/custom-index-name-does-not-work-on-metricbeat/188977 "2019-07-05T15:30:47Z")
I want to keep the indices for my metricbeats unique per project. I have added the custom metricbeats as below Note: running metricbeat 7.2.0 on windows server 2016 ###################### Metricbeat Configuration Exa… --- ## [How can I to install beats on as/400?](https://discuss.elastic.co/t/how-can-i-to-install-beats-on-as-400/188411)
**Author:** [@luisjoelqs](https://discuss.elastic.co/u/luisjoelqs)\ **Replies:** 6\ **Last updated:** [July 5, 2019, 1:58pm UTC](https://discuss.elastic.co/t/how-can-i-to-install-beats-on-as-400/188411 "2019-07-05T13:58:48Z")
We are planing install a production cluster of elastic and I don't see any documentation about install beats on AS/400, can anyone helpme about this? Thanks --- ## [Winlogbeat visualization error](https://discuss.elastic.co/t/winlogbeat-visualization-error/189041)
**Author:** [@Xelrod](https://discuss.elastic.co/u/Xelrod)\ **Replies:** 0\ **Last updated:** [July 5, 2019, 8:40am UTC](https://discuss.elastic.co/t/winlogbeat-visualization-error/189041 "2019-07-05T08:40:53Z")
Hi, I've setup winlogbeat and have the dashboard setup in Kibana. But I'm not seeing all the data in the dashboard instead getting these errors. winlogbeat config winlogbeat.event\_logs: name: Security event… --- ## [Filebeat est en cours d'exécution mais n'envoie pas de logs à logstash](https://discuss.elastic.co/t/filebeat-est-en-cours-dexecution-mais-nenvoie-pas-de-logs-a-logstash/188772)
**Author:** [@Momo](https://discuss.elastic.co/u/Momo)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 8:12am UTC](https://discuss.elastic.co/t/filebeat-est-en-cours-dexecution-mais-nenvoie-pas-de-logs-a-logstash/188772 "2019-07-05T08:12:19Z")
J'essaie d'installer filebeat 7.2.0 sur ma machine. filebeat est bien lancé mais n'envoie pas de logs à logstash. Quand je regarde les logs de filebeat en tapant journalctl -u filebeat -e 2019-07-03T16:35:32.698+0200 … --- ## [How do Beats receive configuration changes from Beats Central Management (i.e REST, SSH)?](https://discuss.elastic.co/t/how-do-beats-receive-configuration-changes-from-beats-central-management-i-e-rest-ssh/188764)
**Author:** [@Maria\_Med](https://discuss.elastic.co/u/Maria_Med)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 8:04am UTC](https://discuss.elastic.co/t/how-do-beats-receive-configuration-changes-from-beats-central-management-i-e-rest-ssh/188764 "2019-07-05T08:04:18Z")
I am trying to find how the Beats Central Management console in Kibana deploys configuration changes to enrolled Beats. I have searched the documentation of both Beats and Beats Central Management, but have seen no clea… --- ## [Filebeats - Sending JSON output to Compacted Kafka Topic](https://discuss.elastic.co/t/filebeats-sending-json-output-to-compacted-kafka-topic/188658)
**Author:** [@vinshas1](https://discuss.elastic.co/u/vinshas1)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 7:33am UTC](https://discuss.elastic.co/t/filebeats-sending-json-output-to-compacted-kafka-topic/188658 "2019-07-05T07:33:50Z")
I am able to send JSON output to Kafka non-compacted Topic but unable to send it to compacted topic. I know we need a keyed message to send it to compacted topic and I tried with 'key' in output.kafka and also tried json… --- ## [How to turn off index management in filebeat.yml](https://discuss.elastic.co/t/how-to-turn-off-index-management-in-filebeat-yml/188930)
**Author:** [@werowe](https://discuss.elastic.co/u/werowe)\ **Replies:** 6\ **Last updated:** [July 4, 2019, 8:42pm UTC](https://discuss.elastic.co/t/how-to-turn-off-index-management-in-filebeat-yml/188930 "2019-07-04T20:42:26Z")
Using version 7.2.2. Getting error message: ERROR instance/beat.go:877 Exiting: Index management requested but the Elasticsearch output is not configured/enabled But not able to disable index management using setup… --- ## [Auditbeat socket dashoard messy with high socket count](https://discuss.elastic.co/t/auditbeat-socket-dashoard-messy-with-high-socket-count/188786)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [July 4, 2019, 3:11pm UTC](https://discuss.elastic.co/t/auditbeat-socket-dashoard-messy-with-high-socket-count/188786 "2019-07-04T15:11:28Z")
Hello, Please check the following screenshot: Of course this is part of a bigger problem, the same happens on so many dashboards. To resolve this, the 'metric' visulisation should have an option to dynamically scale … --- ## [Filebeat wont send all messages to kafka](https://discuss.elastic.co/t/filebeat-wont-send-all-messages-to-kafka/188936)
