# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=435 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 436 --- ## [Monitor thrift transport using Packetbeat](https://discuss.elastic.co/t/monitor-thrift-transport-using-packetbeat/140844)
**Author:** [@npallavi](https://discuss.elastic.co/u/npallavi)\ **Replies:** 2\ **Last updated:** [July 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/monitor-thrift-transport-using-packetbeat/140844 "2018-07-20T09:56:53Z")
Hi, I am facing an issue in this option to provide thrift files in the "IDL\_files" configuration of packetbeat.yml file. Is it possible to provide a folder name which contains all my thrift files instead of providing i… --- ## [The filebeat default index cannot be changed](https://discuss.elastic.co/t/the-filebeat-default-index-cannot-be-changed/140826)
**Author:** [@kioo](https://discuss.elastic.co/u/kioo)\ **Replies:** 1\ **Last updated:** [July 20, 2018, 4:53am UTC](https://discuss.elastic.co/t/the-filebeat-default-index-cannot-be-changed/140826 "2018-07-20T04:53:11Z")
This is my filebeat.yml configuration: #=========================== Filebeat inputs ============================= filebeat.inputs: - type: log # Change to true to enable this input configuration. enabled: true … --- ## [CPU Cache](https://discuss.elastic.co/t/cpu-cache/140356)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 2\ **Last updated:** [July 20, 2018, 3:28am UTC](https://discuss.elastic.co/t/cpu-cache/140356 "2018-07-20T03:28:17Z")
Is there a way to get CPU cache using metric beat? --- ## [Winlogbeat filter](https://discuss.elastic.co/t/winlogbeat-filter/140772)
**Author:** [@8c8459cec5b62e5054b6](https://discuss.elastic.co/u/8c8459cec5b62e5054b6)\ **Replies:** 1\ **Last updated:** [July 19, 2018, 9:26pm UTC](https://discuss.elastic.co/t/winlogbeat-filter/140772 "2018-07-19T21:26:59Z")
Hey Please help. The boss set the task to configure logging of events of deletion, creation, modification and files on the file server. The ELK server is set up, it's time to install winlogbeeat on the file server and… --- ## [How to delete all dashboards of metricbeat](https://discuss.elastic.co/t/how-to-delete-all-dashboards-of-metricbeat/140771)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [July 19, 2018, 9:16pm UTC](https://discuss.elastic.co/t/how-to-delete-all-dashboards-of-metricbeat/140771 "2018-07-19T21:16:54Z")
Hi, I install metricbeat just for test and now i'm not using it anymore, I want to delete all dashboards and visualizations of metricbeat that have been added. If I delete index metricbeat, will all the vizualizations … --- ## [Filebeat.yml.rpmnew use?](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 1\ **Last updated:** [July 19, 2018, 9:01pm UTC](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699 "2018-07-19T21:01:55Z")
Hi, I installed recently filebeat, and I would like to edit the yml file to specify this input: filebeat.prospectors: - input\_type: log paths: - /path/\*.xml # scan\_frequency: 60s document\_type: message m… --- ## [X-Forwarded Headers with IIS Module](https://discuss.elastic.co/t/x-forwarded-headers-with-iis-module/139233)
**Author:** [@rlindner](https://discuss.elastic.co/u/rlindner)\ **Replies:** 3\ **Last updated:** [July 19, 2018, 8:40pm UTC](https://discuss.elastic.co/t/x-forwarded-headers-with-iis-module/139233 "2018-07-19T20:40:07Z")
Hi there, In 6.2 I was parsing IIS logs with Filebeat to Elasticsearch using a pipeline with grok filters, and modifying the filebeat.yml file to use the setup.template.name and setup.template.pattern. I was able to con… --- ## [Get http site body content with metricbeat or heartbeat](https://discuss.elastic.co/t/get-http-site-body-content-with-metricbeat-or-heartbeat/140537)
