# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=424 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 425 --- ## [Multiple Filebeat.yml for achieving different tasks](https://discuss.elastic.co/t/multiple-filebeat-yml-for-achieving-different-tasks/146573)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 3\ **Last updated:** [August 29, 2018, 10:37pm UTC](https://discuss.elastic.co/t/multiple-filebeat-yml-for-achieving-different-tasks/146573 "2018-08-29T22:37:36Z")
Suppose I have two different task to fulfill using filebeat. Is there any issues to make two different filebeat.yml for two different tasks? Its much cleaner and keeps the code separate. --- ## [Docker Filebeat can't connect to Docker ELK's http://logstash:5044 but can connect to http://logstash:9600](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-elks-http-logstash-5044-but-can-connect-to-http-logstash-9600/146556)
**Author:** [@shirakaba](https://discuss.elastic.co/u/shirakaba)\ **Replies:** 5\ **Last updated:** [August 29, 2018, 7:30pm UTC](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-elks-http-logstash-5044-but-can-connect-to-http-logstash-9600/146556 "2018-08-29T19:30:45Z")
This is a continuation of my thread from yesterday: Docker Filebeat can’t connect to Docker bridge network despite ELK being able to. Now I'm trying to send logs from Filebeat to Logstash, rather than directly to Elasti… --- ## [Metricbeat failing to import templates on Windows](https://discuss.elastic.co/t/metricbeat-failing-to-import-templates-on-windows/146529)
**Author:** [@mrsalmon](https://discuss.elastic.co/u/mrsalmon)\ **Replies:** 1\ **Last updated:** [August 29, 2018, 3:12pm UTC](https://discuss.elastic.co/t/metricbeat-failing-to-import-templates-on-windows/146529 "2018-08-29T15:12:18Z")
I'm new to the ELK stack and have killed a couple of hours trawling the forums trying to resolve an issue I am having. I have followed this guide: https://www.elastic.co/guide/en/elastic-stack-overview/current/get-start… --- ## [Winlogbeat template issue](https://discuss.elastic.co/t/winlogbeat-template-issue/146521)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [August 29, 2018, 1:16pm UTC](https://discuss.elastic.co/t/winlogbeat-template-issue/146521 "2018-08-29T13:16:46Z")
Hello, we've just upgraded to winlogbeat 6.3.2 and I have uploaded the template and made the necessary change to the beats output in Logstash. I can see events in Kibana but the host field is showing incorrectly, instea… --- ## [Filebeat breaking up docker log lines](https://discuss.elastic.co/t/filebeat-breaking-up-docker-log-lines/146420)
**Author:** [@btieman](https://discuss.elastic.co/u/btieman)\ **Replies:** 2\ **Last updated:** [August 29, 2018, 1:09pm UTC](https://discuss.elastic.co/t/filebeat-breaking-up-docker-log-lines/146420 "2018-08-29T13:09:02Z")
I'm using filebeat 6.3 to read docker log files with the default docker json-file driver. Lines over 16kb in size are being reported by filebeat as 2 seperate log events. The symptoms look like the situation the combin… --- ## [Kubernetes metadata labels are not sent](https://discuss.elastic.co/t/kubernetes-metadata-labels-are-not-sent/146400)
**Author:** [@maligos](https://discuss.elastic.co/u/maligos)\ **Replies:** 3\ **Last updated:** [August 29, 2018, 10:16am UTC](https://discuss.elastic.co/t/kubernetes-metadata-labels-are-not-sent/146400 "2018-08-29T10:16:05Z")
Hello everyone! Could you help me guys? My Filebeat doesn’t attach Kubernetes metadata. I don’t know why, it looks very strange because log contain normal Kubernetes activity without any errors. My setup: Kubernetes … --- ## [Docker Filebeat can't connect to Docker bridge network despite ELK being able to](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-bridge-network-despite-elk-being-able-to/146408)
**Author:** [@shirakaba](https://discuss.elastic.co/u/shirakaba)\ **Replies:** 2\ **Last updated:** [August 29, 2018, 8:57am UTC](https://discuss.elastic.co/t/docker-filebeat-cant-connect-to-docker-bridge-network-despite-elk-being-able-to/146408 "2018-08-29T08:57:08Z")
My setup I'm using a slight modification\* of the master branch of docker-elk via Docker for Ubuntu 16.04 v18.06.1-ce. The docker-elk repo is currently based on the Elastic stack v6.3.2, and specifically uses the followi… --- ## [Add\_kubernetes\_metadata + rename = disappearing field?](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 26\ **Last updated:** [August 29, 2018, 7:52am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160 "2018-08-29T07:52:18Z")
