# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=418 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 419 --- ## [Getting Started (6.4) - problems](https://discuss.elastic.co/t/getting-started-6-4-problems/148877)
**Author:** [@PhilipPeake](https://discuss.elastic.co/u/PhilipPeake)\ **Replies:** 6\ **Last updated:** [September 19, 2018, 5:49pm UTC](https://discuss.elastic.co/t/getting-started-6-4-problems/148877 "2018-09-19T17:49:27Z")
Trying to follow the Getting Started tutorial for the 6.4 stack. I have followed the instructions as described, except that I configured and used yum for the install rather than download and install the rpm files by han… --- ## [Multiline Configuration / Java Stack Trace](https://discuss.elastic.co/t/multiline-configuration-java-stack-trace/149107)
**Author:** [@cschlaefcke](https://discuss.elastic.co/u/cschlaefcke)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 1:01pm UTC](https://discuss.elastic.co/t/multiline-configuration-java-stack-trace/149107 "2018-09-19T13:01:29Z")
Hi, I just started working with docker elk and also have filebeat for some docker containers up and running (almost). One of my docker container (JIRA) is creating multiline output (mainly java exceptions / stack traces… --- ## [Is it possible for filebeat to move logs to different servers](https://discuss.elastic.co/t/is-it-possible-for-filebeat-to-move-logs-to-different-servers/148493)
**Author:** [@suppandi](https://discuss.elastic.co/u/suppandi)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 10:53am UTC](https://discuss.elastic.co/t/is-it-possible-for-filebeat-to-move-logs-to-different-servers/148493 "2018-09-19T10:53:05Z")
I would like to have my filebeat in my k8s environment to push logs from a set of containers to a different elastic search cluster. So containers C1 and C2 goto es1 and C3 and C4 goto es2. The only way i could think of i… --- ## [Can't disable some metricsets](https://discuss.elastic.co/t/cant-disable-some-metricsets/149100)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 10:49am UTC](https://discuss.elastic.co/t/cant-disable-some-metricsets/149100 "2018-09-19T10:49:01Z")
Hi everybody, I'm running metricbeat agent v6.4.1 on a windows 7 enterprise SP1 . I want to gather some metricsets of the System module. So my conf is : metricbeat.modules: #------------------------------- System Mod… --- ## [ERR SSL client failed to connect with: dial tcp xxx.xxx.xx.xxx:5044: getsockopt: connection refused](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-dial-tcp-xxx-xxx-xx-xxx-getsockopt-connection-refused/148635)
**Author:** [@jyothi\_ca](https://discuss.elastic.co/u/jyothi_ca)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 10:39am UTC](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-dial-tcp-xxx-xxx-xx-xxx-getsockopt-connection-refused/148635 "2018-09-19T10:39:47Z")
Hi, We noticed above error message and logs are not getting shifted due to above error message we checked for connectivity issue , there is not issue of network connectivity --- ## [Metricbeat postgresql shows timeout error](https://discuss.elastic.co/t/metricbeat-postgresql-shows-timeout-error/149017)
**Author:** [@Abhimanyu\_Kaushal](https://discuss.elastic.co/u/Abhimanyu_Kaushal)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 10:32am UTC](https://discuss.elastic.co/t/metricbeat-postgresql-shows-timeout-error/149017 "2018-09-19T10:32:48Z")
Hi, I'm using metricbeat to monitor my postgres server. I've tried telnet and also able to successfully ping my postgres server. But metricbeat is showing this error message: "QueryStats: dial tcp \:5432: i/o ti… --- ## [Unable to send logstash files](https://discuss.elastic.co/t/unable-to-send-logstash-files/148873)
**Author:** [@quetiMPorta](https://discuss.elastic.co/u/quetiMPorta)\ **Replies:** 1\ **Last updated:** [September 19, 2018, 10:26am UTC](https://discuss.elastic.co/t/unable-to-send-logstash-files/148873 "2018-09-19T10:26:52Z")
I have filebeat running as a Windows Service and configured to use logstash to send files to logz.io (listener.logz.io). Based on the registry and filebeat.log, it appears that filebeat is able to detect new files to pr… --- ## [Arm build part of packaging but not in nightlies](https://discuss.elastic.co/t/arm-build-part-of-packaging-but-not-in-nightlies/148973)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 9:28am UTC](https://discuss.elastic.co/t/arm-build-part-of-packaging-but-not-in-nightlies/148973 "2018-09-19T09:28:36Z")