**Author:** [@Aert](https://discuss.elastic.co/u/Aert)\ **Replies:** 4\ **Last updated:** [July 19, 2018, 4:29pm UTC](https://discuss.elastic.co/t/get-http-site-body-content-with-metricbeat-or-heartbeat/140537 "2018-07-19T16:29:42Z")
Hello, Sorry for the newbie request... I managed to deploy & configure metribeat & heartbeat to monitor a few things, and make some graphs. Unfortunately did not manage to get the body content of a simple webpage with … --- ## [Multiple Log type](https://discuss.elastic.co/t/multiple-log-type/140516)
**Author:** [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\ **Replies:** 3\ **Last updated:** [July 19, 2018, 4:01pm UTC](https://discuss.elastic.co/t/multiple-log-type/140516 "2018-07-19T16:01:20Z")
Hi Team, Hope you all are doing great. I have a question regarding the different log type in filebeat. I have configured two prospectors and used different log type but at my kibana dashboard it shows only doc, while i… --- ## [Running on Windows - Not logging Kibana](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 3\ **Last updated:** [July 19, 2018, 3:48pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569 "2018-07-19T15:48:10Z")
Hello, I was running filebeat on linux and forwarding the logs to logstash I then deleted the Linux one and installed one on Windows. I then started the service and it ran fine, then I checked on Kibana it was only di… --- ## [Error in Winlogbeat logs](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 10\ **Last updated:** [July 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485 "2018-07-19T14:00:32Z")
Winlogbeat has been working fine for a week now, today I turned my computer on and it just wouldnt load todays logs. I checked the logs and this is what it says: 2018-07-18T09:32:27.192+0100 ERROR instance/beat.go:691 … --- ## [Missing beat.hostname from Filebeat Index Pattern](https://discuss.elastic.co/t/missing-beat-hostname-from-filebeat-index-pattern/139785)
**Author:** [@Saris](https://discuss.elastic.co/u/Saris)\ **Replies:** 17\ **Last updated:** [July 19, 2018, 3:10pm UTC](https://discuss.elastic.co/t/missing-beat-hostname-from-filebeat-index-pattern/139785 "2018-07-19T15:10:07Z")
Using Filebeat for collecting Windows Firewall Logs. Everything is going well except my Index Pattern does not include the beat.hostname. Filebeat used to report the Host field, but since updating to 6.3.0, was removed… --- ## [Filebeat system module auth log timezone conversion problem](https://discuss.elastic.co/t/filebeat-system-module-auth-log-timezone-conversion-problem/140192)
**Author:** [@Ray\_Frush](https://discuss.elastic.co/u/Ray_Frush)\ **Replies:** 6\ **Last updated:** [July 19, 2018, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-system-module-auth-log-timezone-conversion-problem/140192 "2018-07-19T15:01:05Z")
Greetings, we're VERY new to the Elastic stack. What we've got working so far running on Oracle Linux 7 (RHEL7 clone) using the 6.3 (latest) versions installed via YUM. filebeat-6.3.1-1.x86\_64 All our systems are co… --- ## [Filebeat types elastic 6](https://discuss.elastic.co/t/filebeat-types-elastic-6/140190)
**Author:** [@boboem123](https://discuss.elastic.co/u/boboem123)\ **Replies:** 5\ **Last updated:** [July 19, 2018, 11:40am UTC](https://discuss.elastic.co/t/filebeat-types-elastic-6/140190 "2018-07-19T11:40:41Z")
Hi, My setup is: elasticsearch cluster \< logstash\_host \< ( filebeat\_host, filebeat\_host2) Is there a need / benefit to defining log types in elastic 6? https://www.elastic.co/guide/en/elasticsearch/reference/master/r… --- ## [Install filebeat locally to get access to a server?](https://discuss.elastic.co/t/install-filebeat-locally-to-get-access-to-a-server/140498)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 8:04am UTC](https://discuss.elastic.co/t/install-filebeat-locally-to-get-access-to-a-server/140498 "2018-07-19T08:04:41Z")
Hello, I recently started learning ELK and I succeed to parse my XML files locally. But now I would like to have access to my server to get access to all of my XML files (upgrade every 30 seconds) I have the ip-addres… --- ## [Adding of clients with the different index names](https://discuss.elastic.co/t/adding-of-clients-with-the-different-index-names/140266)