Hi, I have a very strange issue I can't pinpoint. add\_kubernetes\_metadata works - I see the fields rename works - I can rename fields BUT, I can't rename the kubernetes fields. I added the -d \* switch to filebeat to … --- ## [Filebeat monitor nginx 1 record, send ２ records data to elasticsearch, one json format good, the other bad](https://discuss.elastic.co/t/filebeat-monitor-nginx-1-record-send-records-data-to-elasticsearch-one-json-format-good-the-other-bad/146383)
**Author:** [@tomoncle](https://discuss.elastic.co/u/tomoncle)\ **Replies:** 2\ **Last updated:** [August 29, 2018, 2:38am UTC](https://discuss.elastic.co/t/filebeat-monitor-nginx-1-record-send-records-data-to-elasticsearch-one-json-format-good-the-other-bad/146383 "2018-08-29T02:38:53Z")
filebeat Version: filebeat version 6.4.0 (amd64), libbeat 6.4.0 Operating System: centos 7 filebeat.yaml filebeat.inputs: - type: log enabled: true paths: - /var/log/nginx/\*.log filebeat.config.modules: p… --- ## [Auditbeat genealogy](https://discuss.elastic.co/t/auditbeat-genealogy/146003)
**Author:** [@0b501373](https://discuss.elastic.co/u/0b501373)\ **Replies:** 1\ **Last updated:** [August 28, 2018, 11:43pm UTC](https://discuss.elastic.co/t/auditbeat-genealogy/146003 "2018-08-28T23:43:07Z")
Hoping you might have some thoughts on if its possible to track the relationships between files? Eg convert a.jpg b.jpg. I would like to know that b.jpg was created from a.jpg. Wondering if there is some magic on the … --- ## [Filebeat Log Error](https://discuss.elastic.co/t/filebeat-log-error/146217)
**Author:** [@robegome](https://discuss.elastic.co/u/robegome)\ **Replies:** 7\ **Last updated:** [August 28, 2018, 9:45pm UTC](https://discuss.elastic.co/t/filebeat-log-error/146217 "2018-08-28T21:45:43Z")
Hello everyone! I have an error with Filebeat... checking /var/log/filebeat/filebeat , I am seeing this error: 2018-08-27T17:37:09.165Z INFO instance/beat.go:273 Setup Beat: filebeat; Version: 6.4.0 2018… --- ## [Multiple Filebeat inputs with logstash output](https://discuss.elastic.co/t/multiple-filebeat-inputs-with-logstash-output/146343)
**Author:** [@ramesh87](https://discuss.elastic.co/u/ramesh87)\ **Replies:** 3\ **Last updated:** [August 28, 2018, 7:35pm UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-with-logstash-output/146343 "2018-08-28T19:35:07Z")
HI , i am using filebeat 6.3 with the below configuration , however multiple inputs in the file beat configuration with one logstash output is not working. Filebeat configuration : filebeat.inputs: # Each - is an inp… --- ## [Loading template command not working for topbeat](https://discuss.elastic.co/t/loading-template-command-not-working-for-topbeat/146406)
**Author:** [@David\_Moreno](https://discuss.elastic.co/u/David_Moreno)\ **Replies:** 1\ **Last updated:** [August 28, 2018, 6:42pm UTC](https://discuss.elastic.co/t/loading-template-command-not-working-for-topbeat/146406 "2018-08-28T18:42:39Z")
Inputting this in my ELK server: curl -XPUT 'http://localhost:9200/\_template/topbeat' -d@topbeat.template.json I get: {"error":"Content-Type header \[application/x-www-form-urlencoded\] is not supported","status":406} A… --- ## [Multiline logs with a unique identifier](https://discuss.elastic.co/t/multiline-logs-with-a-unique-identifier/145845)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 4\ **Last updated:** [August 28, 2018, 5:21pm UTC](https://discuss.elastic.co/t/multiline-logs-with-a-unique-identifier/145845 "2018-08-28T17:21:31Z")
Hi All, I am reading messages from a syslog file in the following format: \<161\>notify-1089122.1.alert: abcd \<161\>notify-1089122.2.alert: xyz \<161\>notify-1089133.1.alert: abc \<161\>notify-1089122.3.alert: qwer These are… --- ## [Metricbeat modules don't exist](https://discuss.elastic.co/t/metricbeat-modules-dont-exist/146375)
**Author:** [@rsnyde09](https://discuss.elastic.co/u/rsnyde09)\ **Replies:** 3\ **Last updated:** [August 28, 2018, 3:55pm UTC](https://discuss.elastic.co/t/metricbeat-modules-dont-exist/146375 "2018-08-28T15:55:59Z")
I installed metricbeat yesterday from the rpm. I'm trying to use the http module but it says it doesn't exist. What went wrong with my install? I installed with: sudo rpm -vi metricbeat-6.4.0-x86\_64.rpm I made a smal… --- ## [HAproxy dashboard and visulization](https://discuss.elastic.co/t/haproxy-dashboard-and-visulization/146123)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 3\ **Last updated:** [August 28, 2018, 3:11pm UTC](https://discuss.elastic.co/t/haproxy-dashboard-and-visulization/146123 "2018-08-28T15:11:55Z")
