# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=394 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 395 --- ## [Auditbeat identifying directories as files](https://discuss.elastic.co/t/auditbeat-identifying-directories-as-files/161834)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 0\ **Last updated:** [December 21, 2018, 11:26am UTC](https://discuss.elastic.co/t/auditbeat-identifying-directories-as-files/161834 "2018-12-21T11:26:18Z")
Hi, Running Auditbeat 6.4.2 and monitoring a directory. I can see when someone is navigating through a directory tree so for file.path I get /PTC/mq/code /PTC/mq/code/4Q2018 /PTC/mq/code/4Q2018/scan /PTC/mq/code/4Q2… --- ## [Excuse me, how does filebeat add custom fields, random uuid?](https://discuss.elastic.co/t/excuse-me-how-does-filebeat-add-custom-fields-random-uuid/161722)
**Author:** [@xuyangxy](https://discuss.elastic.co/u/xuyangxy)\ **Replies:** 5\ **Last updated:** [December 21, 2018, 10:08am UTC](https://discuss.elastic.co/t/excuse-me-how-does-filebeat-add-custom-fields-random-uuid/161722 "2018-12-21T10:08:48Z")
Excuse me, how does filebeat add custom fields, random uuid? --- ## [Filebeat memory usage](https://discuss.elastic.co/t/filebeat-memory-usage/160883)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 9:56am UTC](https://discuss.elastic.co/t/filebeat-memory-usage/160883 "2018-12-21T09:56:01Z")
I've seen a number of threads on this but none that seem to give any diagnosis or recommendations. We are running Filebeat (various 6.x versions) in Kubernetes, and it seems that whatever memory limit we set the pods ev… --- ## [Array support in http/json metricset doesn't handle simple String Arrays](https://discuss.elastic.co/t/array-support-in-http-json-metricset-doesnt-handle-simple-string-arrays/161342)
**Author:** [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Replies:** 4\ **Last updated:** [December 21, 2018, 9:16am UTC](https://discuss.elastic.co/t/array-support-in-http-json-metricset-doesnt-handle-simple-string-arrays/161342 "2018-12-21T09:16:05Z")
We are currently trying to pull data from an application that exposes a list of connected systems as a REST endpoint, returning a simple String array. So when I call http://example.com/rest/connectedSystems/ it returns \[… --- ## [Filebeat-6.5.1 Registry is Never Cleaned](https://discuss.elastic.co/t/filebeat-6-5-1-registry-is-never-cleaned/160861)
**Author:** [@396175371](https://discuss.elastic.co/u/396175371)\ **Replies:** 3\ **Last updated:** [December 21, 2018, 8:31am UTC](https://discuss.elastic.co/t/filebeat-6-5-1-registry-is-never-cleaned/160861 "2018-12-21T08:31:52Z")
Filebeat 6.5.1, Red Hat 4.4.7 my filebeat can not clean up registry, Here is the my config: filebeat.inputs: - type: log enabled: true paths: - /vol/\*.log encoding: utf-8 exclude\_files: \['.\*gc.log$'\] mul… --- ## [How to get metrics using jolokia module?](https://discuss.elastic.co/t/how-to-get-metrics-using-jolokia-module/158349)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 6:20am UTC](https://discuss.elastic.co/t/how-to-get-metrics-using-jolokia-module/158349 "2018-12-21T06:20:22Z")
I want to get some metrics from an application that is run using tomcat. I've configured jolokia module as follows: - module: jolokia metricsets: \["jmx"\] enabled: true period: 5s fields: app: jmx hosts: \["… --- ## [Inactive and Rolling files](https://discuss.elastic.co/t/inactive-and-rolling-files/161398)
**Author:** [@mickt](https://discuss.elastic.co/u/mickt)\ **Replies:** 1\ **Last updated:** [December 20, 2018, 11:01pm UTC](https://discuss.elastic.co/t/inactive-and-rolling-files/161398 "2018-12-20T23:01:18Z")
Hi, I have a question regarding the close\_inactive status and rolling files configuration of Filebeat. I currently have Filebeat shipping some apache logs. Apache Log entries can come in every 2 seconds as well as eve… --- ## [Geoip location not working - missing nginx.access.geoip.location](https://discuss.elastic.co/t/geoip-location-not-working-missing-nginx-access-geoip-location/161723)
