# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=425 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 426 --- ## [Why install metricbeat 6.4.0, can't find the modules.d folder?](https://discuss.elastic.co/t/why-install-metricbeat-6-4-0-cant-find-the-modules-d-folder/145828)
**Author:** [@jerrywang1974](https://discuss.elastic.co/u/jerrywang1974)\ **Replies:** 6\ **Last updated:** [August 27, 2018, 9:56am UTC](https://discuss.elastic.co/t/why-install-metricbeat-6-4-0-cant-find-the-modules-d-folder/145828 "2018-08-27T09:56:44Z")
Hi, I'd has issue about metricbeat 6.4.0, I installed and that's missing modules.d folder and as 6.3.x is worked. does anyone report that? Jerry --- ## [Nginx Module](https://discuss.elastic.co/t/nginx-module/145547)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 5\ **Last updated:** [August 27, 2018, 8:08am UTC](https://discuss.elastic.co/t/nginx-module/145547 "2018-08-27T08:08:18Z")
Hello All, I have configured metricbeat and enabled the system and Nginx module. The system module is working fine and able to see the metrics on metricbeat dashboard. But no data is available for Nginx. Config file of… --- ## [Filebeat service won't run on windows 2016 & 2012r2 EC2 instance](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075)
**Author:** [@maffydavison](https://discuss.elastic.co/u/maffydavison)\ **Replies:** 3\ **Last updated:** [August 27, 2018, 1:06am UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075 "2018-08-27T01:06:28Z")
Configured my windows instance with the instance metadata. Used the install-service-filebeat.ps1 to install the service. The result is: PS C:\\Filebeat\> C:\\Filebeat\\install-service-filebeat.ps1 \_\_GENUS : 2 \_… --- ## [Filebeat reads a log file but loses some lines](https://discuss.elastic.co/t/filebeat-reads-a-log-file-but-loses-some-lines/145922)
**Author:** [@Steve1](https://discuss.elastic.co/u/Steve1)\ **Replies:** 4\ **Last updated:** [August 24, 2018, 7:35pm UTC](https://discuss.elastic.co/t/filebeat-reads-a-log-file-but-loses-some-lines/145922 "2018-08-24T19:35:16Z")
So i use filebeat 6.4.0. And i produce 1.000.000 lines with log4j2 to a main.log. Then i execute filebeat to read this main.log and writes the output to file. But filebeat dont have 1.000.000 lines but fewer. Why that? f… --- ## [Exclude file pattern not working correctly](https://discuss.elastic.co/t/exclude-file-pattern-not-working-correctly/145847)
**Author:** [@brjisc](https://discuss.elastic.co/u/brjisc)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 5:50pm UTC](https://discuss.elastic.co/t/exclude-file-pattern-not-working-correctly/145847 "2018-08-24T17:50:06Z")
Hi, With this configuration: filebeat.inputs: type: log enabled: true paths: /tmp/cssd/\* exclude\_files: \['^error.+$','^.+error$','^bar.+','^.+error.+$','^.+.log.1','.\*.gz'\] Creating these files in the /tmp/c… --- ## [Filebeat failed to connect to logstash](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-logstash/145842)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-logstash/145842 "2018-08-24T17:45:07Z")
Hello there, I 'm setting up filebeat to send logs to logstash, on filebeat, filebeat can not tcp to the logstash on port 5044... the conection reset by peer. Here is the filebeat log: 2018-08-24T05:52:44.501Z … --- ## [How to add s1ap and GTP protocol in packetbeat](https://discuss.elastic.co/t/how-to-add-s1ap-and-gtp-protocol-in-packetbeat/145339)
**Author:** [@brkumar1990](https://discuss.elastic.co/u/brkumar1990)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 3:35pm UTC](https://discuss.elastic.co/t/how-to-add-s1ap-and-gtp-protocol-in-packetbeat/145339 "2018-08-24T15:35:25Z")
Hi, I tried to load the pcap file consist of S1AP and GTP protocols using packetbeat but i am not getting the S1AP and GTP in the elastic search page. Anyone let me know how to load S1AP and GTP protocols in ES Regard… --- ## [Convert field to lowercase to use in index name](https://discuss.elastic.co/t/convert-field-to-lowercase-to-use-in-index-name/145836)
**Author:** [@insomniac](https://discuss.elastic.co/u/insomniac)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 2:47pm UTC](https://discuss.elastic.co/t/convert-field-to-lowercase-to-use-in-index-name/145836 "2018-08-24T14:47:12Z")
Trying to use the value of a field in the index name for the output to Elastic Cloud caused this error {"type":"invalid\_index\_name\_exception","reason":"Invalid index name \[winlogbeat-Microsoft-Windows-TaskScheduler-6.2… --- ## [ELK Newb - Packetbeat Visualizations](https://discuss.elastic.co/t/elk-newb-packetbeat-visualizations/145818)