**Author:** [@kranthi\_851](https://discuss.elastic.co/u/kranthi_851)\ **Replies:** 4\ **Last updated:** [July 19, 2018, 7:58am UTC](https://discuss.elastic.co/t/adding-of-clients-with-the-different-index-names/140266 "2018-07-19T07:58:41Z")
Kindly suggest me how to add the filebeats with the different index names? As of now,I just added two clients, but I am able to view only logs of one client. Logs of filebeat of other client is also fine, its saying its… --- ## [Filebeat 6.3.1 update caused multiple entries in the registry for the same file, logs re-shipped](https://discuss.elastic.co/t/filebeat-6-3-1-update-caused-multiple-entries-in-the-registry-for-the-same-file-logs-re-shipped/140210)
**Author:** [@jdonahue](https://discuss.elastic.co/u/jdonahue)\ **Replies:** 11\ **Last updated:** [July 19, 2018, 7:47am UTC](https://discuss.elastic.co/t/filebeat-6-3-1-update-caused-multiple-entries-in-the-registry-for-the-same-file-logs-re-shipped/140210 "2018-07-19T07:47:59Z")
Hi there, We've discovered an issue where Filebeat 6.3.1 causes multiple entries of the same file in the registry when starting for the first time after updating from 6.3.0. It also seems to re-ship the logs from the af… --- ## [Filebeat merged 2 "normal" lines](https://discuss.elastic.co/t/filebeat-merged-2-normal-lines/140580)
**Author:** [@Ilia\_Matveikin](https://discuss.elastic.co/u/Ilia_Matveikin)\ **Replies:** 3\ **Last updated:** [July 19, 2018, 6:55am UTC](https://discuss.elastic.co/t/filebeat-merged-2-normal-lines/140580 "2018-07-19T06:55:15Z")
Hello. In general, our application is writing one-line json log entity, but sometimes it\`s multiline json, to merge multiline json i edited filebeat config as follows: - input\_type: log paths: - /var/log/applicati… --- ## [Read files and filebeat status](https://discuss.elastic.co/t/read-files-and-filebeat-status/140432)
**Author:** [@leexum](https://discuss.elastic.co/u/leexum)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 1:19am UTC](https://discuss.elastic.co/t/read-files-and-filebeat-status/140432 "2018-07-19T01:19:20Z")
I need to know the status of files and filebeat, like how many files are opening, how many harvesters are running, which file is closed because close\_eof is enable e.g. Is there any method to read message show in consol… --- ## [Winlogbeat not displaying latest logs](https://discuss.elastic.co/t/winlogbeat-not-displaying-latest-logs/140578)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 1\ **Last updated:** [July 18, 2018, 10:14pm UTC](https://discuss.elastic.co/t/winlogbeat-not-displaying-latest-logs/140578 "2018-07-18T22:14:31Z")
Hello, It is of now 15:29 and there are new logs because I can see it on Event Viewer. However, this is what I see on Kibana from winlogbeat: This is the time range I have set it on: Any clues to why this is happe… --- ## [I can´t find the metric index pattern and I have installed metricbeat](https://discuss.elastic.co/t/i-can-t-find-the-metric-index-pattern-and-i-have-installed-metricbeat/140167)
**Author:** [@Diego\_Moreno](https://discuss.elastic.co/u/Diego_Moreno)\ **Replies:** 7\ **Last updated:** [July 18, 2018, 10:01pm UTC](https://discuss.elastic.co/t/i-can-t-find-the-metric-index-pattern-and-i-have-installed-metricbeat/140167 "2018-07-18T22:01:24Z")
--- ## [Filebeat 6.3.1 UDP + Json](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624)
**Author:** [@ateixeira-pt](https://discuss.elastic.co/u/ateixeira-pt)\ **Replies:** 2\ **Last updated:** [July 18, 2018, 9:31pm UTC](https://discuss.elastic.co/t/filebeat-6-3-1-udp-json/140624 "2018-07-18T21:31:10Z")
Hi, I'm trying to send a JSON Log over UDP, so filebeat forwards it to the ElasticSearch. The thing is, I can't get it to decode the JSON payload I also tried with a \\n and a \\n\\n to no luck { "@timestamp": "2018-… --- ## [Excluding Access Files](https://discuss.elastic.co/t/excluding-access-files/140358)
