# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=428 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 429 --- ## [Restrict/Remove unnecessary fields in MetricBeat](https://discuss.elastic.co/t/restrict-remove-unnecessary-fields-in-metricbeat/144198)
**Author:** [@Vijay\_Chander](https://discuss.elastic.co/u/Vijay_Chander)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 11:17am UTC](https://discuss.elastic.co/t/restrict-remove-unnecessary-fields-in-metricbeat/144198 "2018-08-14T11:17:09Z")
Regarding your solution here, I've tried the same but got no luck. (https://discuss.elastic.co/t/restrict-remove-unnecessary-fields-in-metricbeat/144193) I've enabled only System, CPU, Memory, Process Status/Modules. I… --- ## [Filebeat with custom module at kubernetes](https://discuss.elastic.co/t/filebeat-with-custom-module-at-kubernetes/143975)
**Author:** [@mvasilenko](https://discuss.elastic.co/u/mvasilenko)\ **Replies:** 5\ **Last updated:** [August 14, 2018, 10:36am UTC](https://discuss.elastic.co/t/filebeat-with-custom-module-at-kubernetes/143975 "2018-08-14T10:36:59Z")
Hi I'm running filebeat with custom module on Linux nodes, and want to run it at self-hosted kubernetes cluster, is it possible? Thank you --- ## [Is it support to set regular expressions in tcp check \`\`check.receive\`\`?](https://discuss.elastic.co/t/is-it-support-to-set-regular-expressions-in-tcp-check-check-receive/144273)
**Author:** [@tuxknight](https://discuss.elastic.co/u/tuxknight)\ **Replies:** 2\ **Last updated:** [August 14, 2018, 9:59am UTC](https://discuss.elastic.co/t/is-it-support-to-set-regular-expressions-in-tcp-check-check-receive/144273 "2018-08-14T09:59:40Z")
Is it support to set regular expressions in tcp check check.receive ? --- ## [Writing the Filebeat Registry](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289)
**Author:** [@Christian\_Wohrle](https://discuss.elastic.co/u/Christian_Wohrle)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 7:27am UTC](https://discuss.elastic.co/t/writing-the-filebeat-registry/144289 "2018-08-14T07:27:51Z")
Hi, I´m using filebeat 6.3.2 in a docker container. Shipping Logs works, and it looks the registry /usr/share/filebeat/data/registry is updated (timestamp increases, length changes). But I´m getting these errors every… --- ## [Monitor uncommon ports](https://discuss.elastic.co/t/monitor-uncommon-ports/144231)
**Author:** [@pclaudiowsi](https://discuss.elastic.co/u/pclaudiowsi)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 10:45pm UTC](https://discuss.elastic.co/t/monitor-uncommon-ports/144231 "2018-08-13T22:45:22Z")
Hi, I'm trying to configure packet beat on a linux server that is trying to remotely access the Microsoft's Windows Management Instrumentation (wmi). How can I configure the packetbeat.protocols section to monitor ports… --- ## [How to manually install winlogbeat template and dashboard?](https://discuss.elastic.co/t/how-to-manually-install-winlogbeat-template-and-dashboard/143625)
**Author:** [@lucasjkr](https://discuss.elastic.co/u/lucasjkr)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 8:04pm UTC](https://discuss.elastic.co/t/how-to-manually-install-winlogbeat-template-and-dashboard/143625 "2018-08-13T20:04:00Z")
I don't want my Elastic server exposed to the network, only through logstash; There are instructions for manually exporting and importing metricbeat templates and dashboards, which isn't AS important as I can do that fr… --- ## [Multi-File configuration](https://discuss.elastic.co/t/multi-file-configuration/142868)
**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\ **Replies:** 6\ **Last updated:** [August 13, 2018, 4:42pm UTC](https://discuss.elastic.co/t/multi-file-configuration/142868 "2018-08-13T16:42:37Z")
My filebeat.yml configuration is as below : output.logstash: hosts: \["localhost:5044"\] filebeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.template.settings: index.number… --- ## [Filebeat - Should metadata overwrite event data?](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919)
