# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=430 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 431 --- ## [Connecting metricbeat to microservices](https://discuss.elastic.co/t/connecting-metricbeat-to-microservices/140001)
**Author:** [@shubhamh](https://discuss.elastic.co/u/shubhamh)\ **Replies:** 3\ **Last updated:** [August 7, 2018, 1:12pm UTC](https://discuss.elastic.co/t/connecting-metricbeat-to-microservices/140001 "2018-08-07T13:12:03Z")
Hello, I am looking to connect Metricbeat with multiple microservices on a node. Each microservice is running jolokia and we are looking to pull all of that data into metricbeat. We currently have metricbeat setup to mo… --- ## [Doubling nginx logs](https://discuss.elastic.co/t/doubling-nginx-logs/143131)
**Author:** [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Replies:** 1\ **Last updated:** [August 7, 2018, 12:20pm UTC](https://discuss.elastic.co/t/doubling-nginx-logs/143131 "2018-08-07T12:20:54Z")
Hello! I have used tutorial for parsing nginx logs from Kibana tutorial page: http://localhost:5601/app/kibana#/home/tutorial/nginxLogs?\_g=() for DEB system. And everthing is working fine. But in Kibana all my logs hav… --- ## [Enabling nginx module in filebeat on docker](https://discuss.elastic.co/t/enabling-nginx-module-in-filebeat-on-docker/143256)
**Author:** [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Replies:** 2\ **Last updated:** [August 7, 2018, 12:10pm UTC](https://discuss.elastic.co/t/enabling-nginx-module-in-filebeat-on-docker/143256 "2018-08-07T12:10:50Z")
Hello! I have run filebeat on docker by a custom image. Its Dockerfile is: FROM docker.elastic.co/beats/filebeat:6.3.1 COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root RUN filebeat modules enable nginx RUN … --- ## [Filebeat 6.3.0 is taking too much of memory on windows 2008R2](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715)
**Author:** [@Junble](https://discuss.elastic.co/u/Junble)\ **Replies:** 9\ **Last updated:** [August 7, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715 "2018-08-07T11:50:36Z")
hi: I've set up a filebeat service（version 6.3.0） running on windows2008 R2. I found the memory has gone up all the time Does filebeat have potential memory leaks? Rotated file： filebeat.yml: queue.mem: events… --- ## [Does auditbeat require logstash?](https://discuss.elastic.co/t/does-auditbeat-require-logstash/142946)
**Author:** [@Guillaume\_Bettayeb](https://discuss.elastic.co/u/Guillaume_Bettayeb)\ **Replies:** 2\ **Last updated:** [August 7, 2018, 9:18am UTC](https://discuss.elastic.co/t/does-auditbeat-require-logstash/142946 "2018-08-07T09:18:43Z")
Hi everyone, Not sure what I am doing wrong here, but it seems to me that auditbeat is correctly configured although it does not send anything to ElasticSearch. Here's my auditbeat logs: 2018/08/03 16:12:45.328929 bea… --- ## [Incorrect field type](https://discuss.elastic.co/t/incorrect-field-type/141585)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 8\ **Last updated:** [August 7, 2018, 7:34am UTC](https://discuss.elastic.co/t/incorrect-field-type/141585 "2018-08-07T07:34:16Z")
Hi Team, I am working something with (semi apache access log), copied below and i have also published my logstash conf file, i could see bytes,IP,date and respsonse code usually considerd as strings in kibana. I am able… --- ## [Output with index got error](https://discuss.elastic.co/t/output-with-index-got-error/142873)
**Author:** [@cythwell](https://discuss.elastic.co/u/cythwell)\ **Replies:** 8\ **Last updated:** [August 7, 2018, 7:06am UTC](https://discuss.elastic.co/t/output-with-index-got-error/142873 "2018-08-07T07:06:13Z")
I am using filebeat to collect nginx log and sent to ealsticsearch. when config output.elasticsearch.index as : index: "onwards" , everything is fine, and kibana can catch the message. But when I change "onwards"… --- ## [Specifying complex objects in environment variable doesn't work with Logstash output](https://discuss.elastic.co/t/specifying-complex-objects-in-environment-variable-doesnt-work-with-logstash-output/142824)
