# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=431 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 432 --- ## [Help with pattern](https://discuss.elastic.co/t/help-with-pattern/142892)
**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\ **Replies:** 0\ **Last updated:** [August 3, 2018, 10:22am UTC](https://discuss.elastic.co/t/help-with-pattern/142892 "2018-08-03T10:22:50Z")
Hi all, i have a log files that is composed: Thu Aug 2 21:20:53 2018 (675001) -7- XATTR(Id:304 Len:8) BUF \[ 6e 97 12 7a 00 10 00 00 \] Thu Aug 2 21:20:53 2018 (675007) -7- XATTR(Id:1027 Len:7) BUF \[ 07 e2 08 02 15 14… --- ## [Kubernetes autodiscover not shipping logs to logstash](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861)
**Author:** [@havlan](https://discuss.elastic.co/u/havlan)\ **Replies:** 3\ **Last updated:** [August 3, 2018, 10:02am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861 "2018-08-03T10:02:20Z")
Hi, I'm having issues passing logs to logstash from filebeat. Filebeat version: 6.3.2 filebeat.yml: |- logging.level: ${LOG\_LEVEL} filebeat.autodiscover: providers: - type: kubernetes in… --- ## [How to store metricbeat data in local disk](https://discuss.elastic.co/t/how-to-store-metricbeat-data-in-local-disk/142682)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 4\ **Last updated:** [August 2, 2018, 9:56am UTC](https://discuss.elastic.co/t/how-to-store-metricbeat-data-in-local-disk/142682 "2018-08-02T09:56:40Z")
Hi All, We had a discussion in meeting about the metricbeat data sending through elasticsearch output and if the output elasticsearch is went down where the metric data will store? I was reading this article, https://… --- ## [Filbeat's system modules doesnt present on kibana](https://discuss.elastic.co/t/filbeats-system-modules-doesnt-present-on-kibana/142717)
**Author:** [@Dimas\_Djs](https://discuss.elastic.co/u/Dimas_Djs)\ **Replies:** 6\ **Last updated:** [August 3, 2018, 2:18am UTC](https://discuss.elastic.co/t/filbeats-system-modules-doesnt-present-on-kibana/142717 "2018-08-03T02:18:26Z")
Hi there. Im trying to configure my elk stack, with filebeat as shipping log. When i've configured my filebeat system modules, the log doesnt present on kibana, in same time i alse configure filebeat's nginx modules, a… --- ## [2nd Winlogbeat Install same as the first...this one doesn't work](https://discuss.elastic.co/t/2nd-winlogbeat-install-same-as-the-first-this-one-doesnt-work/142764)
**Author:** [@JustTheDr](https://discuss.elastic.co/u/JustTheDr)\ **Replies:** 6\ **Last updated:** [August 2, 2018, 7:26pm UTC](https://discuss.elastic.co/t/2nd-winlogbeat-install-same-as-the-first-this-one-doesnt-work/142764 "2018-08-02T19:26:27Z")
I installed a Winlogbeat on my Windows 10 PC and everything was zen. I installed another on a Windows Server 2012 R2 Server and followed the same steps. I copied the contents of the winlogbeat.yml file from my first in… --- ## [Filebeat autodiscovery appenders](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619)
**Author:** [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\ **Replies:** 8\ **Last updated:** [August 2, 2018, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619 "2018-08-02T17:09:45Z")
Hi there, I am using filebeat with autodiscovery and would like to use appenders. However the appender config is not being applied. This is my filebeat.yml config. filebeat.autodiscover: providers: - type: kube… --- ## [Not showing data from last 15 minutes](https://discuss.elastic.co/t/not-showing-data-from-last-15-minutes/141644)
**Author:** [@cazorino](https://discuss.elastic.co/u/cazorino)\ **Replies:** 7\ **Last updated:** [August 2, 2018, 4:05pm UTC](https://discuss.elastic.co/t/not-showing-data-from-last-15-minutes/141644 "2018-08-02T16:05:44Z")
Hello ELK community! I'm facing a trouble when trying to view data received from last 15 minutes in Kibana. My server is working with Logstash, Elasticsearch and Kibana 6.3.0, the agent responsible for sending me IIS lo… --- ## [Beats Default Template Mappings for IP Fields](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 2\ **Last updated:** [August 2, 2018, 3:47pm UTC](https://discuss.elastic.co/t/beats-default-template-mappings-for-ip-fields/142644 "2018-08-02T15:47:00Z")