**Author:** [@c257dd0a514ccc788ecc](https://discuss.elastic.co/u/c257dd0a514ccc788ecc)\ **Replies:** 2\ **Last updated:** [December 20, 2018, 7:09pm UTC](https://discuss.elastic.co/t/geoip-location-not-working-missing-nginx-access-geoip-location/161723 "2018-12-20T19:09:28Z")
Hi. ELK stack version 6.5.4. I deployed a new server with nginx and I use Filebeat to send nginx logs the the elasticsearch cluster. I added the pluggin nginx and imported the dashboard (filebeat setup -e). The problem I… --- ## [Filebeat exclude lines with multiline](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/161705)
**Author:** [@swright-eti](https://discuss.elastic.co/u/swright-eti)\ **Replies:** 2\ **Last updated:** [December 20, 2018, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-with-multiline/161705 "2018-12-20T18:17:04Z")
I can only seem to get exlude\_lines to work, if multiline is not enabled. I suspect that this due to the order in which these directives are processed. My guess is that the multiline is processed first, which would then … --- ## [Creating beat from Metricbeat](https://discuss.elastic.co/t/creating-beat-from-metricbeat/160586)
**Author:** [@fdmsantos](https://discuss.elastic.co/u/fdmsantos)\ **Replies:** 5\ **Last updated:** [December 20, 2018, 5:57pm UTC](https://discuss.elastic.co/t/creating-beat-from-metricbeat/160586 "2018-12-20T17:57:43Z")
Hello, I'm trying to create a beat based on Metricbeat. I have followed the steps described in https://www.elastic.co/guide/en/beats/devguide/current/creating-beat-from-metricbeat.html#creating-beat-from-metricbeat. A… --- ## [The request for this panel failed. The aggregations key is missing](https://discuss.elastic.co/t/the-request-for-this-panel-failed-the-aggregations-key-is-missing/159575)
**Author:** [@ggoodenough](https://discuss.elastic.co/u/ggoodenough)\ **Replies:** 9\ **Last updated:** [December 14, 2018, 6:14pm UTC](https://discuss.elastic.co/t/the-request-for-this-panel-failed-the-aggregations-key-is-missing/159575 "2018-12-14T18:14:55Z")
So I'm running into this problem that a few others on this board have had problems with in the past. I'm somewhat confused about the problem so maybe someone could spend a minute or two to help understand the issue or po… --- ## [Host Overview's System Navigation of CPU Usage Gauge is 0](https://discuss.elastic.co/t/host-overviews-system-navigation-of-cpu-usage-gauge-is-0/161451)
**Author:** [@lujiao](https://discuss.elastic.co/u/lujiao)\ **Replies:** 2\ **Last updated:** [December 20, 2018, 2:35am UTC](https://discuss.elastic.co/t/host-overviews-system-navigation-of-cpu-usage-gauge-is-0/161451 "2018-12-20T02:35:15Z")
Dear all I use metricbeat to collect metrics from my system,but in Kibana's Dashboard,all the metric of Host Overview's System Navigation is zero,include CPU Usage Gange,Memory Usage,Disk and so on,the in fact,they are … --- ## [How to create separate dashboard for 3 different hard disk mounted in single machine?](https://discuss.elastic.co/t/how-to-create-separate-dashboard-for-3-different-hard-disk-mounted-in-single-machine/160991)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 3\ **Last updated:** [December 19, 2018, 6:18pm UTC](https://discuss.elastic.co/t/how-to-create-separate-dashboard-for-3-different-hard-disk-mounted-in-single-machine/160991 "2018-12-19T18:18:44Z")
Dear Team, I have mounted, 3 hard disks in one single machine, I have created a graph when I have single SSD in the system and now I have 3 SSD in my single machine, but issue that I am getting total disk space in one g… --- ## [Incorrect HTTP method for uri /\_template/ and method PUT, allowed: GET (404)](https://discuss.elastic.co/t/incorrect-http-method-for-uri-template-and-method-put-allowed-get-404/161559)
**Author:** [@tlacuache](https://discuss.elastic.co/u/tlacuache)\ **Replies:** 3\ **Last updated:** [December 19, 2018, 5:57pm UTC](https://discuss.elastic.co/t/incorrect-http-method-for-uri-template-and-method-put-allowed-get-404/161559 "2018-12-19T17:57:49Z")
I'm having an issue getting a custom beat to load the template into elasticsearch. Here is the section from my beat's config file: setup.template.enabled: true setup.template.name: "foobarbeat-%{\[beat.version\]}" setup.… --- ## [Filebeat multiline assistance](https://discuss.elastic.co/t/filebeat-multiline-assistance/160779)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 3\ **Last updated:** [December 19, 2018, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-multiline-assistance/160779 "2018-12-19T17:07:51Z")
