# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=434 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 435 --- ## [Filebeat Log](https://discuss.elastic.co/t/filebeat-log/140556)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 6\ **Last updated:** [July 25, 2018, 6:47am UTC](https://discuss.elastic.co/t/filebeat-log/140556 "2018-07-25T06:47:12Z")
When i am sending the log data to logstash the data was not going to logstash and in file beat we got this error. 2018-07-18T12:56:30.482+0100 INFO \[monitoring\] log/log.go:124 Non-zero metrics in the last 30s … --- ## [Can't figure out source of config error in new filebeat module](https://discuss.elastic.co/t/cant-figure-out-source-of-config-error-in-new-filebeat-module/141102)
**Author:** [@per.fagrell](https://discuss.elastic.co/u/per.fagrell)\ **Replies:** 6\ **Last updated:** [July 24, 2018, 8:32pm UTC](https://discuss.elastic.co/t/cant-figure-out-source-of-config-error-in-new-filebeat-module/141102 "2018-07-24T20:32:20Z")
I've just walked through the documentation on creating a new filebeat module, tested my parser with the simulation API and then copied the files over to a docker container and fired it up. However, when it loads the modu… --- ## [Packetbeat not always populating "server" common field](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 5:16pm UTC](https://discuss.elastic.co/t/packetbeat-not-always-populating-server-common-field/141426 "2018-07-24T17:16:00Z")
Is there a reason that packetbeat would not always collect the server field? I'm collecting tls packets and only sending events that have the tls.handshake\_completed field. packetbeat.protocols: - type: tls send\_cert… --- ## [Winlogbeat connecting to server then times out](https://discuss.elastic.co/t/winlogbeat-connecting-to-server-then-times-out/140787)
**Author:** [@Stephen\_Meier](https://discuss.elastic.co/u/Stephen_Meier)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 4:44pm UTC](https://discuss.elastic.co/t/winlogbeat-connecting-to-server-then-times-out/140787 "2018-07-24T16:44:08Z")
I am really beating my head against the wall with this one. I have logstash (6.3.0) ingesting winlogbeat (6.3.0) events. However, whenever winlogbeat tries to upload to the logstash server I get 2018-07-19T11:17:38.466… --- ## [Multiline pattern not creating expected results](https://discuss.elastic.co/t/multiline-pattern-not-creating-expected-results/140953)
**Author:** [@rfelske](https://discuss.elastic.co/u/rfelske)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 3:32pm UTC](https://discuss.elastic.co/t/multiline-pattern-not-creating-expected-results/140953 "2018-07-24T15:32:36Z")
I am trying to join two lines together from an IPlanet access log output. Below is my filebeat.yml, output from filebeats and log input. I know I'm missing something but not sure what. I tested the pattern specified in a… --- ## [Add\_locale processor not refreshing timezone info](https://discuss.elastic.co/t/add-locale-processor-not-refreshing-timezone-info/141397)
**Author:** [@tacomaster](https://discuss.elastic.co/u/tacomaster)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 3:01pm UTC](https://discuss.elastic.co/t/add-locale-processor-not-refreshing-timezone-info/141397 "2018-07-24T15:01:06Z")
Recently added the add\_locale processor to a Filebeat instance and its adding the current timezone offset to logs correctly. However, if I change the timezone without restarting Filebeat, the timezone offset reported is … --- ## [Load the index template manually(alternate method)](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 2:46pm UTC](https://discuss.elastic.co/t/load-the-index-template-manually-alternate-method/141205 "2018-07-24T14:46:55Z")
Hi, I am running Winlogbeat on a machine which doesn't have access to elasticsearch. So, I will need to load the index template manually(Winlogbeat outputs to Logstash) with alternate method. I have few questions, I … --- ## [Filebeat doesn't send any logs to logstash](https://discuss.elastic.co/t/filebeat-doesnt-send-any-logs-to-logstash/140792)
