# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=426 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 427 --- ## [How to set source: field to local eth0 ip address](https://discuss.elastic.co/t/how-to-set-source-field-to-local-eth0-ip-address/145248)
**Author:** [@Kum](https://discuss.elastic.co/u/Kum)\ **Replies:** 1\ **Last updated:** [August 21, 2018, 6:10pm UTC](https://discuss.elastic.co/t/how-to-set-source-field-to-local-eth0-ip-address/145248 "2018-08-21T18:10:57Z")
Hi, Is there a way to specify that filebeat use the local eth0 ip address as the source: field value instead of hostname? Right now I'm doing this by overwriting the field "source:" in each filebeat.input, but I'd lik… --- ## [Filebeat.prospectors not working](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203)
**Author:** [@roi\_romano](https://discuss.elastic.co/u/roi_romano)\ **Replies:** 1\ **Last updated:** [August 21, 2018, 6:00pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203 "2018-08-21T18:00:19Z")
The filebeat service is up running, but it is not listening to the ngnix logs by the ngnix.yml. It works as desired if I manually add the input\_type property with the path to the ngnix logs in the main filebeat.yml. thi… --- ## [Exclude Lines](https://discuss.elastic.co/t/exclude-lines/145150)
**Author:** [@WarrenG](https://discuss.elastic.co/u/WarrenG)\ **Replies:** 1\ **Last updated:** [August 21, 2018, 5:56pm UTC](https://discuss.elastic.co/t/exclude-lines/145150 "2018-08-21T17:56:22Z")
Hi All Having a bit of a problem with excluding lines Here is my config, // - type: log // enabled: true // paths: \["/var/log/clamd.log"\] // multiline.pattern: "Starting ClamAV Scan" // multiline.negate: true … --- ## [Sincedb\_path =\> "/dev/null" roll in filebeat](https://discuss.elastic.co/t/sincedb-path-dev-null-roll-in-filebeat/145335)
**Author:** [@wonki](https://discuss.elastic.co/u/wonki)\ **Replies:** 0\ **Last updated:** [August 21, 2018, 8:55am UTC](https://discuss.elastic.co/t/sincedb-path-dev-null-roll-in-filebeat/145335 "2018-08-21T08:55:16Z")
Hello again, is there any command or configuration having a role like sincedb\_path =\> "/dev/null" in logstash? I want to store same log data in elasticsearch just change index name. So when i didn't use filebeat, i us… --- ## [Metricbeat issue: The request for this panel failed](https://discuss.elastic.co/t/metricbeat-issue-the-request-for-this-panel-failed/145108)
**Author:** [@Shree](https://discuss.elastic.co/u/Shree)\ **Replies:** 4\ **Last updated:** [August 21, 2018, 7:15am UTC](https://discuss.elastic.co/t/metricbeat-issue-the-request-for-this-panel-failed/145108 "2018-08-21T07:15:05Z")
Hi, I am getting this on my kibana dashboard. I installed metricbeat and wanted to see the performance of system but this happened. could someone help me with this?? --- ## [Unable to import metricbeat dashboard](https://discuss.elastic.co/t/unable-to-import-metricbeat-dashboard/145083)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 3\ **Last updated:** [August 21, 2018, 7:12am UTC](https://discuss.elastic.co/t/unable-to-import-metricbeat-dashboard/145083 "2018-08-21T07:12:42Z")
Hello All, I am using metricbeat6.2.4. I want to export metricbeat dashboard in kibana. I have configured logstash output in my metricbeat.yml file instead of elasticsearch output. My Kibana dashboard is running on diff… --- ## [Postgres privileges](https://discuss.elastic.co/t/postgres-privileges/144603)
**Author:** [@joshsmoore](https://discuss.elastic.co/u/joshsmoore)\ **Replies:** 3\ **Last updated:** [August 21, 2018, 7:12am UTC](https://discuss.elastic.co/t/postgres-privileges/144603 "2018-08-21T07:12:01Z")
Hi have setup the Postgres module and it seems to be working correctly with one exception. postgresql.activity.query: Can you tell me what privilege I need to set on this user to fix this? --- ## [125: SSL client failed to connect with: dial tcp 192.168.37.147:5044: getsockopt: connection refused](https://discuss.elastic.co/t/125-ssl-client-failed-to-connect-with-dial-tcp-192-168-37-147-getsockopt-connection-refused/145161)