I've noticed that a lot of the beats default templates have IP fields as the keyword datatype. Since elasticsearch supports an ip datatype, which makes subnet mask filtering/searching really handy, I would think you woul… --- ## [Ingest Pipeline does not update on filebeat setup](https://discuss.elastic.co/t/ingest-pipeline-does-not-update-on-filebeat-setup/142769)
**Author:** [@Tethik](https://discuss.elastic.co/u/Tethik)\ **Replies:** 3\ **Last updated:** [August 2, 2018, 2:27pm UTC](https://discuss.elastic.co/t/ingest-pipeline-does-not-update-on-filebeat-setup/142769 "2018-08-02T14:27:59Z")
I'm trying to develop two new modules for filebeat, but ran into issues as I was trying to update my pipelines after some trial and error. It seems like they don't update like they should, so this could be a potential is… --- ## [Filebeat issues - geoip installation error](https://discuss.elastic.co/t/filebeat-issues-geoip-installation-error/137911)
**Author:** [@pge](https://discuss.elastic.co/u/pge)\ **Replies:** 4\ **Last updated:** [August 2, 2018, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-issues-geoip-installation-error/137911 "2018-08-02T14:21:07Z")
Hi all, on centos 7.5 I have to test filebeat 6.3.0. After rhe installation i have problems with geoip plugin. On filebeat log i have this message: 2018-06-28T16:23:04.673+0200 ERROR pipeline/output.go:74 Faile… --- ## [Logstash not recording beats from remote systems](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768)
**Author:** [@nansari](https://discuss.elastic.co/u/nansari)\ **Replies:** 1\ **Last updated:** [August 2, 2018, 1:22pm UTC](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768 "2018-08-02T13:22:29Z")
My Logstash 6+ is able to parse and show logs from various beats running on the same server, however it is not showing me logs from any remote systems. I have verified connectivity to port 5044. In the Logstash logs, i s… --- ## [Multiline is not getting added to the "tag" field](https://discuss.elastic.co/t/multiline-is-not-getting-added-to-the-tag-field/142377)
**Author:** [@Emanuel9](https://discuss.elastic.co/u/Emanuel9)\ **Replies:** 3\ **Last updated:** [August 2, 2018, 10:28am UTC](https://discuss.elastic.co/t/multiline-is-not-getting-added-to-the-tag-field/142377 "2018-08-02T10:28:26Z")
This post says that multiline got added to the tags field. Sadly, it doesn't work for me. When I view the processed multiline message in kibana, the tags field says "beats\_input\_codec\_plain\_applied". I need to do some s… --- ## [Metricbeat failing to pick some mount points under system.filesystem.mount\_point](https://discuss.elastic.co/t/metricbeat-failing-to-pick-some-mount-points-under-system-filesystem-mount-point/142526)
**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 2\ **Last updated:** [August 2, 2018, 7:07am UTC](https://discuss.elastic.co/t/metricbeat-failing-to-pick-some-mount-points-under-system-filesystem-mount-point/142526 "2018-08-02T07:07:26Z")
I am running metricbeat 6.3.0, below is my metricbeat.yml file: #========================== Modules configuration ============================ metricbeat.modules: #------------------------------- System Module -------… --- ## [Multiline for FileBeat](https://discuss.elastic.co/t/multiline-for-filebeat/142275)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 2\ **Last updated:** [August 2, 2018, 4:52am UTC](https://discuss.elastic.co/t/multiline-for-filebeat/142275 "2018-08-02T04:52:22Z")
Hi All, I have tomcat access logs to be combined in a single event using multi-line via filebeat , Below are kind of access logs , 99.99.999.99 - - \[30/Jul/2018:08:38:37 +0200\] "GET /healthcheck/ HTTP/1.1" 200 29 99.… --- ## [Filebeat in endless loop](https://discuss.elastic.co/t/filebeat-in-endless-loop/142445)
**Author:** [@Ray\_Kim](https://discuss.elastic.co/u/Ray_Kim)\ **Replies:** 3\ **Last updated:** [August 2, 2018, 1:10am UTC](https://discuss.elastic.co/t/filebeat-in-endless-loop/142445 "2018-08-02T01:10:19Z")
I have filebeat reading s3 logs but it sometimes get stuck in an endless loop and sometimes it just hangs and (rarely) goes as expected. filebeat.prospectors: - type: log enabled: true paths: - /home/linux/logs/… --- ## [1GB single json record](https://discuss.elastic.co/t/1gb-single-json-record/142512)