**Author:** [@Ferdous\_Shibly](https://discuss.elastic.co/u/Ferdous_Shibly)\ **Replies:** 3\ **Last updated:** [July 24, 2018, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-any-logs-to-logstash/140792 "2018-07-24T14:40:52Z")
We are getting the following error message in Filebeat 2018-07-19T18:46:18.832Z ERROR logstash/async.go:235 Failed to publish events caused by: write tcp 172.17.0.2:42194-\>10.14.86.242:9191: write: connection reset… --- ## [Geoip processor not working with filebeat](https://discuss.elastic.co/t/geoip-processor-not-working-with-filebeat/141382)
**Author:** [@Raj2](https://discuss.elastic.co/u/Raj2)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 1:40pm UTC](https://discuss.elastic.co/t/geoip-processor-not-working-with-filebeat/141382 "2018-07-24T13:40:25Z")
I recently installed geoip plugin but I can not see my ip filed being processed in logs being indexed by filebeat. However when I manually try to index some document with same structure it is working fine. Do I need to… --- ## [Filebeat plugin to send Varnish log](https://discuss.elastic.co/t/filebeat-plugin-to-send-varnish-log/141368)
**Author:** [@Vignesh\_S](https://discuss.elastic.co/u/Vignesh_S)\ **Replies:** 1\ **Last updated:** [July 24, 2018, 1:38pm UTC](https://discuss.elastic.co/t/filebeat-plugin-to-send-varnish-log/141368 "2018-07-24T13:38:08Z")
Is there any plugin to send my varnish logs to logstash to parse and display on my Kibana dashboard? If yes, please give me the link or how to e=install it. Thanks --- ## [How to compile winlogbeat source code](https://discuss.elastic.co/t/how-to-compile-winlogbeat-source-code/141328)
**Author:** [@ping\_luo](https://discuss.elastic.co/u/ping_luo)\ **Replies:** 5\ **Last updated:** [July 24, 2018, 9:45am UTC](https://discuss.elastic.co/t/how-to-compile-winlogbeat-source-code/141328 "2018-07-24T09:45:52Z")
hi all: i want to add extra functions to winlogbeat, but i can\`t find any doc to guide. any one could provide a detailed method? --- ## [Filebeat having error in bulk index operations](https://discuss.elastic.co/t/filebeat-having-error-in-bulk-index-operations/141339)
**Author:** [@rich456](https://discuss.elastic.co/u/rich456)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 9:33am UTC](https://discuss.elastic.co/t/filebeat-having-error-in-bulk-index-operations/141339 "2018-07-24T09:33:08Z")
Hi all, I just started exploring ELK stack for my company and I am quite new to this. I am encountering an error, and this is the error logs: 2018/07/24 09:01:35.330832 client.go:297: DBG ES Ping(url=http://10.130.12.… --- ## [Compilation filebeat gccgo solaris /sparc](https://discuss.elastic.co/t/compilation-filebeat-gccgo-solaris-sparc/141170)
**Author:** [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)\ **Replies:** 2\ **Last updated:** [July 24, 2018, 8:47am UTC](https://discuss.elastic.co/t/compilation-filebeat-gccgo-solaris-sparc/141170 "2018-07-24T08:47:33Z")
I am driving to compile the project filebeat going for solar / SPARC environments. Officially, Elastic tools are not supported by Solaris. Neamoins, there is circumventenement to this problem / compile via gccgo. I actu… --- ## [Filebeat unable to sent logs](https://discuss.elastic.co/t/filebeat-unable-to-sent-logs/134595)
**Author:** [@mamta](https://discuss.elastic.co/u/mamta)\ **Replies:** 70\ **Last updated:** [July 24, 2018, 6:14am UTC](https://discuss.elastic.co/t/filebeat-unable-to-sent-logs/134595 "2018-07-24T06:14:01Z")
Hi, I have installed ELK 5.6.8 on Redhat server and filebeat on another redhat server. I have used logstash to collect data from filebeat. I have changed default port 5044 with 5045 in the filebeat.yml file because 50… --- ## [Filebeat setup not work](https://discuss.elastic.co/t/filebeat-setup-not-work/140897)
**Author:** [@weyderfs](https://discuss.elastic.co/u/weyderfs)\ **Replies:** 3\ **Last updated:** [July 23, 2018, 7:50pm UTC](https://discuss.elastic.co/t/filebeat-setup-not-work/140897 "2018-07-23T19:50:02Z")
Hi guys, I'm trying monitoring syslogs in my ELK server, but when try run filebeat setup happens the error bellow: Loaded index template Loading dashboards (Kibana must be running and reachable) Exiting: Error importin… --- ## [How can I config about reverse log](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116)