Hello, I am hoping someone might be able to provide some assistance with a Filebeat multiline issue I can't seem to resolve. One server is running Novell Storage Services Auditing Client Logger (VLOG). Filebeat is insta… --- ## [Central Management (Beta)](https://discuss.elastic.co/t/central-management-beta/160413)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [December 11, 2018, 7:45pm UTC](https://discuss.elastic.co/t/central-management-beta/160413 "2018-12-11T19:45:23Z")
I'm trying out Enroll Beat feature, yet when I issue following command, I get error:: # filebeat enroll https://k.X.com 91595fa7b82f421a9a9b9e0defaea9fe Error while enrolling: fail to execute the HTTP POST request: Post… --- ## [Config files](https://discuss.elastic.co/t/config-files/161368)
**Author:** [@LevavasseurYann](https://discuss.elastic.co/u/LevavasseurYann)\ **Replies:** 3\ **Last updated:** [December 19, 2018, 5:03pm UTC](https://discuss.elastic.co/t/config-files/161368 "2018-12-19T17:03:14Z")
Required informations Beat version: 6.4.3 Operating System: Debian9, Docker Configuration: The issue itslef Description I'm using Metricbeat with Docker module and Vsphere module to feed an Elasticsearch and read the m… --- ## [Jolokia in metricbeat](https://discuss.elastic.co/t/jolokia-in-metricbeat/160869)
**Author:** [@Nikhil\_Singh1](https://discuss.elastic.co/u/Nikhil_Singh1)\ **Replies:** 1\ **Last updated:** [December 19, 2018, 4:58pm UTC](https://discuss.elastic.co/t/jolokia-in-metricbeat/160869 "2018-12-19T16:58:51Z")
I have copied jolokia-war-1.6.0.war in Tomcat 7 and in metricbeat modules.d when I try to change jolokia.yml and restart metricbeat it stops is there anything that I miss --- ## [Decode\_json\_fields and when.not, not working as expected](https://discuss.elastic.co/t/decode-json-fields-and-when-not-not-working-as-expected/161355)
**Author:** [@Kody\_Peterson](https://discuss.elastic.co/u/Kody_Peterson)\ **Replies:** 1\ **Last updated:** [December 19, 2018, 3:16pm UTC](https://discuss.elastic.co/t/decode-json-fields-and-when-not-not-working-as-expected/161355 "2018-12-19T15:16:46Z")
I have the following simple when.not I am using for testing: processors: - decode\_json\_fields: when.not: or: - equals.input.type: "docker" fields: \["log"\] … --- ## [Filebeat IIS module : high CPU consumption?](https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541)
**Author:** [@Hellong](https://discuss.elastic.co/u/Hellong)\ **Replies:** 0\ **Last updated:** [December 19, 2018, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-high-cpu-consumption/161541 "2018-12-19T14:37:37Z")
Hi, I use Filebeat with the IIS module to send logs to a distant Logstash, with the following configuration : Filebeat.yml filebeat.config.modules: path: ${path.config}/modules.d/\*.yml # filebeat.inputs: # other in… --- ## [Filebeat+CSV](https://discuss.elastic.co/t/filebeat-csv/161192)
**Author:** [@Aralex](https://discuss.elastic.co/u/Aralex)\ **Replies:** 3\ **Last updated:** [December 19, 2018, 1:15pm UTC](https://discuss.elastic.co/t/filebeat-csv/161192 "2018-12-19T13:15:45Z")
Hi, I'm quite frustrated as how to handle things. Documentation is quite confusing since there are few ways to do things in detail but no sufficient overview. Alright, so here are my questions. I would highly appreciat… --- ## [Speed up filebeat registrar](https://discuss.elastic.co/t/speed-up-filebeat-registrar/160873)
**Author:** [@s1p](https://discuss.elastic.co/u/s1p)\ **Replies:** 2\ **Last updated:** [December 19, 2018, 8:39am UTC](https://discuss.elastic.co/t/speed-up-filebeat-registrar/160873 "2018-12-19T08:39:55Z")
I'm searching through 200000 files on a server (24 logical cores, 48GB RAM) and want to collect logs only for the previous 24 hours: My filebeat.ymlfilebeat.inputs: - type: log enabled: true paths: - '/data/… --- ## [How to check filebeat have read all files or not?](https://discuss.elastic.co/t/how-to-check-filebeat-have-read-all-files-or-not/161455)