**Author:** [@jaquisar1](https://discuss.elastic.co/u/jaquisar1)\ **Replies:** 1\ **Last updated:** [August 13, 2018, 4:35pm UTC](https://discuss.elastic.co/t/filebeat-should-metadata-overwrite-event-data/143919 "2018-08-13T16:35:59Z")
Hi! I'm having an issue with Filebeat 6.3.2, basically because of: https://github.com/elastic/beats/pull/7051 and I'm thinking weather this is a bug, a feature or just an inconvenience. Basically, my input configuratio… --- ## [Mongodb parset timestamp is wrong](https://discuss.elastic.co/t/mongodb-parset-timestamp-is-wrong/144164)
**Author:** [@meritus](https://discuss.elastic.co/u/meritus)\ **Replies:** 1\ **Last updated:** [August 13, 2018, 3:25pm UTC](https://discuss.elastic.co/t/mongodb-parset-timestamp-is-wrong/144164 "2018-08-13T15:25:42Z")
Hi All. I recently tried to start mongodb filebeat plugin (v 6.3.2) To my surprise, all parsed logs appears as from Jan this year (day is correct). json doc stored in ES (anonymized) { "\_index": "filebeat-mongodb-… --- ## [Filebeat not detecting log files](https://discuss.elastic.co/t/filebeat-not-detecting-log-files/143939)
**Author:** [@perryparktung](https://discuss.elastic.co/u/perryparktung)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-not-detecting-log-files/143939 "2018-08-13T12:58:56Z")
Hi, I am setting my filebeat on Windows, but for somehow it did not detect the files in the path I configured in filebeat.yml. I do have .log files in c:\\var\\logs\\oob-demo\\ , but apparently those were not detected. An… --- ## [MetricLogBeats To LogStash connection issue](https://discuss.elastic.co/t/metriclogbeats-to-logstash-connection-issue/143881)
**Author:** [@ConorTier](https://discuss.elastic.co/u/ConorTier)\ **Replies:** 5\ **Last updated:** [August 13, 2018, 11:23am UTC](https://discuss.elastic.co/t/metriclogbeats-to-logstash-connection-issue/143881 "2018-08-13T11:23:35Z")
Hi, Im having an issue with MetricLogBeats. Within metricbeat.log file I see the following: (IP address removed from logs for personal reasons) 2018-08-10T09:56:47.937-0400|ERROR|logstash/async.go:235|Failed to publish… --- ## [Grok from nginx-module gets error](https://discuss.elastic.co/t/grok-from-nginx-module-gets-error/143473)
**Author:** [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 9:52am UTC](https://discuss.elastic.co/t/grok-from-nginx-module-gets-error/143473 "2018-08-13T09:52:51Z")
Hello! I have nginx-module enabled in filebeat.yml: filebeat.modules: - module: nginx access: var.paths: \["/testvar/nginx/access.log"\] error: var.paths: \["/testvar/nginx/error.log"\] output.elasticsearch: … --- ## [Filter logs from NGINX module](https://discuss.elastic.co/t/filter-logs-from-nginx-module/143305)
**Author:** [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 9:40am UTC](https://discuss.elastic.co/t/filter-logs-from-nginx-module/143305 "2018-08-13T09:40:16Z")
Hello I am using the NGINX module for Filebeat. Is there a way to filter logs on the machine before it's sent to Elasticsearch? I much rather carry on using the module than parsing everything through Logstash while usi… --- ## [Setting inside config file not work](https://discuss.elastic.co/t/setting-inside-config-file-not-work/143838)
**Author:** [@cythwell](https://discuss.elastic.co/u/cythwell)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 7:28am UTC](https://discuss.elastic.co/t/setting-inside-config-file-not-work/143838 "2018-08-13T07:28:11Z")
Hi, I am trying set up the following. Unfortunately the setting of "setup.template.settings" not work.. After index created, the number\_of\_share still set to default 3, and the refresh\_interval default as 5s. Is the… --- ## [Filebeat failed to parse JSON with nested object](https://discuss.elastic.co/t/filebeat-failed-to-parse-json-with-nested-object/140209)
**Author:** [@grigory](https://discuss.elastic.co/u/grigory)\ **Replies:** 9\ **Last updated:** [August 12, 2018, 10:17pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-parse-json-with-nested-object/140209 "2018-08-12T22:17:18Z")
Hi, I am trying to configure Filebeat to parse json logs produced by one of my service. Everything works find if log message has one level properties only. But if I include custom payload(nested object) Filebeat always … --- ## [Filebeat: tcp xx.xx.xx.xx:5044: i/o timeout](https://discuss.elastic.co/t/filebeat-tcp-xx-xx-xx-xx-i-o-timeout/142832)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 5\ **Last updated:** [August 12, 2018, 8:14pm UTC](https://discuss.elastic.co/t/filebeat-tcp-xx-xx-xx-xx-i-o-timeout/142832 "2018-08-12T20:14:38Z")