**Author:** [@mulderyang](https://discuss.elastic.co/u/mulderyang)\ **Replies:** 2\ **Last updated:** [August 2, 2018, 12:23am UTC](https://discuss.elastic.co/t/1gb-single-json-record/142512 "2018-08-02T00:23:09Z")
Hi all, We are trying to let the filebeat to collect a json file. Which is a single record json file, but it got 1GB file size. We tried filebeat send to logstash also the filebeat send to ES directly. Unfortunately … --- ## [Custom elasticsearch template](https://discuss.elastic.co/t/custom-elasticsearch-template/142643)
**Author:** [@Brandon\_Metcalf](https://discuss.elastic.co/u/Brandon_Metcalf)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 8:45pm UTC](https://discuss.elastic.co/t/custom-elasticsearch-template/142643 "2018-08-01T20:45:50Z")
I'm trying to load a custom elasticsearch template when filebeat starts up. The relevant part of my latest filebeat.yml looks like: output.elasticsearch: enabled: true hosts: \["\<%= @elasticsearch %\>:443"\] protoco… --- ## [Filebeat custom module for nodejs logs](https://discuss.elastic.co/t/filebeat-custom-module-for-nodejs-logs/142626)
**Author:** [@Jogendra\_Jangid](https://discuss.elastic.co/u/Jogendra_Jangid)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 7:08pm UTC](https://discuss.elastic.co/t/filebeat-custom-module-for-nodejs-logs/142626 "2018-08-01T19:08:31Z")
Hi All, I trying to write a custom module for file beat that can send Nodejs application logs directory to elasticsearch. It's showing me below error on the execution using the plugin. 2018-08-01T22:05:12.348+0530 ERRO… --- ## [Timestamp in json logs](https://discuss.elastic.co/t/timestamp-in-json-logs/142438)
**Author:** [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Replies:** 8\ **Last updated:** [August 1, 2018, 6:49pm UTC](https://discuss.elastic.co/t/timestamp-in-json-logs/142438 "2018-08-01T18:49:54Z")
Hi, I am using Ossec https://www.ossec.net/docs/ to log alerts locally to alerts.json which already has a timestamp in the log. Can I use this timestamp in the logstash output to elastic ? The input is below. All my … --- ## [Upgrade filebeat,metricbeat and winlogbeat from 5.5.1 version to 6.2.3 version in windows servers](https://discuss.elastic.co/t/upgrade-filebeat-metricbeat-and-winlogbeat-from-5-5-1-version-to-6-2-3-version-in-windows-servers/142574)
**Author:** [@savvy](https://discuss.elastic.co/u/savvy)\ **Replies:** 3\ **Last updated:** [August 1, 2018, 6:19pm UTC](https://discuss.elastic.co/t/upgrade-filebeat-metricbeat-and-winlogbeat-from-5-5-1-version-to-6-2-3-version-in-windows-servers/142574 "2018-08-01T18:19:57Z")
Hello, I am trying to upgrade my beats agents from 5.5.1 version to 6.2.3. What I am doing is : 1\> stop agent 2\> run uninstall script 3\> copy the new version beats (filebeat, metricbeat, winlogbeat) folder to c:/Progra… --- ## [Multiple filebeats to logstash](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 5:47pm UTC](https://discuss.elastic.co/t/multiple-filebeats-to-logstash/142628 "2018-08-01T17:47:40Z")
Hello there, I'm new to ELK on AWS, I have set up an ELK cluster on one node/EC2 instance (may expand later). Also I set up a linux server(EC2 instance) with filebeat and metricbeat running and sending logs and metrics … --- ## [Filebeat configuration: clean\_\*](https://discuss.elastic.co/t/filebeat-configuration-clean/142553)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 4:56pm UTC](https://discuss.elastic.co/t/filebeat-configuration-clean/142553 "2018-08-01T16:56:30Z")
Is there a chance to clean the state of file or filebeat won't re-read the file again after the close\_eof is reached? How? Thanks. --- ## [Filebeat Field Mapping For JSON Logs](https://discuss.elastic.co/t/filebeat-field-mapping-for-json-logs/142517)
**Author:** [@John\_Slater](https://discuss.elastic.co/u/John_Slater)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 4:12pm UTC](https://discuss.elastic.co/t/filebeat-field-mapping-for-json-logs/142517 "2018-08-01T16:12:01Z")
I have created a Spring application which outputs logfiles as JSON after attending an Elasticsearch meetup which is based on. https://github.com/xeraa/microservice-monitoring However when Filebeats creates the index te… --- ## [Filebeat Loadbalancing not working](https://discuss.elastic.co/t/filebeat-loadbalancing-not-working/142478)