**Author:** [@Alsheh](https://discuss.elastic.co/u/Alsheh)\ **Replies:** 5\ **Last updated:** [August 6, 2018, 10:50pm UTC](https://discuss.elastic.co/t/specifying-complex-objects-in-environment-variable-doesnt-work-with-logstash-output/142824 "2018-08-06T22:50:55Z")
Hi, I tried to follow the example provided in the filebeat docs to specify complex objects in environment variables (array of LS hosts in my case) for logstash output but filebeat exits with the following error message… --- ## [Guide for installing winlogbeat on Windows Server 2016](https://discuss.elastic.co/t/guide-for-installing-winlogbeat-on-windows-server-2016/143062)
**Author:** [@Emersumbigens](https://discuss.elastic.co/u/Emersumbigens)\ **Replies:** 1\ **Last updated:** [August 6, 2018, 10:31pm UTC](https://discuss.elastic.co/t/guide-for-installing-winlogbeat-on-windows-server-2016/143062 "2018-08-06T22:31:03Z")
I'm trying to get winlogbeats installed on a few of my Windows machines. I have ELK installed on a remote Redhat instance and am wanting the windows logs to be sent to Logstash. The guides I've found either not using L… --- ## [Beats Homepage UI](https://discuss.elastic.co/t/beats-homepage-ui/143200)
**Author:** [@vic18](https://discuss.elastic.co/u/vic18)\ **Replies:** 0\ **Last updated:** [August 6, 2018, 6:07pm UTC](https://discuss.elastic.co/t/beats-homepage-ui/143200 "2018-08-06T18:07:28Z")
I found the beats homepage svg annimation so cool!! Just wonder how the animation is implemented? Can anyone shed some lights or help direct it to the UI team? https://www.elastic.co/products/beats --- ## [GEO POINT Problem](https://discuss.elastic.co/t/geo-point-problem/142958)
**Author:** [@puccibox73](https://discuss.elastic.co/u/puccibox73)\ **Replies:** 1\ **Last updated:** [August 6, 2018, 9:43am UTC](https://discuss.elastic.co/t/geo-point-problem/142958 "2018-08-06T09:43:43Z")
Hallo, i'im using filebeat from my servers mainly to track access log via ssh, now I'm trying to add geoIP filter for Public Server, in order to create a map to track ssh attacks attempts, this is my filter \< filter { … --- ## [Managing Multiline logs](https://discuss.elastic.co/t/managing-multiline-logs/142888)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 6\ **Last updated:** [August 6, 2018, 9:32am UTC](https://discuss.elastic.co/t/managing-multiline-logs/142888 "2018-08-06T09:32:14Z")
Hello All, I have single file of logs in which some logs are single line and some logs are multiline logs. I have wrote the logstash filter for single line log and its working fine. But i am facing the problem while tr… --- ## [Metricbeat fail safe/over function on output](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 13\ **Last updated:** [August 6, 2018, 5:23am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466 "2018-08-06T05:23:31Z")
Is there a way in which i can save the data from metric beat even though the output destination is not available? Like for example elasticsearch host can't be reach, it will save first the data then continue once the c… --- ## [Filebeat error with freebsd](https://discuss.elastic.co/t/filebeat-error-with-freebsd/143053)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 0\ **Last updated:** [August 5, 2018, 11:39am UTC](https://discuss.elastic.co/t/filebeat-error-with-freebsd/143053 "2018-08-05T11:39:31Z")
Hello All, I run bro on Freebsd 11.2 and now I filebeat show this error : "" Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. I… --- ## [Filebeat connection to logstash during ES upgrade](https://discuss.elastic.co/t/filebeat-connection-to-logstash-during-es-upgrade/143016)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 0\ **Last updated:** [August 4, 2018, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-logstash-during-es-upgrade/143016 "2018-08-04T12:26:24Z")
Hi, I am planning ES upgrade in Tets environment. I have one question about the FB and LS connection. If I stop LS during ES upgrade duration, will al filebeat still be running, even though they don't have connection w… --- ## [FileBeat configuration test with output](https://discuss.elastic.co/t/filebeat-configuration-test-with-output/143002)
