# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=433 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 434 --- ## [How to read .gz file using filebeat?](https://discuss.elastic.co/t/how-to-read-gz-file-using-filebeat/141754)
**Author:** [@sudhish\_op](https://discuss.elastic.co/u/sudhish_op)\ **Replies:** 4\ **Last updated:** [July 27, 2018, 3:21pm UTC](https://discuss.elastic.co/t/how-to-read-gz-file-using-filebeat/141754 "2018-07-27T15:21:11Z")
My setup is working fine and able to read log files. But not able to load .gz files . Please assist. --- ## [Report additional vsphere metrics](https://discuss.elastic.co/t/report-additional-vsphere-metrics/140778)
**Author:** [@Drav3nmc](https://discuss.elastic.co/u/Drav3nmc)\ **Replies:** 3\ **Last updated:** [July 27, 2018, 11:15am UTC](https://discuss.elastic.co/t/report-additional-vsphere-metrics/140778 "2018-07-27T11:15:32Z")
It is possible to config metricbeat to collect additional vsphere performance metrics, in particular I am after the virtualmachine cpu.usage.average metric so i can display this on a kibana dashboard thanks mark --- ## [Filebeat: large json log will case OOM killed by k8s](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240)
**Author:** [@wklken](https://discuss.elastic.co/u/wklken)\ **Replies:** 3\ **Last updated:** [July 27, 2018, 3:13am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240 "2018-07-27T03:13:47Z")
Hi, Currently, I met a problem with the json log with max\_bytes limit. filebeat.yml # 100KB max\_bytes: 102400 json.message\_key: message json.add\_error\_key: true then I run it on k8s with memory limit… --- ## [Can we configure Winlogbeat to send logs to multiple Logstash instances?](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 5\ **Last updated:** [July 26, 2018, 8:46pm UTC](https://discuss.elastic.co/t/can-we-configure-winlogbeat-to-send-logs-to-multiple-logstash-instances/141840 "2018-07-26T20:46:45Z")
Hi, I just to wanted to check if we can configure Winlogbeat to send logs to multiple Logstash instances? I have two different Logstash instances which would then send logs to two different Elasticsearch clusters. So, I… --- ## [New filebeat-related log error](https://discuss.elastic.co/t/new-filebeat-related-log-error/141827)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 2\ **Last updated:** [July 26, 2018, 7:42pm UTC](https://discuss.elastic.co/t/new-filebeat-related-log-error/141827 "2018-07-26T19:42:13Z")
In trying to get all filebeat fields to show, I did something (and I don't know what it is) that now produces the following in logstash-plain.log: \[2018-07-26T12:45:12,299\]\[WARN \]\[logstash.outputs.elasticsearch\] Could n… --- ## [ELK server timing out filebeat from Windows Server](https://discuss.elastic.co/t/elk-server-timing-out-filebeat-from-windows-server/141635)
**Author:** [@mrojo](https://discuss.elastic.co/u/mrojo)\ **Replies:** 1\ **Last updated:** [July 26, 2018, 7:19pm UTC](https://discuss.elastic.co/t/elk-server-timing-out-filebeat-from-windows-server/141635 "2018-07-26T19:19:28Z")
Hello, I'm trying to establish connection between a windows box and ELK server, file beat has been successfully installed and running as a service, I'm able to ping and telnet to port 5044, Netstat shows that the connect… --- ## [Why does filebeat run from CLI but not as a service?](https://discuss.elastic.co/t/why-does-filebeat-run-from-cli-but-not-as-a-service/141818)
**Author:** [@laidig](https://discuss.elastic.co/u/laidig)\ **Replies:** 1\ **Last updated:** [July 26, 2018, 6:57pm UTC](https://discuss.elastic.co/t/why-does-filebeat-run-from-cli-but-not-as-a-service/141818 "2018-07-26T18:57:50Z")
I have no trouble running filebeat and submitting to my host on the Elastic cloud from the cli as such: filebeat -c filebeat.yml -e -d "\*" Loglines start whizzing by and show up in Kibana. But when I start the service… --- ## [Multiple filebeat instances on RedHat using "service"](https://discuss.elastic.co/t/multiple-filebeat-instances-on-redhat-using-service/141406)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 2\ **Last updated:** [July 26, 2018, 3:32pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-on-redhat-using-service/141406 "2018-07-26T15:32:46Z")