Hello All, I have configured the HAproxy module for metricbeat and getting the data on kibana dashboard. But i didn't see any dashboard and visualization for HAproxy on kibana dashboard. Can anyone please help me. Tha… --- ## [Multiple type output](https://discuss.elastic.co/t/multiple-type-output/146352)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [August 28, 2018, 2:25pm UTC](https://discuss.elastic.co/t/multiple-type-output/146352 "2018-08-28T14:25:35Z")
Hi All, Wanted to use elasticsearch and logstash for filebeat output. Though we can use the multiple instances of filebeat would like to check any other possible options. Requirement Use elasticsearch output for defau… --- ## [Osquery module logs not prefixed with osquery.result](https://discuss.elastic.co/t/osquery-module-logs-not-prefixed-with-osquery-result/146315)
**Author:** [@wojtas](https://discuss.elastic.co/u/wojtas)\ **Replies:** 1\ **Last updated:** [August 28, 2018, 2:21pm UTC](https://discuss.elastic.co/t/osquery-module-logs-not-prefixed-with-osquery-result/146315 "2018-08-28T14:21:30Z")
Hello, I am using 6.3.0 elastic stack on RHEL7, sending filebeat osquery logs to logstash (with osquery filebeat module enabled). As per the documentation https://www.elastic.co/guide/en/beats/filebeat/6.3/filebeat-mod… --- ## [Why does Filebeat allow rotateeverybytes min as 1?](https://discuss.elastic.co/t/why-does-filebeat-allow-rotateeverybytes-min-as-1/146268)
**Author:** [@siddharthgoel88](https://discuss.elastic.co/u/siddharthgoel88)\ **Replies:** 1\ **Last updated:** [August 28, 2018, 2:10pm UTC](https://discuss.elastic.co/t/why-does-filebeat-allow-rotateeverybytes-min-as-1/146268 "2018-08-28T14:10:59Z")
I was playing around with Filebeat along with my colleague and noticed that filebeat configuration allows a minimum value of rotateeverybytes as 1 (see code ) . This looks to me like an invalid validation check and does … --- ## [Read file from beginning always](https://discuss.elastic.co/t/read-file-from-beginning-always/146212)
**Author:** [@vshankara](https://discuss.elastic.co/u/vshankara)\ **Replies:** 5\ **Last updated:** [August 28, 2018, 1:56pm UTC](https://discuss.elastic.co/t/read-file-from-beginning-always/146212 "2018-08-28T13:56:56Z")
I have a file which gets overwritten every 15 minutes, the filename does not change and remains the same. The scan frequency is set at 10s and currently the filebeat only reads the file every 1 hour and misses the previo… --- ## [Creating custom modules from terminal](https://discuss.elastic.co/t/creating-custom-modules-from-terminal/145720)
**Author:** [@souravtyson](https://discuss.elastic.co/u/souravtyson)\ **Replies:** 4\ **Last updated:** [August 28, 2018, 1:05pm UTC](https://discuss.elastic.co/t/creating-custom-modules-from-terminal/145720 "2018-08-28T13:05:08Z")
Hi Team, I have been trying to create custom module for vmstat command. Earlier i created tomcat access log module by copying the existing module. But i wanted to try the steps available in the below link as the above… --- ## [FileBeat Propector issue](https://discuss.elastic.co/t/filebeat-propector-issue/145494)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 10\ **Last updated:** [August 28, 2018, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-propector-issue/145494 "2018-08-28T13:02:31Z")
Hi All, i am sending events of tomee via filebeat to kafka but getting below exceptions , can someone help me understanding it , looks like some configuration needs to be updated . ticker time , crawler , prospector o… --- ## [Azure Kubernetes Services - metadata API error](https://discuss.elastic.co/t/azure-kubernetes-services-metadata-api-error/146225)
**Author:** [@ac-astuartkregor](https://discuss.elastic.co/u/ac-astuartkregor)\ **Replies:** 2\ **Last updated:** [August 28, 2018, 7:58am UTC](https://discuss.elastic.co/t/azure-kubernetes-services-metadata-api-error/146225 "2018-08-28T07:58:57Z")
Hi folks, Apologies if this has already been mentioned, I couldn't find much reference to it. Would love to get some input as to what the cause of the error might be, as I've not managed to figure it out. I can use fil… --- ## [MetricBeat keep metricbeat Index for 7 day](https://discuss.elastic.co/t/metricbeat-keep-metricbeat-index-for-7-day/146220)