**Author:** [@ziserendexin](https://discuss.elastic.co/u/ziserendexin)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 4:02pm UTC](https://discuss.elastic.co/t/how-can-i-config-about-reverse-log/141116 "2018-07-23T16:02:45Z")
I have this kind of log: |2018/6/8|15:49:37|D| |2018/5/8|14:49:37|C| |2018/3/30|13:33:32|B| |2018/3/28|12:26:08|A| when a new msgline is added, this new msgline will add at start of logfile. Like this: |2018/7/8… --- ## ["message" filed missing from windows event logs](https://discuss.elastic.co/t/message-filed-missing-from-windows-event-logs/137854)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 10\ **Last updated:** [July 23, 2018, 3:33pm UTC](https://discuss.elastic.co/t/message-filed-missing-from-windows-event-logs/137854 "2018-07-23T15:33:43Z")
Hi, I am sending all the event logs to Logstash using Winlogbeat. Here is part of Winlogbeat.yml, winlogbeat.event\_logs: - name: Application level: error, warning, info output.logstash: # The Logstash hosts … --- ## [Adding custom fields doesn't work in Winlogbeat](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 3:33pm UTC](https://discuss.elastic.co/t/adding-custom-fields-doesnt-work-in-winlogbeat/140588 "2018-07-23T15:33:09Z")
Hi, I am trying to add custom fields and I don't see field added to the event. Winlogbeat logs show following logs WARN EventLog\[CustomLog\] Open() error. No events will be read from this source. The specified channel c… --- ## [Importing Beats Dashboards and Index Patterns](https://discuss.elastic.co/t/importing-beats-dashboards-and-index-patterns/140937)
**Author:** [@ryanrossiter](https://discuss.elastic.co/u/ryanrossiter)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 2:54pm UTC](https://discuss.elastic.co/t/importing-beats-dashboards-and-index-patterns/140937 "2018-07-23T14:54:26Z")
Hi there, I am working on deploying an Elastic Stack that will contain data from Metricbeat and Packetbeat. To visualize the data in Kibana I'll need to set up the dashboards for these beats' data, and I'd like to impor… --- ## [Log rotation and filebeat](https://discuss.elastic.co/t/log-rotation-and-filebeat/140285)
**Author:** [@bsikander](https://discuss.elastic.co/u/bsikander)\ **Replies:** 16\ **Last updated:** [July 23, 2018, 2:22pm UTC](https://discuss.elastic.co/t/log-rotation-and-filebeat/140285 "2018-07-23T14:22:57Z")
I have multiple long running jobs that produce alot of logs. We are using logrotate utility of Linux to rotate the logs. The problem is that filebeat can miss logs. For example, if I have a log file named output.log and … --- ## [Filebeat6.0.0 Registry problem](https://discuss.elastic.co/t/filebeat6-0-0-registry-problem/141086)
**Author:** [@Owl](https://discuss.elastic.co/u/Owl)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 11:26am UTC](https://discuss.elastic.co/t/filebeat6-0-0-registry-problem/141086 "2018-07-23T11:26:54Z")
Hi,All I hava a problem that the filebeat can't scan the document again. firstly,there's 2 document path named /data/EDI/manifest/EKONEK/in/ .txt and /data/EDI/manifest/EKONEK/out/.txt ,when i start filebeat for the fi… --- ## [Are new input files automatically enabled with the reload feature?](https://discuss.elastic.co/t/are-new-input-files-automatically-enabled-with-the-reload-feature/141122)
**Author:** [@andreastoom](https://discuss.elastic.co/u/andreastoom)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 10:56am UTC](https://discuss.elastic.co/t/are-new-input-files-automatically-enabled-with-the-reload-feature/141122 "2018-07-23T10:56:45Z")
Hi, I am trying to get some confirmation whether filebeat automatically adds new input files that are dropped in a config path with a GLOB pattern or not ? In our case we will have a number of applications that will be … --- ## [Filebeat modules doesn't parse the logs](https://discuss.elastic.co/t/filebeat-modules-doesnt-parse-the-logs/140973)