Hello, I am a redhat user using Filebeat 6.2.2 installed through rpm. I need to send some log files to multiple logstash instances and the only solution in my situation is running two filebeat instances in parallel. I… --- ## [Autodiscover and modules](https://discuss.elastic.co/t/autodiscover-and-modules/141697)
**Author:** [@Zane\_Storha](https://discuss.elastic.co/u/Zane_Storha)\ **Replies:** 2\ **Last updated:** [July 26, 2018, 2:36pm UTC](https://discuss.elastic.co/t/autodiscover-and-modules/141697 "2018-07-26T14:36:42Z")
What is the main difference between using only docker module and autodiscover ? What's the main idea of autodiscover? With both I can detect stopped containers, images etc . --- ## [Auditbeat and filebeat in same Index](https://discuss.elastic.co/t/auditbeat-and-filebeat-in-same-index/141736)
**Author:** [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 2:28pm UTC](https://discuss.elastic.co/t/auditbeat-and-filebeat-in-same-index/141736 "2018-07-26T14:28:23Z")
I want to send Auditbeat and filebeats logs in same index over Logstash. Filebeat is already successfully sending the data. But i dont know how i get Auditbeat logs in the same index because there is no output\_type tag.… --- ## [Filebeat error: log/prospector.go:437](https://discuss.elastic.co/t/filebeat-error-log-prospector-go-437/139741)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 16\ **Last updated:** [July 26, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-error-log-prospector-go-437/139741 "2018-07-26T14:10:45Z")
Hi, anyone from the team help me fix this issue. 2018-07-12T07:11:34.266-0400 ERROR log/prospector.go:437 Harvester could not be started on new file: d:\\logs\\azure\\data\\SignInEvent\_accenture.onmicrosoft.com\_2018-07-03T… --- ## [Rollout of Winlogbeat](https://discuss.elastic.co/t/rollout-of-winlogbeat/141740)
**Author:** [@Nerd0815](https://discuss.elastic.co/u/Nerd0815)\ **Replies:** 1\ **Last updated:** [July 26, 2018, 1:29pm UTC](https://discuss.elastic.co/t/rollout-of-winlogbeat/141740 "2018-07-26T13:29:13Z")
Hello, i have around 300+ Windows Server and just wonder how i can automatically rollout the winlogbeat client with my modified yml to all of them Has anyone a suggestion ? Regards --- ## [Monitor particular port using elk](https://discuss.elastic.co/t/monitor-particular-port-using-elk/141575)
**Author:** [@dinesh1](https://discuss.elastic.co/u/dinesh1)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 1:16pm UTC](https://discuss.elastic.co/t/monitor-particular-port-using-elk/141575 "2018-07-26T13:16:41Z")
how monitor number of active connections in particular port.Like 22, 9090, 15672 etc using elk --- ## [No metrics send to logstash](https://discuss.elastic.co/t/no-metrics-send-to-logstash/141208)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 1\ **Last updated:** [July 26, 2018, 1:00pm UTC](https://discuss.elastic.co/t/no-metrics-send-to-logstash/141208 "2018-07-26T13:00:10Z")
Hi Elastic Team, After installing and configuring Filebeat and Logstash, i can consult my gathered logs in Kibana. So, today full of confidence, i decided to install metricbeat.... and then, the drama ! LOL I inform t… --- ## [Filebeat don't send send proper multiline messages on logstash](https://discuss.elastic.co/t/filebeat-dont-send-send-proper-multiline-messages-on-logstash/141323)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 4\ **Last updated:** [July 26, 2018, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-dont-send-send-proper-multiline-messages-on-logstash/141323 "2018-07-26T12:20:09Z")
Hello, I have a problem with sending multiline log messages to Logstash using Filebeat. This is my Filebeat.yml configuration: filebeat.inputs: - type: log paths: - "/home/mladen/Desktop/qmraz2.log" fields: … --- ## [Filebeat/Modules Cannot index event publisher.Event](https://discuss.elastic.co/t/filebeat-modules-cannot-index-event-publisher-event/141419)