**Author:** [@zaq.hack](https://discuss.elastic.co/u/zaq.hack)\ **Replies:** 2\ **Last updated:** [August 24, 2018, 2:39pm UTC](https://discuss.elastic.co/t/elk-newb-packetbeat-visualizations/145818 "2018-08-24T14:39:58Z")
I wanted to figure out where all my bandwidth was going at home. I set up a switch and a sniffer port and a friend recommended Packetbeat, Elasticsearch, and Kibana. So far, it seems very interesting, but ... I am not su… --- ## [How to get filebeat docker image's Dockerfile](https://discuss.elastic.co/t/how-to-get-filebeat-docker-images-dockerfile/145486)
**Author:** [@Chao\_Lee](https://discuss.elastic.co/u/Chao_Lee)\ **Replies:** 2\ **Last updated:** [August 24, 2018, 2:36pm UTC](https://discuss.elastic.co/t/how-to-get-filebeat-docker-images-dockerfile/145486 "2018-08-24T14:36:14Z")
How can I get the filebeat docker iamge's docker file? Here is the document says FROM docker.elastic.co/beats/filebeat:6.3.2 COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root RUN chown root:filebeat /usr/sha… --- ## [Filebeat not sending log files](https://discuss.elastic.co/t/filebeat-not-sending-log-files/144911)
**Author:** [@beel](https://discuss.elastic.co/u/beel)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-log-files/144911 "2018-08-24T14:34:00Z")
Hi everybody, I 'm beginner in ElasticStack. I'm using version 6.3.2. to test it. I'm installing Filebeat, Logstash, Elasticsearch and Kibana as service on windows 10. Normlay filebeat must recover the logfiles and s… --- ## [Data is not avaialable for some metrics](https://discuss.elastic.co/t/data-is-not-avaialable-for-some-metrics/145381)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 6\ **Last updated:** [August 24, 2018, 10:19am UTC](https://discuss.elastic.co/t/data-is-not-avaialable-for-some-metrics/145381 "2018-08-24T10:19:39Z")
Hello All, I am using metricbeat6.2.4 and all the other component are also 6.2.4 like ELK. I have imported metricbeat dashboard but didn't get value for some metrics. Please refer the below screenshot: Can anyone pl… --- ## [Winlogbeat failed to start after adding add\_host\_metadata](https://discuss.elastic.co/t/winlogbeat-failed-to-start-after-adding-add-host-metadata/145733)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 2\ **Last updated:** [August 24, 2018, 6:58am UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-start-after-adding-add-host-metadata/145733 "2018-08-24T06:58:12Z")
Hi, since upgrading Elastic to 6.3, we added the add\_host\_metadata processor to our beats yml files. We know that we cannot use it on the windows 2003 servers. But it seems not to work on Windows 2008 SP2 64-bit serve… --- ## [NO\_SHARED\_CIPHER error when beats is behind AWS load balancer](https://discuss.elastic.co/t/no-shared-cipher-error-when-beats-is-behind-aws-load-balancer/144751)
**Author:** [@smilin\_stan](https://discuss.elastic.co/u/smilin_stan)\ **Replies:** 3\ **Last updated:** [August 23, 2018, 5:30pm UTC](https://discuss.elastic.co/t/no-shared-cipher-error-when-beats-is-behind-aws-load-balancer/144751 "2018-08-23T17:30:00Z")
I am running logstash 6.3.2 on Amazon Linux 2. My beats input is as follows: input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/ssl/certs/logstash.crt" ssl\_key =\> "/etc/ssl/certs/logstash.pem" } }… --- ## [Moving JSON inner field to root level](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565)
**Author:** [@mecavity](https://discuss.elastic.co/u/mecavity)\ **Replies:** 1\ **Last updated:** [August 23, 2018, 4:01pm UTC](https://discuss.elastic.co/t/moving-json-inner-field-to-root-level/145565 "2018-08-23T16:01:00Z")
Hi, I'm using filebeats to send logs from docker instances to elasticsearch. The log I am receiving in elasticsearch has a field called message which is a JSON object of the actual log that came out of the container. H… --- ## [FileBeat slow - Improve performance](https://discuss.elastic.co/t/filebeat-slow-improve-performance/144717)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 11\ **Last updated:** [August 23, 2018, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-slow-improve-performance/144717 "2018-08-23T13:05:57Z")