**Author:** [@marcusedvardsson](https://discuss.elastic.co/u/marcusedvardsson)\ **Replies:** 0\ **Last updated:** [July 4, 2019, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-wont-send-all-messages-to-kafka/188936 "2019-07-04T14:55:25Z")
Filebeat 7.2.0 Kafka 2.2.0 (apache, not confluent) Logstash 7.2.0 ElasticSearch 7.2.0 Kibana 7.2.0 The setup is: Filebeat -\> kafka -\> logstash -\> elasticsearch Filebeat (or is Logstash the problem?) will not sent A… --- ## [Creating New Beat based on MetricBeat](https://discuss.elastic.co/t/creating-new-beat-based-on-metricbeat/188887)
**Author:** [@purus](https://discuss.elastic.co/u/purus)\ **Replies:** 3\ **Last updated:** [July 4, 2019, 2:42pm UTC](https://discuss.elastic.co/t/creating-new-beat-based-on-metricbeat/188887 "2019-07-04T14:42:26Z")
When I run the below binary, after running "make setup" and "make": ./mybeat -e -d "\*" I get the below error Exiting: error loading config file: stat beat.yml: no such file or directory Why it's looking for beat.yml?… --- ## [Filebeat Java Regex](https://discuss.elastic.co/t/filebeat-java-regex/188923)
**Author:** [@fixxxera](https://discuss.elastic.co/u/fixxxera)\ **Replies:** 0\ **Last updated:** [July 4, 2019, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-java-regex/188923 "2019-07-04T13:54:57Z")
Hello guys, i am having trouble getting my multiline regex to match my java stack traces. Currently i am using ^(\[\\s\]{2,})+(at )|^Caused by:|^(\[\\s\]{3,})+(\[.\]{3,}) An example stacktrace: 2019-06-26 15:44:24,176 ht… --- ## [Controlling Filebeat Memory Usage](https://discuss.elastic.co/t/controlling-filebeat-memory-usage/188913)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [July 4, 2019, 12:45pm UTC](https://discuss.elastic.co/t/controlling-filebeat-memory-usage/188913 "2019-07-04T12:45:24Z")
Hi, Is there information on best practices for minimising the memory footprint of filebeat? Since installing it I've been seeing elasticsearch get oom-killed every few days on the VM it runs on. Regards, D --- ## [Error: setting 'filebeat.config.prospectors' has been removed after upgrade to 7.2](https://discuss.elastic.co/t/error-setting-filebeat-config-prospectors-has-been-removed-after-upgrade-to-7-2/188489)
**Author:** [@aleksei.saiko](https://discuss.elastic.co/u/aleksei.saiko)\ **Replies:** 2\ **Last updated:** [July 4, 2019, 11:48am UTC](https://discuss.elastic.co/t/error-setting-filebeat-config-prospectors-has-been-removed-after-upgrade-to-7-2/188489 "2019-07-04T11:48:58Z")
Hi there! I started to upgrade my ELK stack form 6.6.2 to 7.2.0. Changed accordingly Elastic and Kibana configs , but got stuck on Filebeat. After deploy to K8S, I receive this error error: setting 'filebeat.config.p… --- ## [Metricbeat couchbase module faced with "401 unauthorized error"](https://discuss.elastic.co/t/metricbeat-couchbase-module-faced-with-401-unauthorized-error/188308)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 2\ **Last updated:** [July 4, 2019, 9:09am UTC](https://discuss.elastic.co/t/metricbeat-couchbase-module-faced-with-401-unauthorized-error/188308 "2019-07-04T09:09:12Z")
hi all, I am going to use metricbeat in order to capture couchbase information. I have a cluster named as "Test1" and a Bucket named as " staging" on node "127.0.0.1" of couchbase. I enabled couchbase module, and couch… --- ## [Does setting close\_inactive to 0 means disable this option?](https://discuss.elastic.co/t/does-setting-close-inactive-to-0-means-disable-this-option/185779)
**Author:** [@biello](https://discuss.elastic.co/u/biello)\ **Replies:** 3\ **Last updated:** [June 27, 2019, 12:28pm UTC](https://discuss.elastic.co/t/does-setting-close-inactive-to-0-means-disable-this-option/185779 "2019-06-27T12:28:04Z")
I am confused about this because the docs doesn't make it clear... --- ## [Automating Metricbeats Installation](https://discuss.elastic.co/t/automating-metricbeats-installation/186387)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 2\ **Last updated:** [July 4, 2019, 6:24am UTC](https://discuss.elastic.co/t/automating-metricbeats-installation/186387 "2019-07-04T06:24:39Z")
Hi- I have got to install metricbeats on a several machines, which I was planning to do it using the Configuration Management tool, I have got stuck at while adding the security credentials to the keystore. Is there a w… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=338) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=340)