**Author:** [@jdomsic](https://discuss.elastic.co/u/jdomsic)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-modules-cannot-index-event-publisher-event/141419 "2018-07-26T12:15:53Z")
Hi, I just enabled and started filebeat with 2 modules (system and auditd) and my index (filebeat-\*) is not created/populated in elasticsearch. Filebeat config: filebeat.config.modules.path: ${path.config}/modules.d/\*… --- ## [Filebeat -\>graylog](https://discuss.elastic.co/t/filebeat-graylog/141752)
**Author:** [@normander](https://discuss.elastic.co/u/normander)\ **Replies:** 0\ **Last updated:** [July 26, 2018, 11:53am UTC](https://discuss.elastic.co/t/filebeat-graylog/141752 "2018-07-26T11:53:33Z")
Hi Everyone, I have kubernetes cluster and filebeat pods in it. Is there any option to send logs from pods to graylog with fileds such as kubernetes metadata? I see this data in log of filebeat, but I would like to reci… --- ## [Add memory-usage metrics to schema of memcached-module of metricbeats](https://discuss.elastic.co/t/add-memory-usage-metrics-to-schema-of-memcached-module-of-metricbeats/140303)
**Author:** [@Hooddominator](https://discuss.elastic.co/u/Hooddominator)\ **Replies:** 4\ **Last updated:** [July 26, 2018, 10:31am UTC](https://discuss.elastic.co/t/add-memory-usage-metrics-to-schema-of-memcached-module-of-metricbeats/140303 "2018-07-26T10:31:30Z")
To determ memory-usage of a memcached-instance it would be really helpfull if we can add two additional metrics which are allready present in scanned/parsed "stats"-data of memcached. The field with key " limit\_maxbytes"… --- ## [Filebeat TTL value: is it seconds? milliseconds?](https://discuss.elastic.co/t/filebeat-ttl-value-is-it-seconds-milliseconds/138646)
**Author:** [@Precision](https://discuss.elastic.co/u/Precision)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 10:25am UTC](https://discuss.elastic.co/t/filebeat-ttl-value-is-it-seconds-milliseconds/138646 "2018-07-26T10:25:54Z")
Is the "ttl" value in seconds or milliseconds? https://www.elastic.co/guide/en/beats/filebeat/master/logstash-output.html#\_literal\_ttl\_literal The documentation does not say anything about it. --- ## [Splitting metricbeat events into separate index](https://discuss.elastic.co/t/splitting-metricbeat-events-into-separate-index/141720)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [July 26, 2018, 9:01am UTC](https://discuss.elastic.co/t/splitting-metricbeat-events-into-separate-index/141720 "2018-07-26T09:01:24Z")
I am trying to read events from a s3 bucket and index them into elasticsearch. Everything works fine if I have a single input and output and I used to be able to use a conditional like if \[metricset\] { elasticsearch {… --- ## [Failed to publish events caused by: unsupported float value: NaN](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-unsupported-float-value-nan/140986)
**Author:** [@birkhoff](https://discuss.elastic.co/u/birkhoff)\ **Replies:** 4\ **Last updated:** [July 26, 2018, 8:20am UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-unsupported-float-value-nan/140986 "2018-07-26T08:20:08Z")
Metricbeat version: 6.3.1 OS: CentOS 7.1 Config: metricbeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false #reload.period: 10s setup.template.settings: index.number\_of\_shards: 1 i… --- ## [Filebeat is not sending the logs to the logstash](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 5\ **Last updated:** [July 25, 2018, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101 "2018-07-25T16:45:37Z")
Hi All, I am using filebeat and ELK stack. I am not getting any logs from the filebeat to Logstash. Can anyone help me. Its very urgent. Filebeat version : 6.0.0 ELK stack(sebp/elk) : 6.0.0 Filebeat.config :-- fileb… --- ## [Something wrong with multiline](https://discuss.elastic.co/t/something-wrong-with-multiline/141544)
**Author:** [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Replies:** 3\ **Last updated:** [July 25, 2018, 4:29pm UTC](https://discuss.elastic.co/t/something-wrong-with-multiline/141544 "2018-07-25T16:29:56Z")
Hello, I try to use multiline pattern for my ELK system (ElasticSearch+LogStash+Kibana+FileBeat). There is my filebeat.yml: filebeat.inputs: - type: log enabled: true paths: - /testvar/test.log multiline: … --- ## [Failed to parse \[kubernetes.container.start\_time\]](https://discuss.elastic.co/t/failed-to-parse-kubernetes-container-start-time/141600)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [July 25, 2018, 3:06pm UTC](https://discuss.elastic.co/t/failed-to-parse-kubernetes-container-start-time/141600 "2018-07-25T15:06:22Z")