**Author:** [@rpendela](https://discuss.elastic.co/u/rpendela)\ **Replies:** 1\ **Last updated:** [July 23, 2018, 9:56am UTC](https://discuss.elastic.co/t/filebeat-modules-doesnt-parse-the-logs/140973 "2018-07-23T09:56:38Z")
Hello Community, I have installed filebeat and Nginx module is enabled \[root@ip-10-1-247-159 filebeat\]# ./filebeat modules list Enabled: nginx Filebeat templates are loaded manually. I can see the logs in kibana … --- ## [Configuring Metricbeat](https://discuss.elastic.co/t/configuring-metricbeat/140951)
**Author:** [@piedmont01](https://discuss.elastic.co/u/piedmont01)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 9:51am UTC](https://discuss.elastic.co/t/configuring-metricbeat/140951 "2018-07-23T09:51:08Z")
Maybe it's me but the Elastic documentation isn't clear as to what's server and what's client :frowning: I have installed metricbeat on several clients and they appear to be sending data to Elasticsearch. But I don't h… --- ## [Kafka topics configuration example](https://discuss.elastic.co/t/kafka-topics-configuration-example/140911)
**Author:** [@sykomaniac](https://discuss.elastic.co/u/sykomaniac)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 9:50am UTC](https://discuss.elastic.co/t/kafka-topics-configuration-example/140911 "2018-07-23T09:50:51Z")
Hi, Is anyone able to provide me with an example of configuring the topics setting for Kafka output. I think I can use this to potentially write data points to different topics. E.g. write a mapping of kubernetes --\> p… --- ## [Filebeat grok processor with pipe delimiter not working](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913)
**Author:** [@blutswende](https://discuss.elastic.co/u/blutswende)\ **Replies:** 2\ **Last updated:** [July 23, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913 "2018-07-23T09:10:50Z")
Hi all, i'm writing a new module to parse our own logfiles. Now i'm stuck at a problem. With parsing the pipeline.json My pipeline.json looks like: { "processors": \[ { "grok": { "field": "… --- ## [Something is wrong with pipeline](https://discuss.elastic.co/t/something-is-wrong-with-pipeline/140766)
**Author:** [@g.myznikov.tinkoff](https://discuss.elastic.co/u/g.myznikov.tinkoff)\ **Replies:** 4\ **Last updated:** [July 23, 2018, 7:35am UTC](https://discuss.elastic.co/t/something-is-wrong-with-pipeline/140766 "2018-07-23T07:35:44Z")
I have Stack without Logstash. But I need to correct some fields in kibana (timestamp for example). I try to use pipeline for this purpose. This is my config file: filebeat.yml filebeat.inputs: - type: log enabled: … --- ## [Filebeat don't pick up overwritten log file](https://discuss.elastic.co/t/filebeat-dont-pick-up-overwritten-log-file/140360)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 9\ **Last updated:** [July 23, 2018, 7:13am UTC](https://discuss.elastic.co/t/filebeat-dont-pick-up-overwritten-log-file/140360 "2018-07-23T07:13:41Z")
Hi Everyone, already looked here and Fielbeat documentation, but something isn't working :confused: there is only 1 log file that i want to collect and this one get overwritten every 3 minutes. i already added close\_e… --- ## [Kubernetes & Docker max-size](https://discuss.elastic.co/t/kubernetes-docker-max-size/139813)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 7\ **Last updated:** [July 20, 2018, 3:52pm UTC](https://discuss.elastic.co/t/kubernetes-docker-max-size/139813 "2018-07-20T15:52:33Z")
Hi! We're trying to better manage our Kubernetes logs. I have Filebeat running in the cluster using autodiscover and shipping off to Logstash. Say in the K8s cluster, I have the Docker logging driver set to max-size o… --- ## [Metricbeat dashboard](https://discuss.elastic.co/t/metricbeat-dashboard/140611)
**Author:** [@joshua625](https://discuss.elastic.co/u/joshua625)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 11:51am UTC](https://discuss.elastic.co/t/metricbeat-dashboard/140611 "2018-07-19T11:51:05Z")
Hello, I'm trying to create a dashboard for metricbeat which shows highest cpu utilization vs process that is consuming more for current hour compared with previous hour and 2. how many process are running vs process… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=433) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=435)