**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\ **Replies:** 0\ **Last updated:** [August 4, 2018, 5:01am UTC](https://discuss.elastic.co/t/filebeat-configuration-test-with-output/143002 "2018-08-04T05:01:49Z")
I am trying to test my configuration using filebeat test ouput -e -c filebeat.yml i see only the help message with command list. I am actually trying to output the data file to verify. Though i have tested filebeat tes… --- ## [Filebeat agent is not collecting everything](https://discuss.elastic.co/t/filebeat-agent-is-not-collecting-everything/142979)
**Author:** [@cazorino](https://discuss.elastic.co/u/cazorino)\ **Replies:** 0\ **Last updated:** [August 3, 2018, 9:44pm UTC](https://discuss.elastic.co/t/filebeat-agent-is-not-collecting-everything/142979 "2018-08-03T21:44:51Z")
Hello everybody! I'm facing a problem with filebeat recently, it's not collecting everything from the source I specified. I'm using Filebeat, Logstash, Elasticsearch and Kibana as a combo to produce useful date from II… --- ## [Metricbeat Setup not work](https://discuss.elastic.co/t/metricbeat-setup-not-work/142604)
**Author:** [@weyderfs](https://discuss.elastic.co/u/weyderfs)\ **Replies:** 5\ **Last updated:** [August 3, 2018, 5:22pm UTC](https://discuss.elastic.co/t/metricbeat-setup-not-work/142604 "2018-08-03T17:22:03Z")
Hello guys, I need help to fix this: mservice@sentinel:~$ sudo metricbeat setup Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: \[Error connection to Elasticsearch http://localhost:5044: … --- ## [WInLogBeat not sending data to kibana](https://discuss.elastic.co/t/winlogbeat-not-sending-data-to-kibana/142951)
**Author:** [@Akott](https://discuss.elastic.co/u/Akott)\ **Replies:** 0\ **Last updated:** [August 3, 2018, 4:33pm UTC](https://discuss.elastic.co/t/winlogbeat-not-sending-data-to-kibana/142951 "2018-08-03T16:33:59Z")
so i am using winlogbeat on over 38 servers and 6 are not working, everything installs fine and is the exact same on the working servers but if i run a netstat i do not see the port 5044, ive tried adding the port as a b… --- ## [Only Multiline lines that \*do\* match](https://discuss.elastic.co/t/only-multiline-lines-that-do-match/142941)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 0\ **Last updated:** [August 3, 2018, 3:49pm UTC](https://discuss.elastic.co/t/only-multiline-lines-that-do-match/142941 "2018-08-03T15:49:18Z")
Hi, I have a log like this: 2018-08-03 xxx # yyy # yyy # yyy 2018-08-03 xxx I need help with filebeat demultilining this log. I need all events starting with a number in a single line, but I need all lines from a blo… --- ## [Very slow filebeat/elasic cloud throughput](https://discuss.elastic.co/t/very-slow-filebeat-elasic-cloud-throughput/142856)
**Author:** [@Kieren\_Johnstone](https://discuss.elastic.co/u/Kieren_Johnstone)\ **Replies:** 7\ **Last updated:** [August 3, 2018, 3:26pm UTC](https://discuss.elastic.co/t/very-slow-filebeat-elasic-cloud-throughput/142856 "2018-08-03T15:26:46Z")
Here's my cluster, hosting on elastic.co: My index activity: My filebeat monitoring graphs: And my filebeat console output stats: 2018-08-03T07:13:28.751Z INFO \[monitoring\] log/log.go:124 Non-zero metrics in th… --- ## [System unresponsive with auditbeat running](https://discuss.elastic.co/t/system-unresponsive-with-auditbeat-running/142882)
**Author:** [@ppanagiotis](https://discuss.elastic.co/u/ppanagiotis)\ **Replies:** 7\ **Last updated:** [August 3, 2018, 2:54pm UTC](https://discuss.elastic.co/t/system-unresponsive-with-auditbeat-running/142882 "2018-08-03T14:54:22Z")
I've setup Auditbeat to report to an elasticsearch cluster. If the elasticsearch index state is RED auditbeat occasionally makes the whole system unresponsive for 1 minute. logs: 2018-08-03T12:29:45.951+0300 DEBUG \[ela… --- ## [Winlogbeat performance issue](https://discuss.elastic.co/t/winlogbeat-performance-issue/142779)
**Author:** [@Tim\_P](https://discuss.elastic.co/u/Tim_P)\ **Replies:** 4\ **Last updated:** [August 3, 2018, 2:51pm UTC](https://discuss.elastic.co/t/winlogbeat-performance-issue/142779 "2018-08-03T14:51:09Z")
Hi, We forward all our very busy Active Directory Event logs to a single host, I then am trying to read these forwarded event logs using winlogbeat but I seem to hit a problem that it's just ignoring messages. I have n… --- ## [REDIS Module : harvester/registry.go:83 Error running input: error receiving slowlog data: dial tcp 127.0.0.1:6379](https://discuss.elastic.co/t/redis-module-harvester-registry-go-83-error-running-input-error-receiving-slowlog-data-dial-tcp-127-0-0-1-6379/141987)