Hello, There seems to be a problem with the mapping of kubernetes.container.start\_time. I find the following errors in my Elastic cluster logs every minute: Elasticsearch cluster log error: \[2018-07-25T16:06:44,953\]\[D… --- ## [Problem with filebeat (installed in different servers)](https://discuss.elastic.co/t/problem-with-filebeat-installed-in-different-servers/141548)
**Author:** [@kimfut](https://discuss.elastic.co/u/kimfut)\ **Replies:** 2\ **Last updated:** [July 25, 2018, 2:42pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-installed-in-different-servers/141548 "2018-07-25T14:42:35Z")
hello everyone , i have a problem with filebeat i think , i will explain : i have server A and B and C , all run filebeat with the same configuration , the server A run logstash and elasticseach , so when i added file… --- ## [Filebeat - prospectors/inputs and active modules with configuration](https://discuss.elastic.co/t/filebeat-prospectors-inputs-and-active-modules-with-configuration/141524)
**Author:** [@yannicknk](https://discuss.elastic.co/u/yannicknk)\ **Replies:** 1\ **Last updated:** [July 25, 2018, 12:02pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-inputs-and-active-modules-with-configuration/141524 "2018-07-25T12:02:56Z")
Dear Elastic Team, I am having a small question. Currently I am using a wildcard expression in my Filebeat input configuration (/var/log/log; /var/log//\*log)., but I started to use the system module with its configurati… --- ## [Short\_message nil value](https://discuss.elastic.co/t/short-message-nil-value/140123)
**Author:** [@PitoneMaledetto](https://discuss.elastic.co/u/PitoneMaledetto)\ **Replies:** 18\ **Last updated:** [July 25, 2018, 10:39am UTC](https://discuss.elastic.co/t/short-message-nil-value/140123 "2018-07-25T10:39:29Z")
Hi all, I am trying to send system metrics using metricbeat 6.3.0 to Logstash 6.3.0 but I am getting this error. Trouble sending GELF event {:gelf\_event=\>{"short\_message"=\>nil The issue seems to be that the short\_mess… --- ## [How to get data from localhost:8080 to Metricbeat?](https://discuss.elastic.co/t/how-to-get-data-from-localhost-8080-to-metricbeat/141143)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 18\ **Last updated:** [July 25, 2018, 9:05am UTC](https://discuss.elastic.co/t/how-to-get-data-from-localhost-8080-to-metricbeat/141143 "2018-07-25T09:05:03Z")
Hi, my problem is the following. I need to get some data from endpoints in a project in a localhost:8080, but i don't know if I configured wright. /etc/logstash/conf.d/logstash.conf input { beats { port =\>… --- ## [Filebeat not trasnferring messages to Logstash](https://discuss.elastic.co/t/filebeat-not-trasnferring-messages-to-logstash/141311)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 8\ **Last updated:** [July 25, 2018, 7:06am UTC](https://discuss.elastic.co/t/filebeat-not-trasnferring-messages-to-logstash/141311 "2018-07-25T07:06:20Z")
HI Team, I have completed ELK setup completed and successful in creating many visualtisation, however, offlate my filebeat is not sending any messages to my logstash system. I am getting below message when trying to pub… --- ## [Nagioscheckbeat starting error](https://discuss.elastic.co/t/nagioscheckbeat-starting-error/141375)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [July 25, 2018, 6:59am UTC](https://discuss.elastic.co/t/nagioscheckbeat-starting-error/141375 "2018-07-25T06:59:28Z")
Hi All, I have installed nagioscheckbeat as an rpm package in my nagiosxi machine, as per the readme doc i have configured the yml and pointed my elasticsearch and kibana server information, while starting the service i… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=432) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=434)