Hey folks, Speaking to @andrewkroh a little while ago ARM builds were added to the build process but they are still not showing up in the nightlies...any way I can get my hands on filebeat / metricbeat / packetbeat for… --- ## [Filebeat - IIS Module - No geopoint](https://discuss.elastic.co/t/filebeat-iis-module-no-geopoint/149000)
**Author:** [@Mudasar\_Ellahi](https://discuss.elastic.co/u/Mudasar_Ellahi)\ **Replies:** 4\ **Last updated:** [September 19, 2018, 6:09am UTC](https://discuss.elastic.co/t/filebeat-iis-module-no-geopoint/149000 "2018-09-19T06:09:49Z")
Hi everyone, I am trying to send IIS logs of one server to elasticsearch for which I am using Filebeat IIS module. I am able to send IIS logs to elasticsearch directly only problem is Index mapping, I have location fie… --- ## [Not getting logs from filebeat client](https://discuss.elastic.co/t/not-getting-logs-from-filebeat-client/148922)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 2\ **Last updated:** [September 19, 2018, 5:37am UTC](https://discuss.elastic.co/t/not-getting-logs-from-filebeat-client/148922 "2018-09-19T05:37:06Z")
Dear Team, I am testing elk with filebeat for logs, I have setup kiban 6.3.2, es 6.3.2 and filebeat 6.3.2, I have 4 filebeat client machine 3 is sending logs but one machine is not sending logs last 12 hours, I am not u… --- ## [No data MySQL dashboard - version mismatch?](https://discuss.elastic.co/t/no-data-mysql-dashboard-version-mismatch/146480)
**Author:** [@ron\_e\_e](https://discuss.elastic.co/u/ron_e_e)\ **Replies:** 24\ **Last updated:** [September 18, 2018, 11:10pm UTC](https://discuss.elastic.co/t/no-data-mysql-dashboard-version-mismatch/146480 "2018-09-18T23:10:06Z")
Hello, Somehow we ended up with a slightly newer version of metricbeats vs everything else. We are running on Centos 7, version 6.3.1 while metricbeats is 6.3.2, we do see some data such as system metrics but after conf… --- ## [Filebeat: Exiting: Can only start an input when all related states are finished](https://discuss.elastic.co/t/filebeat-exiting-can-only-start-an-input-when-all-related-states-are-finished/147692)
**Author:** [@przemolb](https://discuss.elastic.co/u/przemolb)\ **Replies:** 19\ **Last updated:** [September 18, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-exiting-can-only-start-an-input-when-all-related-states-are-finished/147692 "2018-09-18T16:57:10Z")
Hello, my filebeat 6.2.4 had been running for quite a long. Yesterday I had to restart it and it turned out it is bouncing every couple of seconds with the following message: Sep 07 09:42:02 jira filebeat\[93968\]: Exiti… --- ## [Beats for AWS VPC Flow](https://discuss.elastic.co/t/beats-for-aws-vpc-flow/148886)
**Author:** [@ashishlal](https://discuss.elastic.co/u/ashishlal)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 4:10pm UTC](https://discuss.elastic.co/t/beats-for-aws-vpc-flow/148886 "2018-09-18T16:10:39Z")
Hello All, I am new to elastic and was wondering which Beats agent can be used in pulling the logs from AWS VPC Flow. --- ## [About filebeat test modules feature](https://discuss.elastic.co/t/about-filebeat-test-modules-feature/148901)
**Author:** [@jerrywang1974](https://discuss.elastic.co/u/jerrywang1974)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 3:25pm UTC](https://discuss.elastic.co/t/about-filebeat-test-modules-feature/148901 "2018-09-18T15:25:03Z")
Hi, I'd like to inquiry does it possible to have the feature about filebeat to have test modules feature like metricbeat same feature? I feel metricbeat test modules is good for testing the modules working well, but fi… --- ## [General architectural question re beats & ES](https://discuss.elastic.co/t/general-architectural-question-re-beats-es/147702)
**Author:** [@robs](https://discuss.elastic.co/u/robs)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 3:14pm UTC](https://discuss.elastic.co/t/general-architectural-question-re-beats-es/147702 "2018-09-18T15:14:07Z")
Hi all, I'm going to have to monitor several remote domains consisting of Windows and Linux servers. I want to run beats on all of them. Is there a simple way of concentrating all beats output into one system inside suc… --- ## [How to parse field named "host" (or any other field which is reserved by filebeat) in JSON structured log?](https://discuss.elastic.co/t/how-to-parse-field-named-host-or-any-other-field-which-is-reserved-by-filebeat-in-json-structured-log/148331)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [September 18, 2018, 2:53pm UTC](https://discuss.elastic.co/t/how-to-parse-field-named-host-or-any-other-field-which-is-reserved-by-filebeat-in-json-structured-log/148331 "2018-09-18T14:53:30Z")