**Author:** [@rituraj](https://discuss.elastic.co/u/rituraj)\ **Replies:** 8\ **Last updated:** [August 21, 2018, 6:53am UTC](https://discuss.elastic.co/t/125-ssl-client-failed-to-connect-with-dial-tcp-192-168-37-147-getsockopt-connection-refused/145161 "2018-08-21T06:53:20Z")
Hi Team, I am getting below errro while fetching logs by using filebeat . Details are mentioned below \[root@nagios-core ~\]# systemctl status filebeat ● filebeat.service - filebeat Loaded: loaded (/usr/lib/systemd/sy… --- ## [Add\_kubernetes\_metadata does't parse labels with dots properly](https://discuss.elastic.co/t/add-kubernetes-metadata-doest-parse-labels-with-dots-properly/145195)
**Author:** [@Jarek\_Miszkinis](https://discuss.elastic.co/u/Jarek_Miszkinis)\ **Replies:** 1\ **Last updated:** [August 21, 2018, 6:13am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-doest-parse-labels-with-dots-properly/145195 "2018-08-21T06:13:04Z")
Labels with dots get parsed as a hash and it builds structures out of it, from my searching it looks like there were commits in code to replace dots with dashes in kubernetes and docker labels. But the dots are not repla… --- ## [Filebeat hint based autodiscovery not working](https://discuss.elastic.co/t/filebeat-hint-based-autodiscovery-not-working/144985)
**Author:** [@Alex\_Scoble](https://discuss.elastic.co/u/Alex_Scoble)\ **Replies:** 4\ **Last updated:** [August 21, 2018, 5:59am UTC](https://discuss.elastic.co/t/filebeat-hint-based-autodiscovery-not-working/144985 "2018-08-21T05:59:56Z")
I have filebeat 6.3.2 installed in kubernetes cluster as daemonset. Configs are at https://gist.github.com/ITBlogger/f50632d643ec4cb241bdd41355b295ba#file-filebeat-configmaps and deployment snippet is at https://gist.gi… --- ## [How to use the index specified in Filebeat in logstash.yml?](https://discuss.elastic.co/t/how-to-use-the-index-specified-in-filebeat-in-logstash-yml/144992)
**Author:** [@mhyousefi](https://discuss.elastic.co/u/mhyousefi)\ **Replies:** 2\ **Last updated:** [August 21, 2018, 5:57am UTC](https://discuss.elastic.co/t/how-to-use-the-index-specified-in-filebeat-in-logstash-yml/144992 "2018-08-21T05:57:45Z")
Hey there, I am using Filebeat to send log files over to my Logstash with the following configurations: filebeat.inputs: - type: log enabled: true paths: - ${PWD}/filebeat-volume/data/\*.txt output.logstash: … --- ## [Do I need filebeat module for filebeat to work?](https://discuss.elastic.co/t/do-i-need-filebeat-module-for-filebeat-to-work/145208)
**Author:** [@ELK\_believer](https://discuss.elastic.co/u/ELK_believer)\ **Replies:** 2\ **Last updated:** [August 21, 2018, 4:53am UTC](https://discuss.elastic.co/t/do-i-need-filebeat-module-for-filebeat-to-work/145208 "2018-08-21T04:53:20Z")
I'm new to ELK and at the point of setting up filebeat. I have input and output configured on a server to send logs to LS. Do I have to enable ANY filebeat modules or can I comment that section out in the .yml file? --- ## [Unable to send logs from windows 10 to kibana](https://discuss.elastic.co/t/unable-to-send-logs-from-windows-10-to-kibana/145139)
**Author:** [@ssss](https://discuss.elastic.co/u/ssss)\ **Replies:** 1\ **Last updated:** [August 21, 2018, 3:11am UTC](https://discuss.elastic.co/t/unable-to-send-logs-from-windows-10-to-kibana/145139 "2018-08-21T03:11:28Z")
Hello, I'm getting problem in sending logs from winlogbeat-6.3.2-windows-x86\_64 to kibana(version - 4.5.4), from windows 10. After installing and start running the winlogbeat service successfully as given below :- PS … --- ## [Filebeat collects logs prior to deployment of ELK](https://discuss.elastic.co/t/filebeat-collects-logs-prior-to-deployment-of-elk/144446)
**Author:** [@ss.z](https://discuss.elastic.co/u/ss.z)\ **Replies:** 12\ **Last updated:** [August 21, 2018, 2:25am UTC](https://discuss.elastic.co/t/filebeat-collects-logs-prior-to-deployment-of-elk/144446 "2018-08-21T02:25:55Z")
Hi I'm using ELk-6.3.1 I've only recently started using Elk, and I output some of the cluster logs to logstash through filebeat, but I can only deliver the latest ones, and before I deploy ELk, will some logs also want … --- ## [Filebeats multiline pattern help](https://discuss.elastic.co/t/filebeats-multiline-pattern-help/144955)
**Author:** [@fionamacd](https://discuss.elastic.co/u/fionamacd)\ **Replies:** 1\ **Last updated:** [August 20, 2018, 12:43pm UTC](https://discuss.elastic.co/t/filebeats-multiline-pattern-help/144955 "2018-08-20T12:43:37Z")
Hi, I have some log files I want to parse in Filebeat and can't get the multiline.pattern options to work for my logs. All the sites I tested the regex and data at show it should match, but I get mixed up message entrie… --- ## [Memory/Filesystem Percentage](https://discuss.elastic.co/t/memory-filesystem-percentage/144957)