**Author:** [@hangstl](https://discuss.elastic.co/u/hangstl)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-loadbalancing-not-working/142478 "2018-08-01T16:02:47Z")
I have setup a Logstash Cluster in Google Cloud that sits behind a Load Balancer and uses Autoscaling (-\> when the load gets to high new instances are started up automatically). Unfortunately this does not work properly… --- ## [Thrift parse exception | runtime error: index out of range](https://discuss.elastic.co/t/thrift-parse-exception-runtime-error-index-out-of-range/142467)
**Author:** [@npallavi](https://discuss.elastic.co/u/npallavi)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 4:01pm UTC](https://discuss.elastic.co/t/thrift-parse-exception-runtime-error-index-out-of-range/142467 "2018-08-01T16:01:20Z")
Hi, Packetbeat is continuosly throwing the following exception for thrift-rpc monitoring: ERROR runtime/panic.go:28 ParseThrift exception. Recovering, but please report this.{"panic": "runtime error: index out of… --- ## [Elasticsearch indexing JSON Log Files in a Folder](https://discuss.elastic.co/t/elasticsearch-indexing-json-log-files-in-a-folder/142578)
**Author:** [@emincan\_sahin](https://discuss.elastic.co/u/emincan_sahin)\ **Replies:** 1\ **Last updated:** [August 1, 2018, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-json-log-files-in-a-folder/142578 "2018-08-01T13:50:51Z")
json log files are located in the folde, want to index these files elasticsearh . first time I use ElasticSearch. Could you explain it in a simple way. Thank you --- ## [Filebeat Error decoding JSON: invalid character '}' looking for beginning of value](https://discuss.elastic.co/t/filebeat-error-decoding-json-invalid-character-looking-for-beginning-of-value/142369)
**Author:** [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Replies:** 3\ **Last updated:** [August 1, 2018, 8:07am UTC](https://discuss.elastic.co/t/filebeat-error-decoding-json-invalid-character-looking-for-beginning-of-value/142369 "2018-08-01T08:07:04Z")
Hi, I have deployed filebeat 5.4.0 on a windows machine and have visualcron output logs in a JSON format, now I got these logs pushed using filebeat json format: VisualCron log example: { "timestamp":"2018-07-2… --- ## [Beats HTTP Endpoint](https://discuss.elastic.co/t/beats-http-endpoint/142453)
**Author:** [@Sanjeev\_Gopal](https://discuss.elastic.co/u/Sanjeev_Gopal)\ **Replies:** 3\ **Last updated:** [August 1, 2018, 3:23am UTC](https://discuss.elastic.co/t/beats-http-endpoint/142453 "2018-08-01T03:23:25Z")
Where can I get more information on the HTTP Endpoint feature of Beats? Specifically, I want to know what API requests it supports. I'm hoping to query it for a couple of data points - which cluster it's connected to, a… --- ## [Alert on non-reporting beats](https://discuss.elastic.co/t/alert-on-non-reporting-beats/140046)
**Author:** [@Sanjeev\_Gopal](https://discuss.elastic.co/u/Sanjeev_Gopal)\ **Replies:** 3\ **Last updated:** [July 31, 2018, 8:40pm UTC](https://discuss.elastic.co/t/alert-on-non-reporting-beats/140046 "2018-07-31T20:40:56Z")
How can I setup an alert for a non-reporting beat? In other/specific words, I need to know, ideally through Kibana, when any of the beats stops sending data. I know I can setup monitoring on the data received, but here I… --- ## [Apache/status not register](https://discuss.elastic.co/t/apache-status-not-register/142288)
**Author:** [@sicute](https://discuss.elastic.co/u/sicute)\ **Replies:** 2\ **Last updated:** [July 31, 2018, 7:37pm UTC](https://discuss.elastic.co/t/apache-status-not-register/142288 "2018-07-31T19:37:36Z")
Hi ... I try active metricbeat module apache , but get some error . sudo metricbeat modules list Enabled: apache system Disabled: aerospike ceph couchbase docker dropwizard elasticsearch etcd golang graph… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=430) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=432)