Hi, I am trying to publish messages into Kafka using filebeat 6.3.0. My log files has single line, JSON structured logs, like; {"f1":"data1","host":"server1","timestamp":"2018-09-10T12:33:15.878+0000","f2":"data2","f3"… --- ## [Filebeat's Multiline not grouping properly](https://discuss.elastic.co/t/filebeats-multiline-not-grouping-properly/148711)
**Author:** [@kellen.hopwood](https://discuss.elastic.co/u/kellen.hopwood)\ **Replies:** 5\ **Last updated:** [September 18, 2018, 2:35pm UTC](https://discuss.elastic.co/t/filebeats-multiline-not-grouping-properly/148711 "2018-09-18T14:35:18Z")
Hi All, I am using filebeats to try and pull from a text file that contains http logs, the logs are generally not uniform, so I used powershell to create an end of file marker. However when I then try and send the logs … --- ## [Virtual bytes wrong counter in metricbeat](https://discuss.elastic.co/t/virtual-bytes-wrong-counter-in-metricbeat/148636)
**Author:** [@noskills](https://discuss.elastic.co/u/noskills)\ **Replies:** 5\ **Last updated:** [September 18, 2018, 1:20pm UTC](https://discuss.elastic.co/t/virtual-bytes-wrong-counter-in-metricbeat/148636 "2018-09-18T13:20:52Z")
I use perfmon to check Virtual Bytes for a process currently but we are trying to metricbeat to push the information elsewhere. The Virtual Bytes in metricbeat never matches even close to what is shown by perfmon or PS … --- ## [Cross compile metricbeat for FreeBSD](https://discuss.elastic.co/t/cross-compile-metricbeat-for-freebsd/148543)
**Author:** [@Peek](https://discuss.elastic.co/u/Peek)\ **Replies:** 2\ **Last updated:** [September 14, 2018, 4:27pm UTC](https://discuss.elastic.co/t/cross-compile-metricbeat-for-freebsd/148543 "2018-09-14T16:27:35Z")
Trying to cross-compile metricbeat 6.4.0 for FreeBSD 11.1-amd64 via Debian-9.5.0-amd64, yet stuck at gosigar vomitting: github.com/elastic/beats/vendor/github.com/elastic/gosigar ../vendor/github.com/elastic/gosigar/co… --- ## [Metricbeat Index Size Recommendation](https://discuss.elastic.co/t/metricbeat-index-size-recommendation/148916)
**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 5:30am UTC](https://discuss.elastic.co/t/metricbeat-index-size-recommendation/148916 "2018-09-18T05:30:31Z")
Hi, In our setup, Metricbeat (6.2.4) index is growing day by day - it has reached to ~200GB per day. I got some idea from somehwhere that efficient size of single index should be less than 50G. Could someone please shar… --- ## [How to create dashboard for tomcat using metricbeat?](https://discuss.elastic.co/t/how-to-create-dashboard-for-tomcat-using-metricbeat/148812)
**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\ **Replies:** 2\ **Last updated:** [September 18, 2018, 5:24am UTC](https://discuss.elastic.co/t/how-to-create-dashboard-for-tomcat-using-metricbeat/148812 "2018-09-18T05:24:14Z")
Dear Team, We have lots of module web-server like Apache, nginx and more but i am looking for tomcat and i want to view Tomcat up-time, CPU, JVM memory, Threads Status, online number of connection, how this is possible … --- ## [Metricbeat does not write data to elasticsearch](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [September 12, 2018, 4:32am UTC](https://discuss.elastic.co/t/metricbeat-does-not-write-data-to-elasticsearch/147488 "2018-09-12T04:32:24Z")
Hello, I have a newly installed metricbeat with the latest version elasticsearch upgraded to the latest version. I started metricbeat I can see in the logs that it's gathering data however the data is not loaded into el… --- ## [Central centos 7 logging server](https://discuss.elastic.co/t/central-centos-7-logging-server/148308)
**Author:** [@UnNis](https://discuss.elastic.co/u/UnNis)\ **Replies:** 8\ **Last updated:** [September 17, 2018, 5:43pm UTC](https://discuss.elastic.co/t/central-centos-7-logging-server/148308 "2018-09-17T17:43:16Z")
I have filebeat installed on all clients which send log files to my central logging server. On the central server I have kibanna, logstash and filebeat installed. The other day I ran out of space. This server is a vm … --- ## [Just cannot have filebeat ouput right!](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849)