Hello, I'm new to ELK and beats, I set up filebeat and merticbeat on 2 linux servers to send logs/metrics to Logstash on another server in our AWS Clould. On one of the beat servers, beats work fine and send data to lo… --- ## [Iis error default pipeline -- grok pattern fails for malformed url paths](https://discuss.elastic.co/t/iis-error-default-pipeline-grok-pattern-fails-for-malformed-url-paths/143944)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 2\ **Last updated:** [August 11, 2018, 3:33am UTC](https://discuss.elastic.co/t/iis-error-default-pipeline-grok-pattern-fails-for-malformed-url-paths/143944 "2018-08-11T03:33:57Z")
I have filebeat installed with the iis module, and it is using the default iis error pipeline for the HTTPERR log files. A few of the error logs have malformed urls, which the grok patterns don't match. here's the grok… --- ## [Apache access log request grok failure](https://discuss.elastic.co/t/apache-access-log-request-grok-failure/143823)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [August 10, 2018, 3:59pm UTC](https://discuss.elastic.co/t/apache-access-log-request-grok-failure/143823 "2018-08-10T15:59:01Z")
Hello, Using the standard apache2 module for Apache access logs, I get Provided Grok expressions do not match field value errors for example with: \[10/Aug/2018:09:45:56 +0200\] 172.30.0.119 TLSv1.2 ECDHE-RSA-AES128-GCM… --- ## [Winlogbeat Throughput Seems Low](https://discuss.elastic.co/t/winlogbeat-throughput-seems-low/142966)
**Author:** [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Replies:** 2\ **Last updated:** [August 10, 2018, 2:54pm UTC](https://discuss.elastic.co/t/winlogbeat-throughput-seems-low/142966 "2018-08-10T14:54:45Z")
We are running a POC with beats to see if it can replace our current connector infrastructure. We can't seem to get winlogbeat to get past 1,500-2,000 eps. Our current connectors are able to peak at about 3k...Any sugges… --- ## [Filebeat.yml ignoring path.home](https://discuss.elastic.co/t/filebeat-yml-ignoring-path-home/143795)
**Author:** [@Tom\_Motley](https://discuss.elastic.co/u/Tom_Motley)\ **Replies:** 2\ **Last updated:** [August 10, 2018, 1:27pm UTC](https://discuss.elastic.co/t/filebeat-yml-ignoring-path-home/143795 "2018-08-10T13:27:19Z")
I am running Filebeat 6.2.4 on my local Mac OS, installed via Homebrew. When I run FB, it ignores my path.home declaration in my filebeat.yml file. However, I can verify that yml is being parsed and read, because if I i… --- ## [Attempting to compile filebeat in AIX](https://discuss.elastic.co/t/attempting-to-compile-filebeat-in-aix/143378)
**Author:** [@arlequin](https://discuss.elastic.co/u/arlequin)\ **Replies:** 4\ **Last updated:** [August 10, 2018, 1:20pm UTC](https://discuss.elastic.co/t/attempting-to-compile-filebeat-in-aix/143378 "2018-08-10T13:20:13Z")
Hello, I've been reading the entries in this forum regarding filebeat compilation using go (gccgo) in AIX. I am able to compile a hello-world.go program in AIX, dynamically or statically linked but no way to find a wor… --- ## [Dockerized Filebeat not sending logs to Logstash](https://discuss.elastic.co/t/dockerized-filebeat-not-sending-logs-to-logstash/143744)
**Author:** [@Derek\_Stevens](https://discuss.elastic.co/u/Derek_Stevens)\ **Replies:** 2\ **Last updated:** [August 10, 2018, 12:19pm UTC](https://discuss.elastic.co/t/dockerized-filebeat-not-sending-logs-to-logstash/143744 "2018-08-10T12:19:32Z")
Hello! I'm attempting to setup Filebeat to send logs to Logstash. Everything is running in docker, so I'm attempting to use the autodiscover feature. I'm using v6.3.2 across the board. I can see the index in kibana for… --- ## [A panic of dumplicated kafka output](https://discuss.elastic.co/t/a-panic-of-dumplicated-kafka-output/143645)