**Author:** [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\ **Replies:** 2\ **Last updated:** [August 28, 2018, 4:31am UTC](https://discuss.elastic.co/t/metricbeat-keep-metricbeat-index-for-7-day/146220 "2018-08-28T04:31:12Z")
Hi, I am using MetricBeat 5.6.10, I am seeing metricbeat-2018.08.XX index getting created every day on elastic search. Is there any setting to control this to 7 days(Similar to xpack.monitoring.… --- ## [Need recommended FileBeat config for logs that replace file every hour](https://discuss.elastic.co/t/need-recommended-filebeat-config-for-logs-that-replace-file-every-hour/145755)
**Author:** [@HackerHurricane](https://discuss.elastic.co/u/HackerHurricane)\ **Replies:** 3\ **Last updated:** [August 27, 2018, 8:49pm UTC](https://discuss.elastic.co/t/need-recommended-filebeat-config-for-logs-that-replace-file-every-hour/145755 "2018-08-27T20:49:48Z")
Hello all, I have a tool that we slurp up the files to Humio and FileBeat works perfectly if I delete the file before the task runs, but we would like not to delete the file so we don't get all the lines every hour, jus… --- ## [Parsing a long json line with filebeat to logstash](https://discuss.elastic.co/t/parsing-a-long-json-line-with-filebeat-to-logstash/145231)
**Author:** [@Gab\_Ubi](https://discuss.elastic.co/u/Gab_Ubi)\ **Replies:** 5\ **Last updated:** [August 27, 2018, 7:07pm UTC](https://discuss.elastic.co/t/parsing-a-long-json-line-with-filebeat-to-logstash/145231 "2018-08-27T19:07:37Z")
Hi all, Im trying to parse a big json line into logstash. The json is an array of multpiple object. I'd like each object to be an event and each value to be a field. This is my filebeat config: filebeat.inputs: - typ… --- ## [Kibana and packetbeat questions](https://discuss.elastic.co/t/kibana-and-packetbeat-questions/146206)
**Author:** [@AlekseyS](https://discuss.elastic.co/u/AlekseyS)\ **Replies:** 1\ **Last updated:** [August 27, 2018, 5:20pm UTC](https://discuss.elastic.co/t/kibana-and-packetbeat-questions/146206 "2018-08-27T17:20:51Z")
Hello all! I have some questions about my elk + packtebeat solituons. I'm using packetbeat to collection statistic about my servers. In the packtebeat have very good visualization called "netwrk traffic beetwen my hosts… --- ## [Filebeat on docker doesnt sends all logs](https://discuss.elastic.co/t/filebeat-on-docker-doesnt-sends-all-logs/145946)
**Author:** [@Vadim\_Sohin](https://discuss.elastic.co/u/Vadim_Sohin)\ **Replies:** 1\ **Last updated:** [August 27, 2018, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-doesnt-sends-all-logs/145946 "2018-08-27T13:54:32Z")
Hello All i am using FB 6.3.2 LS 6.3.2 and KIbana 6.3.2 , ubuntu 16.04 lts my dokcer version is 18.03 ce and docker compose is 1.21 version when using Filebeat on Docker i dont see logs received in Kibana only log fr… --- ## [Filebeat is sending additional fields](https://discuss.elastic.co/t/filebeat-is-sending-additional-fields/145672)
**Author:** [@Jyothi\_Balla](https://discuss.elastic.co/u/Jyothi_Balla)\ **Replies:** 3\ **Last updated:** [August 27, 2018, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-additional-fields/145672 "2018-08-27T13:50:34Z")
I have a filebeat configured to send the logs to the kafka then to the logstash-\>elasticsearch-\>kibana the filebeat is sending the message as follows: "@timestamp": "2018-08-23T07:22:11.390Z", "@metadata": { "beat": … --- ## [Registry load gets caught in infinite loop](https://discuss.elastic.co/t/registry-load-gets-caught-in-infinite-loop/145717)
**Author:** [@Marco\_de\_Abreu](https://discuss.elastic.co/u/Marco_de_Abreu)\ **Replies:** 2\ **Last updated:** [August 27, 2018, 11:33am UTC](https://discuss.elastic.co/t/registry-load-gets-caught-in-infinite-loop/145717 "2018-08-27T11:33:27Z")
Hello, I'm using Filebeat to process a big number of logfiles and I've got the feeling that the registry is not able to cope with the amount. The config I am using has worked the first time and the startup happens immed… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=423) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=425)