**Author:** [@pastorsx](https://discuss.elastic.co/u/pastorsx)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 4:47pm UTC](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849 "2018-09-17T16:47:07Z")
I am trying to use something that should be straightforward: beat -\> logstash -\> elasticsearch -\> kibana. Few config parameters and I believe it should be fine... but hwres' the catch... I just can't get my beat to for… --- ## [Metricbeat default index template causes "No matching token for number\_type \[BIG\_INTEGER\]"](https://discuss.elastic.co/t/metricbeat-default-index-template-causes-no-matching-token-for-number-type-big-integer/148370)
**Author:** [@wes](https://discuss.elastic.co/u/wes)\ **Replies:** 5\ **Last updated:** [September 17, 2018, 4:44pm UTC](https://discuss.elastic.co/t/metricbeat-default-index-template-causes-no-matching-token-for-number-type-big-integer/148370 "2018-09-17T16:44:30Z")
Hi there, I've posted about this issue in the past and never received any suggestions. I finally got around to looking at it again and was able to figure out a little more this time, so I'm hoping someone will be able t… --- ## [CPU usage \[Metricbeat Apache\] No apache.status.cpu.load](https://discuss.elastic.co/t/cpu-usage-metricbeat-apache-no-apache-status-cpu-load/148474)
**Author:** [@txivo83](https://discuss.elastic.co/u/txivo83)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 4:27pm UTC](https://discuss.elastic.co/t/cpu-usage-metricbeat-apache-no-apache-status-cpu-load/148474 "2018-09-17T16:27:38Z")
Hi community. I'm trying to get all metrics of my apache through metricbeat but I'm not getting apace.status.cpu.\* metrics I've been googling about this possible issue, but I've not find any information. Does any one g… --- ## [Postgresql grpk pattern error fb 6.4](https://discuss.elastic.co/t/postgresql-grpk-pattern-error-fb-6-4/148670)
**Author:** [@bhansen](https://discuss.elastic.co/u/bhansen)\ **Replies:** 2\ **Last updated:** [September 17, 2018, 3:09pm UTC](https://discuss.elastic.co/t/postgresql-grpk-pattern-error-fb-6-4/148670 "2018-09-17T15:09:37Z")
Hello, I am using filebeat 6.4 with the postgresql module installed and pointed at my pg\_log folder, and it is shipping the logs but I am getting a GROK parse error the system is centos 7 installed with the filebeat 6.… --- ## [Filebeat not indetifying multiple line logs](https://discuss.elastic.co/t/filebeat-not-indetifying-multiple-line-logs/148661)
**Author:** [@Nelson\_Ferreira\_Juni](https://discuss.elastic.co/u/Nelson_Ferreira_Juni)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-not-indetifying-multiple-line-logs/148661 "2018-09-17T13:31:18Z")
I have some springboot logs that start like this: 2018-09-11 09:18:42.968 INFO 12036 --- And I created a pattern in the filebeat.yml file to consider multiple line logs as part of the previous line like this: #====… --- ## [About @timestamp](https://discuss.elastic.co/t/about-timestamp/148799)
**Author:** [@liwenlin](https://discuss.elastic.co/u/liwenlin)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 9:25am UTC](https://discuss.elastic.co/t/about-timestamp/148799 "2018-09-17T09:25:28Z")
the default @timestamp format is UTC format (yyyy-MM-dd'T'HH:mm:ss.SSS'Z'), such as 2018-09-17T08:28:49.883Z , how to set it as GMT format (yyyy-MM-dd HH:mm:ss) ? thank you My data result example "\_source": { "@tim… --- ## [Auditbeat installation replaces custom config with example](https://discuss.elastic.co/t/auditbeat-installation-replaces-custom-config-with-example/148601)
**Author:** [@antwan](https://discuss.elastic.co/u/antwan)\ **Replies:** 2\ **Last updated:** [September 14, 2018, 3:38pm UTC](https://discuss.elastic.co/t/auditbeat-installation-replaces-custom-config-with-example/148601 "2018-09-14T15:38:40Z")
On CentOS 6, using beats 6.4.0, I create custom configs in /etc/"beat"/"beat".yml. After deploying Filebeat and Packetbeat I end up with "beat".yml.rpmnew, and they work as intended. But with Auditbeat, I end up with t… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=417) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=419)