**Author:** [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Replies:** 0\ **Last updated:** [December 19, 2018, 6:55am UTC](https://discuss.elastic.co/t/how-to-check-filebeat-have-read-all-files-or-not/161455 "2018-12-19T06:55:02Z")
Filebeat is reading all files or not? how many files filebeat can read? --- ## [Unable to configure Redis password topology in filebeat due to lack of documentation](https://discuss.elastic.co/t/unable-to-configure-redis-password-topology-in-filebeat-due-to-lack-of-documentation/161449)
**Author:** [@Debashis](https://discuss.elastic.co/u/Debashis)\ **Replies:** 0\ **Last updated:** [December 19, 2018, 6:17am UTC](https://discuss.elastic.co/t/unable-to-configure-redis-password-topology-in-filebeat-due-to-lack-of-documentation/161449 "2018-12-19T06:17:40Z")
Hi, I want to verify the "password\_topology" with "password" parameter in filebeat-5.4.3. But due to lack of documentation I can't understand the password topology. Can anyone guide me to understand the Redis password … --- ## [Filebeat reship all file when it is modified](https://discuss.elastic.co/t/filebeat-reship-all-file-when-it-is-modified/161343)
**Author:** [@Zool](https://discuss.elastic.co/u/Zool)\ **Replies:** 1\ **Last updated:** [December 19, 2018, 6:14am UTC](https://discuss.elastic.co/t/filebeat-reship-all-file-when-it-is-modified/161343 "2018-12-19T06:14:30Z")
Hello, I am using Filebeat 5.1.1 and I have questions regarding its configuration. The log file I want to ship is particular: Each time the batch runs, the log file is regenerated with the same file name and I need to… --- ## [Filebeat kubernetes autodiscover Multiple conditions](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscover-multiple-conditions/161145)
**Author:** [@icoolchn](https://discuss.elastic.co/u/icoolchn)\ **Replies:** 2\ **Last updated:** [December 19, 2018, 3:06am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscover-multiple-conditions/161145 "2018-12-19T03:06:07Z")
The problem is When the condition has “kubernetes.labels.log-index” ，fields:log\_topic: 'labels-{data.kubernetes.labels.log-index}', otherwise fields: log\_topic: 'aip-{data.kubernetes.namespace}-${data.kubernetes.pod.na… --- ## [Metricbeat can not connect to elastic](https://discuss.elastic.co/t/metricbeat-can-not-connect-to-elastic/160487)
**Author:** [@lujiao](https://discuss.elastic.co/u/lujiao)\ **Replies:** 2\ **Last updated:** [December 19, 2018, 1:57am UTC](https://discuss.elastic.co/t/metricbeat-can-not-connect-to-elastic/160487 "2018-12-19T01:57:03Z")
Hello I have install elasticsearch and metricbeat,I have config metricbeat’s output to elastic,but when setup meticbeat, it’s connect to elasticsearch was refused,the Errors is shown below: Exiting: Couldn’t connect t… --- ## [If the machine is down, filebeat cannot automatically rebalance](https://discuss.elastic.co/t/if-the-machine-is-down-filebeat-cannot-automatically-rebalance/161428)
**Author:** [@kimileonis](https://discuss.elastic.co/u/kimileonis)\ **Replies:** 0\ **Last updated:** [December 19, 2018, 1:26am UTC](https://discuss.elastic.co/t/if-the-machine-is-down-filebeat-cannot-automatically-rebalance/161428 "2018-12-19T01:26:29Z")
If the machine is down, filebeat cannot automatically rebalance --- ## [Fields\_under\_root = true is displayed in kibana](https://discuss.elastic.co/t/fields-under-root-true-is-displayed-in-kibana/161426)
**Author:** [@mikkel](https://discuss.elastic.co/u/mikkel)\ **Replies:** 0\ **Last updated:** [December 19, 2018, 12:38am UTC](https://discuss.elastic.co/t/fields-under-root-true-is-displayed-in-kibana/161426 "2018-12-19T00:38:09Z")
I have a filebeat yaml like: filebeat.inputs: - type: log enabled: true paths: - /var/log/containers/App/\*.log multiline.pattern: '^\\\[' multiline.negate: true … --- ## [Community beats and keystore?](https://discuss.elastic.co/t/community-beats-and-keystore/161367)
**Author:** [@tlacuache](https://discuss.elastic.co/u/tlacuache)\ **Replies:** 0\ **Last updated:** [December 18, 2018, 4:07pm UTC](https://discuss.elastic.co/t/community-beats-and-keystore/161367 "2018-12-18T16:07:31Z")
Are community beats able to create/use password keystores in the same way as filebeat, metricbeat, auditbeat, etc.? I've tried using the same pattern to create/populate a keystore with a community beat called protologbe… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=393) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=395)