**Author:** [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\ **Replies:** 4\ **Last updated:** [July 18, 2018, 6:21pm UTC](https://discuss.elastic.co/t/excluding-access-files/140358 "2018-07-18T18:21:09Z")
version 6.3 for the entire ELK Stack hello! i am trying to exclude all access files from filebeat but am having trouble with the syntax. i am allowing all of the files because i have multiple folders with the same stru… --- ## [Multiline / multipattern](https://discuss.elastic.co/t/multiline-multipattern/139706)
**Author:** [@goochjs](https://discuss.elastic.co/u/goochjs)\ **Replies:** 6\ **Last updated:** [July 18, 2018, 11:48am UTC](https://discuss.elastic.co/t/multiline-multipattern/139706 "2018-07-18T11:48:08Z")
Hi, I'm trying to configure FIlebeat to process a log file where records are mostly spread over multiple lines separated by a blank line but occasionally aren't. Here's an example:- 2018-07-02T21:10:09.775 Start Proce… --- ## [Dynamic reload of outputs](https://discuss.elastic.co/t/dynamic-reload-of-outputs/140153)
**Author:** [@MrWeeble](https://discuss.elastic.co/u/MrWeeble)\ **Replies:** 3\ **Last updated:** [July 18, 2018, 10:51am UTC](https://discuss.elastic.co/t/dynamic-reload-of-outputs/140153 "2018-07-18T10:51:51Z")
Hi, I am very new to the ELK ecosystem and am a little confused about the configuration. https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html indicates that parts of the configura… --- ## [Filebeat apache2 configuration](https://discuss.elastic.co/t/filebeat-apache2-configuration/139927)
**Author:** [@cahlasem](https://discuss.elastic.co/u/cahlasem)\ **Replies:** 7\ **Last updated:** [July 18, 2018, 10:26am UTC](https://discuss.elastic.co/t/filebeat-apache2-configuration/139927 "2018-07-18T10:26:23Z")
Hi All, I am just trying elastic cloud and want to forward my apache logs into the cloud. I am getting my website up and running using XAMPP The installation location is at C:\\AppServ I try to enable apache2 module an… --- ## [Powershell DSC Deploy and MSI](https://discuss.elastic.co/t/powershell-dsc-deploy-and-msi/139776)
**Author:** [@OffColour](https://discuss.elastic.co/u/OffColour)\ **Replies:** 4\ **Last updated:** [July 18, 2018, 9:48am UTC](https://discuss.elastic.co/t/powershell-dsc-deploy-and-msi/139776 "2018-07-18T09:48:37Z")
Hi all, Before I attempt this from scratch, has anyone created a Powershell DSC file that they've used for deploying Filebeat? --- ## [Exiting: No paths were defined for input accessing config](https://discuss.elastic.co/t/exiting-no-paths-were-defined-for-input-accessing-config/139687)
**Author:** [@vkoul](https://discuss.elastic.co/u/vkoul)\ **Replies:** 8\ **Last updated:** [July 18, 2018, 8:10am UTC](https://discuss.elastic.co/t/exiting-no-paths-were-defined-for-input-accessing-config/139687 "2018-07-18T08:10:01Z")
Hello, Here is the problem. When I run filebeat command on command prompt, it starts writing to the logs instantly. However, if I execute "filebeat modules enable system" command and then run "filebeat" command, it giv… --- ## [Several configuration files for filebeat processors?](https://discuss.elastic.co/t/several-configuration-files-for-filebeat-processors/140295)
**Author:** [@qvigand](https://discuss.elastic.co/u/qvigand)\ **Replies:** 3\ **Last updated:** [July 17, 2018, 2:00pm UTC](https://discuss.elastic.co/t/several-configuration-files-for-filebeat-processors/140295 "2018-07-17T14:00:56Z")
Hello, I'm using filebeat to parse multiple log files and send them directly to elasticsearch. I use processors to parse those files and I would like to separate those processors by file. I first tried to create module… --- ## [Set additional fields in Filebeat Modules](https://discuss.elastic.co/t/set-additional-fields-in-filebeat-modules/139964)
**Author:** [@lumi](https://discuss.elastic.co/u/lumi)\ **Replies:** 3\ **Last updated:** [July 17, 2018, 2:12pm UTC](https://discuss.elastic.co/t/set-additional-fields-in-filebeat-modules/139964 "2018-07-17T14:12:56Z")
Problem solved [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=434) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=436)