Hi All, I have a bit of a problem in terms of data ingestion using FileBeat. I have multiple directories from which I wish to read data in almost near realtime. Below is the relevant snippet from my filebeat. =========… --- ## [Filebeat stops shipping data when Kafka broker is unavailable](https://discuss.elastic.co/t/filebeat-stops-shipping-data-when-kafka-broker-is-unavailable/143858)
**Author:** [@rs\_ela](https://discuss.elastic.co/u/rs_ela)\ **Replies:** 6\ **Last updated:** [August 23, 2018, 12:00pm UTC](https://discuss.elastic.co/t/filebeat-stops-shipping-data-when-kafka-broker-is-unavailable/143858 "2018-08-23T12:00:00Z")
Hello. Noticed an issue with my Filebeat & Kafka environment. Can anyone confirm behaviour described below? If so, I'll report it on Github to be fixed. Reproduction steps: Filebeat is configured to ship data to Kafka… --- ## [Dbstats and collstats mongo db metric issues](https://discuss.elastic.co/t/dbstats-and-collstats-mongo-db-metric-issues/144974)
**Author:** [@Jonathan\_Thinh](https://discuss.elastic.co/u/Jonathan_Thinh)\ **Replies:** 1\ **Last updated:** [August 20, 2018, 12:20pm UTC](https://discuss.elastic.co/t/dbstats-and-collstats-mongo-db-metric-issues/144974 "2018-08-20T12:20:59Z")
Receiving errors for both collstat and dbstat when running metricbeat in docker container. dbstats Error: 2018/08/17 22:31:22.444955 client.go:442: WARN Can not index event (status=400): {"type":"mapper\_parsing\_excepti… --- ## [Metricbeat not processing kubernetes labels](https://discuss.elastic.co/t/metricbeat-not-processing-kubernetes-labels/144574)
**Author:** [@fbcbarbosa](https://discuss.elastic.co/u/fbcbarbosa)\ **Replies:** 6\ **Last updated:** [August 22, 2018, 5:46pm UTC](https://discuss.elastic.co/t/metricbeat-not-processing-kubernetes-labels/144574 "2018-08-22T17:46:18Z")
Hello, I'm running Metrict beat 6.3.1 on a Kubernetes clusters on AWS. It works fine, except for the fact that the kubernetes.labels field is missing. The metricbeat index has 1330 fields, but searching for "label" retu… --- ## [Scalability Issue: Significant delay in shipping out log files & the delay is dramatically different for different log files!](https://discuss.elastic.co/t/scalability-issue-significant-delay-in-shipping-out-log-files-the-delay-is-dramatically-different-for-different-log-files/145476)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 7\ **Last updated:** [August 22, 2018, 5:00pm UTC](https://discuss.elastic.co/t/scalability-issue-significant-delay-in-shipping-out-log-files-the-delay-is-dramatically-different-for-different-log-files/145476 "2018-08-22T17:00:55Z")
We use filebeat to tail log files on disk and ship them to kafka. We observed there is some significant delay between the logs are written to disk and they were processed and sent to kafka. For example: for READER-6.log… --- ## [Use preliminary 6.4.0 Filebeat](https://discuss.elastic.co/t/use-preliminary-6-4-0-filebeat/145550)
**Author:** [@jesusgn90](https://discuss.elastic.co/u/jesusgn90)\ **Replies:** 4\ **Last updated:** [August 22, 2018, 2:44pm UTC](https://discuss.elastic.co/t/use-preliminary-6-4-0-filebeat/145550 "2018-08-22T14:44:56Z")
Hello team! Recently I've been testing our Kibana plugin in order to adapt it to future 6.4.0 version. Currently I'm using Kibana dev from 6.4 branch, and launching an ES instance with ES snapshot command from Kibana's … --- ## [Add\_docker\_metadata filter desired fields](https://discuss.elastic.co/t/add-docker-metadata-filter-desired-fields/145502)
**Author:** [@caub](https://discuss.elastic.co/u/caub)\ **Replies:** 2\ **Last updated:** [August 22, 2018, 1:48pm UTC](https://discuss.elastic.co/t/add-docker-metadata-filter-desired-fields/145502 "2018-08-22T13:48:57Z")
It would be great to be able to select which fields we want from add\_docker\_metadata prospector I'm doing currently: processors: - add\_docker\_metadata: ~ - drop\_fields: fields: \["input.type", "prospector.type… --- ## [Using index template to read a field as date](https://discuss.elastic.co/t/using-index-template-to-read-a-field-as-date/145322)