**Author:** [@Sundar\_V](https://discuss.elastic.co/u/Sundar_V)\ **Replies:** 1\ **Last updated:** [August 20, 2018, 12:18pm UTC](https://discuss.elastic.co/t/memory-filesystem-percentage/144957 "2018-08-20T12:18:47Z")
Hello, In my case, I'm getting 0.96 memory used percentage, however, it should be 96.24 percentage memory.used: 2018578432 memory.used.pct: 0.9624 memory.total: 2097442816 Looking into the c… --- ## [Monitoring in FileBeat 5.6](https://discuss.elastic.co/t/monitoring-in-filebeat-5-6/145051)
**Author:** [@pksinghal](https://discuss.elastic.co/u/pksinghal)\ **Replies:** 3\ **Last updated:** [August 20, 2018, 10:53am UTC](https://discuss.elastic.co/t/monitoring-in-filebeat-5-6/145051 "2018-08-20T10:53:07Z")
Hi, I am using ELK Stack 5.6. In this version of a stack, I want to monitor filebeat using Elasticsearch. One way is to add new filebeat what will scan filebeat log and send to elasticsearch. Is there any other way t… --- ## [Filebeat doesn't log anythign with kubernetes autodiscover](https://discuss.elastic.co/t/filebeat-doesnt-log-anythign-with-kubernetes-autodiscover/144933)
**Author:** [@lassizci](https://discuss.elastic.co/u/lassizci)\ **Replies:** 1\ **Last updated:** [August 20, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-doesnt-log-anythign-with-kubernetes-autodiscover/144933 "2018-08-20T09:13:29Z")
Hi, I've been trying to set up kubernetes logging with filebeat from outside our kubernetes cluster. Here is my config: filebeat: autodiscover: providers: - type: kubernetes kube\_config: /etc/kuberne… --- ## [Filebeat into Syslog](https://discuss.elastic.co/t/filebeat-into-syslog/145074)
**Author:** [@nate](https://discuss.elastic.co/u/nate)\ **Replies:** 0\ **Last updated:** [August 20, 2018, 12:49am UTC](https://discuss.elastic.co/t/filebeat-into-syslog/145074 "2018-08-20T00:49:57Z")
Hi All, We are looking to try out some features from the elastic stack which im excited about. We want to start of small though and use existing services at the start before expanding out to (hopefully) use the entire s… --- ## [Log All User's Shell Activity](https://discuss.elastic.co/t/log-all-users-shell-activity/144982)
**Author:** [@homood](https://discuss.elastic.co/u/homood)\ **Replies:** 2\ **Last updated:** [August 18, 2018, 2:01am UTC](https://discuss.elastic.co/t/log-all-users-shell-activity/144982 "2018-08-18T02:01:01Z")
Hello everyone. I am trying to log all command line activities using Auditbeats. I have Auditbeat installed on Redhat, this Auditbeat agent sends logs to a Logstash server I am receiving logs on the Logstash server, bu… --- ## [Filebeat does not send logs to logstash](https://discuss.elastic.co/t/filebeat-does-not-send-logs-to-logstash/144465)
**Author:** [@mhyousefi](https://discuss.elastic.co/u/mhyousefi)\ **Replies:** 8\ **Last updated:** [August 17, 2018, 7:32pm UTC](https://discuss.elastic.co/t/filebeat-does-not-send-logs-to-logstash/144465 "2018-08-17T19:32:14Z")
So here's the big picture: my objective is to index large amounts of (.txt) data using the ELK stack + filebeat. Basically, my problem is that filebeat seems to be unable to send logs to logstash. My guess is, some dock… --- ## [Logs still being shipped with filebeat purged](https://discuss.elastic.co/t/logs-still-being-shipped-with-filebeat-purged/144601)
**Author:** [@ianjack](https://discuss.elastic.co/u/ianjack)\ **Replies:** 2\ **Last updated:** [August 17, 2018, 4:14pm UTC](https://discuss.elastic.co/t/logs-still-being-shipped-with-filebeat-purged/144601 "2018-08-17T16:14:30Z")
I attempted to use "exclude\_lines:" and didn't have any success with filebeat v5.8.3 input\_type: log paths: /var/log/auth.log /var/log/syslog /var/log/ufw.log /var/log/mail.log exclude\_files: \[".gz$"\] exclude\_lines… --- ## [Able to configure Filebeat and index in Kibana, but no data is appearing](https://discuss.elastic.co/t/able-to-configure-filebeat-and-index-in-kibana-but-no-data-is-appearing/144222)