**Author:** [@yuz11](https://discuss.elastic.co/u/yuz11)\ **Replies:** 5\ **Last updated:** [August 10, 2018, 11:50am UTC](https://discuss.elastic.co/t/a-panic-of-dumplicated-kafka-output/143645 "2018-08-10T11:50:54Z")
I get this panic as below,it happens when my filebeat kafka output module is reconnecting the kafka server as the Cloud server of kafka connection is not stable or server is restarted(cloud service,out of our control.Sad… --- ## [Help with Detecting DNS Tunnels with PacketBeat + Watcher](https://discuss.elastic.co/t/help-with-detecting-dns-tunnels-with-packetbeat-watcher/143537)
**Author:** [@Madhu\_Neal1](https://discuss.elastic.co/u/Madhu_Neal1)\ **Replies:** 4\ **Last updated:** [August 10, 2018, 11:32am UTC](https://discuss.elastic.co/t/help-with-detecting-dns-tunnels-with-packetbeat-watcher/143537 "2018-08-10T11:32:00Z")
Hi @andrewkroh - Hope you doing good! I would require your help to build Detecting DNS Tunnels with PacketBeat+Watcher using ELK stack 6.0; I believe the current example which is not supported to use in the 6.x stack. W… --- ## [Add\_docker\_metadata failing to get container id if logs are in different path](https://discuss.elastic.co/t/add-docker-metadata-failing-to-get-container-id-if-logs-are-in-different-path/143452)
**Author:** [@somelifeDev](https://discuss.elastic.co/u/somelifeDev)\ **Replies:** 5\ **Last updated:** [August 10, 2018, 6:30am UTC](https://discuss.elastic.co/t/add-docker-metadata-failing-to-get-container-id-if-logs-are-in-different-path/143452 "2018-08-10T06:30:58Z")
Setup: docker logs are not in the default folder "/var/lib/docker/containers//-json.log" but in "/home/var/docker/data/containers//-json.log" Filebeat works just fine and pushes docker logs into elasticsearch Problem: … --- ## [Frequent restarts - kubernetes\_metadata](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743)
**Author:** [@Raj\_Etta](https://discuss.elastic.co/u/Raj_Etta)\ **Replies:** 1\ **Last updated:** [August 10, 2018, 6:27am UTC](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743 "2018-08-10T06:27:20Z")
Used the daemonset yaml at https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml with following added to filebeat-prospector(Version 6.2.4 and tried 6.3 also) metadata: name… --- ## [Geoip NOT WORKING HELP](https://discuss.elastic.co/t/geoip-not-working-help/143445)
**Author:** [@leea](https://discuss.elastic.co/u/leea)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 8:02pm UTC](https://discuss.elastic.co/t/geoip-not-working-help/143445 "2018-08-09T20:02:10Z")
Input.conf input { beats{ port =\> 5044 type =\> "ioc" } beats{ port =\> 5043 type =\> "packetbeat" } beats{ port =\> 5045 type =\> "snort" } } logstash.conf filter { date{ match =\> \["timestamp", "dd/MM/yyy:H… --- ## [Json logs separated by blank lines](https://discuss.elastic.co/t/json-logs-separated-by-blank-lines/143523)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 7:55pm UTC](https://discuss.elastic.co/t/json-logs-separated-by-blank-lines/143523 "2018-08-09T19:55:15Z")
i have a json log file, where each entry is separated by a blank line {"@timestamp":1456544565,"valid\_domain":true,"ip":"8.8.8.8"} {"@timestamp":2464564543,"valid\_domain":false,"ip":"1.2.3.4"} {"@timestamp":3454678735… --- ## [File beat on windows](https://discuss.elastic.co/t/file-beat-on-windows/143695)
**Author:** [@raph](https://discuss.elastic.co/u/raph)\ **Replies:** 2\ **Last updated:** [August 9, 2018, 7:02pm UTC](https://discuss.elastic.co/t/file-beat-on-windows/143695 "2018-08-09T19:02:20Z")
Hi, I'm having an issue with filebeat on windows, why this error ? thanks, and my yml file: --- ## [Unable to import kibana dashboards](https://discuss.elastic.co/t/unable-to-import-kibana-dashboards/143731)
**Author:** [@Bleyc](https://discuss.elastic.co/u/Bleyc)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 4:38pm UTC](https://discuss.elastic.co/t/unable-to-import-kibana-dashboards/143731 "2018-08-09T16:38:46Z")
hello folks, i have set up elastic, logstash, kibana and metricbeat, all running version 5.6.10 on Centos7. metricbeat is on a different node, what am trying to do is import the kibana dashboards into elastic, i tried ru… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=427) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=429)