**Author:** [@Jonathan\_Tan](https://discuss.elastic.co/u/Jonathan_Tan)\ **Replies:** 4\ **Last updated:** [August 22, 2018, 12:30pm UTC](https://discuss.elastic.co/t/using-index-template-to-read-a-field-as-date/145322 "2018-08-22T12:30:59Z")
Hi, I'm attempting to take a JSON-based log, and use Filebeat to stick it directly into Elasticsearch. I'm trying - at this point - not to include Logstash yet, AND also attempting to get a better understanding of what … --- ## [Getting error while running filebeat on unix](https://discuss.elastic.co/t/getting-error-while-running-filebeat-on-unix/145527)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [August 22, 2018, 10:32am UTC](https://discuss.elastic.co/t/getting-error-while-running-filebeat-on-unix/145527 "2018-08-22T10:32:26Z")
While running filebeat using ./filebeat -e -c filebeat.yml command getting ksh: ./filebeat: cannot execute How can i run filebeat on unix system? --- ## [Filebeat autodiscover advanced pod log shipping with container specific actions](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820)
**Author:** [@havlan](https://discuss.elastic.co/u/havlan)\ **Replies:** 4\ **Last updated:** [August 22, 2018, 10:05am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820 "2018-08-22T10:05:00Z")
Hi! I know autodiscover for Kubernetes/Docker is quite new. In a pod context where a pod has several containers, is it possible to specify a sidecar configuration from kubernetes metadata in terms of achieving logging … --- ## [Link problem between ELK and filebeat](https://discuss.elastic.co/t/link-problem-between-elk-and-filebeat/145503)
**Author:** [@raph](https://discuss.elastic.co/u/raph)\ **Replies:** 1\ **Last updated:** [August 22, 2018, 9:11am UTC](https://discuss.elastic.co/t/link-problem-between-elk-and-filebeat/145503 "2018-08-22T09:11:20Z")
hello, Filebeats do not send me anything,Do you have an idea of the problem ? \< ###################### Filebeat Configuration Example ######################### This file is an example configuration file highlighting… --- ## [Sending Event Logs and Log Files](https://discuss.elastic.co/t/sending-event-logs-and-log-files/142860)
**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Replies:** 14\ **Last updated:** [August 22, 2018, 8:51am UTC](https://discuss.elastic.co/t/sending-event-logs-and-log-files/142860 "2018-08-22T08:51:16Z")
Is there anybody can help me, how to configure the winlogbeat to send these logs? define BASEDIR D:\\sdfdsfs\\LogFiles\\zip\_archive File '%BASEDIR%\\www.vvv.com\\u\*.log' Module im\_file File '%BASEDI… --- ## [Process State does not display Stopped state](https://discuss.elastic.co/t/process-state-does-not-display-stopped-state/145294)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 3\ **Last updated:** [August 22, 2018, 7:16am UTC](https://discuss.elastic.co/t/process-state-does-not-display-stopped-state/145294 "2018-08-22T07:16:02Z")
Hello Team, We are using Metricbeat to check the state of services. We get only one state - Sleeping. When we stop the services I don't get the Stopped state nor states like Running, Idle etc We are creating a servic… --- ## [Can't find indices in elasticsearch and kibana after running filebeat](https://discuss.elastic.co/t/cant-find-indices-in-elasticsearch-and-kibana-after-running-filebeat/145292)
**Author:** [@wonki](https://discuss.elastic.co/u/wonki)\ **Replies:** 1\ **Last updated:** [August 22, 2018, 1:54am UTC](https://discuss.elastic.co/t/cant-find-indices-in-elasticsearch-and-kibana-after-running-filebeat/145292 "2018-08-22T01:54:57Z")
Hello ! I'm trying to run filebeat and i have one question. Below is what i have done so far. Install Elasticstack ( Elasticsearch & kibana & logstash & filebeat ) and i succeed in making a pipeline Elasticsearch, Ki… --- ## [Configure filebeat as listening acceptor, logstash as initiator](https://discuss.elastic.co/t/configure-filebeat-as-listening-acceptor-logstash-as-initiator/145145)
**Author:** [@\_Alex](https://discuss.elastic.co/u/_Alex)\ **Replies:** 2\ **Last updated:** [August 21, 2018, 7:40pm UTC](https://discuss.elastic.co/t/configure-filebeat-as-listening-acceptor-logstash-as-initiator/145145 "2018-08-21T19:40:51Z")
Hi all, Is it possible to configure Filebeat to listen on a port and have Logstash connect to it, rather than the other way round? In the configuration section of the docs, I can see Filebeat can be configured as an in… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=424) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=426)