**Author:** [@JustTheDr](https://discuss.elastic.co/u/JustTheDr)\ **Replies:** 5\ **Last updated:** [August 17, 2018, 2:46pm UTC](https://discuss.elastic.co/t/able-to-configure-filebeat-and-index-in-kibana-but-no-data-is-appearing/144222 "2018-08-17T14:46:22Z")
I was able to configure the Filebeat yaml and index it in Kibana, but no data is appearing. Service is running but no information is displaying in my discover tab or in my filebeat iis dashboard. Below is my filebeat.y… --- ## [Fileabeat grok fail "Provided Grok expressions do not match field value"](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609)
**Author:** [@cythwell](https://discuss.elastic.co/u/cythwell)\ **Replies:** 4\ **Last updated:** [August 17, 2018, 2:45pm UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609 "2018-08-17T14:45:52Z")
Hi, my filebeat was got a grok error "Provided Grok expressions do not match field value" when publishing log to elasticsearch. However, the pattern using was generated by Grok debugger and passed the test. the log, f… --- ## [Change index per pipeline](https://discuss.elastic.co/t/change-index-per-pipeline/144901)
**Author:** [@Josiah\_Raiche](https://discuss.elastic.co/u/Josiah_Raiche)\ **Replies:** 1\ **Last updated:** [August 17, 2018, 2:02pm UTC](https://discuss.elastic.co/t/change-index-per-pipeline/144901 "2018-08-17T14:02:00Z")
I'm very new to elasticsearch, so I may be approaching this problem incorrectly. I've got a couple logs with different log formats. It's pretty easy to create a pipeline with a grok pattern for each, but I'd like to sen… --- ## [Filebeat/Metricbeat logs rotation](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744)
**Author:** [@BiNaP](https://discuss.elastic.co/u/BiNaP)\ **Replies:** 4\ **Last updated:** [August 17, 2018, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-metricbeat-logs-rotation/144744 "2018-08-17T13:53:17Z")
Hello everyone, On my server, I've Filebeat and Metricbeat installed by RPM. So I have folders in /etc for each product : /etc/metricbeat & /etc/filebeat. My question is about the log rotation : I have searched in the… --- ## [Filbeat autodiscover ssl options](https://discuss.elastic.co/t/filbeat-autodiscover-ssl-options/144899)
**Author:** [@John\_Doe2](https://discuss.elastic.co/u/John_Doe2)\ **Replies:** 0\ **Last updated:** [August 17, 2018, 12:37pm UTC](https://discuss.elastic.co/t/filbeat-autodiscover-ssl-options/144899 "2018-08-17T12:37:39Z")
I have filbeat running as an docker container and want to use the autodiscover to gather the container logs. My Docker daemon is secured, as described here: Protect the Docker daemon socket | Docker Docs where can i set… --- ## [How to set "\_id" value in elasticsearch document as my custom document id](https://discuss.elastic.co/t/how-to-set-id-value-in-elasticsearch-document-as-my-custom-document-id/144644)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 5\ **Last updated:** [August 17, 2018, 12:31pm UTC](https://discuss.elastic.co/t/how-to-set-id-value-in-elasticsearch-document-as-my-custom-document-id/144644 "2018-08-17T12:31:50Z")
Hi All, We are developing a customized beats for the monitoring tool and we are capturing metrics like cpu, memory, disk etc.. Data was sending it through output logstash which is configured in beat.yml file as like bel… --- ## [Filebeat stops sending logs after kubernetes deployment restart](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-kubernetes-deployment-restart/141096)
**Author:** [@Kamil\_Glod](https://discuss.elastic.co/u/Kamil_Glod)\ **Replies:** 9\ **Last updated:** [August 17, 2018, 7:55am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-kubernetes-deployment-restart/141096 "2018-08-17T07:55:57Z")
Hi, I'm using filebeat in kubernetes cluster with autodiscovery option. When I deploy daemonset first time everything works correctly but after redeploying one of my test deployments do not send logs from new pods. Here… --- ## [Dockerizing the entire elastic stack](https://discuss.elastic.co/t/dockerizing-the-entire-elastic-stack/144655)
**Author:** [@Ji\_Ho\_Choi](https://discuss.elastic.co/u/Ji_Ho_Choi)\ **Replies:** 3\ **Last updated:** [August 17, 2018, 5:29am UTC](https://discuss.elastic.co/t/dockerizing-the-entire-elastic-stack/144655 "2018-08-17T05:29:16Z")
I am trying to dockerize elasticsearch, kibana, logstash, metricbeat, packetbeat, postgresql and redis I have a configuration file looking like below version: '3' services: redis: build: ./docker/redis postgre… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=425) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=427)