**Author:** [@eric.franckx](https://discuss.elastic.co/u/eric.franckx)\ **Replies:** 4\ **Last updated:** [August 3, 2018, 2:39pm UTC](https://discuss.elastic.co/t/redis-module-harvester-registry-go-83-error-running-input-error-receiving-slowlog-data-dial-tcp-127-0-0-1-6379/141987 "2018-08-03T14:39:11Z")
Hi, just try the Redis module on a Redis server but receives error message when start: filebeat -e --modules system,redis The message in the console is the following: ERROR harvester/registry.go:83 Error run… --- ## [Postgres log preifx](https://discuss.elastic.co/t/postgres-log-preifx/142815)
**Author:** [@andreacfm](https://discuss.elastic.co/u/andreacfm)\ **Replies:** 3\ **Last updated:** [August 3, 2018, 2:38pm UTC](https://discuss.elastic.co/t/postgres-log-preifx/142815 "2018-08-03T14:38:33Z")
I am having some issue in setting up the correct PG log prefix format that is then parsable by Grok as defined in the ingest module pipeline. Any suggestion? --- ## [Filebeat 6.3.2 / Logstash 6.3.2](https://discuss.elastic.co/t/filebeat-6-3-2-logstash-6-3-2/142594)
**Author:** [@Tusune](https://discuss.elastic.co/u/Tusune)\ **Replies:** 8\ **Last updated:** [August 3, 2018, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-6-3-2-logstash-6-3-2/142594 "2018-08-03T14:27:41Z")
Hello ! Today i've tried to make filebeat (that is on one of my servers) send logs to another server, that have logstash, elasticsearch and kibana. I've got some problems and one in particular that i can't find a solut… --- ## [Each entry has multiple lines with keywords](https://discuss.elastic.co/t/each-entry-has-multiple-lines-with-keywords/142901)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 3\ **Last updated:** [August 3, 2018, 12:38pm UTC](https://discuss.elastic.co/t/each-entry-has-multiple-lines-with-keywords/142901 "2018-08-03T12:38:16Z")
Hi Guys and Gals I'm hoping that somebody has run into something similar, and can give me a hint. I have a lot of logfiles where each key is on a seperate line, and each event is seperated by a row of dashes, like this… --- ## [Issues with PGSQL-Module | Too much errors](https://discuss.elastic.co/t/issues-with-pgsql-module-too-much-errors/141768)
**Author:** [@mkr](https://discuss.elastic.co/u/mkr)\ **Replies:** 5\ **Last updated:** [August 3, 2018, 11:04am UTC](https://discuss.elastic.co/t/issues-with-pgsql-module-too-much-errors/141768 "2018-08-03T11:04:45Z")
Hi there, we recently installed Packetbeat on one of our PostgreSQL-Servers. Basicly it works. It sends things to Elasticsearch and created the Dashboards in Kibana. But in the PGSQL-Performace Dashboard it tells us tha… --- ## [Filebeat Monitoring Log files](https://discuss.elastic.co/t/filebeat-monitoring-log-files/142680)
**Author:** [@Priyaranjan\_Mudliar](https://discuss.elastic.co/u/Priyaranjan_Mudliar)\ **Replies:** 3\ **Last updated:** [August 3, 2018, 10:40am UTC](https://discuss.elastic.co/t/filebeat-monitoring-log-files/142680 "2018-08-03T10:40:07Z")
I am using filebeat to monitor log files and what i am trying to do is print only "Found Error" in another log file (using output.files option) if my log files has a message which contains "Error" string. Can someone he… --- ## [Filebeat - difference in beat\_timestamp and @timestamp](https://discuss.elastic.co/t/filebeat-difference-in-beat-timestamp-and-timestamp/142811)
**Author:** [@if-meaton](https://discuss.elastic.co/u/if-meaton)\ **Replies:** 4\ **Last updated:** [August 3, 2018, 10:39am UTC](https://discuss.elastic.co/t/filebeat-difference-in-beat-timestamp-and-timestamp/142811 "2018-08-03T10:39:14Z")
HI Guys, first, let me explain my setup. Using filebeat, Kibana and Elasticsearch 6.3.x. Windows Server (filebeat and iis module & metricsbeat) -\> Logstash Server -\> ElasticSearch \<- Kibana Configs: Filebeat.yml: #=… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=429) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=431)