# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=436 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 437 --- ## [No results when using logstash](https://discuss.elastic.co/t/no-results-when-using-logstash/140016)
**Author:** [@swgroupw](https://discuss.elastic.co/u/swgroupw)\ **Replies:** 2\ **Last updated:** [July 17, 2018, 12:46pm UTC](https://discuss.elastic.co/t/no-results-when-using-logstash/140016 "2018-07-17T12:46:54Z")
I am new to Elastic Stack and have been experimenting on a single CentOS 7 virtual machine. I have been following the installation and startup guides and have been pretty successful at getting things to work. I am tryin… --- ## [Configuring beats to send router's data to elasticsearch](https://discuss.elastic.co/t/configuring-beats-to-send-routers-data-to-elasticsearch/140035)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [July 17, 2018, 8:45am UTC](https://discuss.elastic.co/t/configuring-beats-to-send-routers-data-to-elasticsearch/140035 "2018-07-17T08:45:18Z")
Not sure which beat is relevant in this case but what I want to do is, I have a use case where I need to listen to the routers data so that I can visualize the data (Requests) from different machines connected to my rout… --- ## [Finding User Name & more](https://discuss.elastic.co/t/finding-user-name-more/139942)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 6\ **Last updated:** [July 17, 2018, 8:19am UTC](https://discuss.elastic.co/t/finding-user-name-more/139942 "2018-07-17T08:19:16Z")
Hello, 1st Question: I am forwarding logs from my collector environment to Kibana using winlogbeat I am interested in finding who done what. When I check a log I look for the user that done that, and I can't find - m… --- ## [Multiline and blank lines](https://discuss.elastic.co/t/multiline-and-blank-lines/140060)
**Author:** [@mv\_unige](https://discuss.elastic.co/u/mv_unige)\ **Replies:** 2\ **Last updated:** [July 17, 2018, 7:31am UTC](https://discuss.elastic.co/t/multiline-and-blank-lines/140060 "2018-07-17T07:31:57Z")
I've the following multiline pattern multiline.pattern: '^\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2}.\\d{3}' multiline.negate: true multiline.match: before Using the Go playground https://play.golang.org/p/uAd5XHxscu, I can s… --- ## [No matching indices found no indices match pattern filebeat-\*](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-filebeat/139745)
**Author:** [@kranthi\_851](https://discuss.elastic.co/u/kranthi_851)\ **Replies:** 17\ **Last updated:** [July 17, 2018, 7:21am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-filebeat/139745 "2018-07-17T07:21:45Z")
Hi All, I am getting this error on kibana such that file beat has created, but kibana unable to fetch the data. Kindly check my filebeat.yml code & input logsatsh code. Please help me it's important. it's my filebeat… --- ## [System Processes module Error timeout](https://discuss.elastic.co/t/system-processes-module-error-timeout/139840)
**Author:** [@justingoesfpv](https://discuss.elastic.co/u/justingoesfpv)\ **Replies:** 7\ **Last updated:** [July 17, 2018, 6:57am UTC](https://discuss.elastic.co/t/system-processes-module-error-timeout/139840 "2018-07-17T06:57:40Z")
I'm trying to deploy metricbeat to help monitor a couple troublesome servers to see if we can pinpoint the issue. I however keep getting the following when running test modules: error... ERROR timeout waiting for an eve… --- ## [Not sure filebeat configuration supports if statement](https://discuss.elastic.co/t/not-sure-filebeat-configuration-supports-if-statement/140075)
**Author:** [@lovelk](https://discuss.elastic.co/u/lovelk)\ **Replies:** 2\ **Last updated:** [July 17, 2018, 1:43am UTC](https://discuss.elastic.co/t/not-sure-filebeat-configuration-supports-if-statement/140075 "2018-07-17T01:43:59Z")
Hello all, a filebeat question: Whether it's possible to logstash, support if statements, send the collected data to different message queues? regards, lovelk --- ## [Beats not working on 6.3.1 but did on 6.3.0](https://discuss.elastic.co/t/beats-not-working-on-6-3-1-but-did-on-6-3-0/139026)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 22\ **Last updated:** [July 16, 2018, 11:09pm UTC](https://discuss.elastic.co/t/beats-not-working-on-6-3-1-but-did-on-6-3-0/139026 "2018-07-16T23:09:14Z")
Hi. Just upgraded my Elastic Cluster from 6.3.0 --\> 6.3.1 (Ubuntu 16.04). None of my Beats are working on my Linux hosts (filebeat or metricbeat). They start and there are no errors in the log files (/var/log/filebeat … --- ## [Filebeat Holds open rotated log files](https://discuss.elastic.co/t/filebeat-holds-open-rotated-log-files/138259)
**Author:** [@aforster](https://discuss.elastic.co/u/aforster)\ **Replies:** 5\ **Last updated:** [July 16, 2018, 5:37pm UTC](https://discuss.elastic.co/t/filebeat-holds-open-rotated-log-files/138259 "2018-07-16T17:37:48Z")
On our kubernetes clusters we have an issue caused by filebeat holding open rotated log files for too long. Filebeat needs a more native understanding of log file rotation. Docker is configured to rotate logs at 20meg a… --- ## [Filebeat not shipping files](https://discuss.elastic.co/t/filebeat-not-shipping-files/139781)
**Author:** [@intrepid1](https://discuss.elastic.co/u/intrepid1)\ **Replies:** 2\ **Last updated:** [July 16, 2018, 7:46am UTC](https://discuss.elastic.co/t/filebeat-not-shipping-files/139781 "2018-07-16T07:46:02Z")
I am migrating from a very old version of the logstash shipper to Filebeat but it won't enable my log prospector. 018-07-12T15:30:32.002+0100 INFO crawler/crawler.go:82 Loading and starting Prospectors completed… --- ## [Metricbeat activity on different power state](https://discuss.elastic.co/t/metricbeat-activity-on-different-power-state/139863)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 4\ **Last updated:** [July 16, 2018, 3:23am UTC](https://discuss.elastic.co/t/metricbeat-activity-on-different-power-state/139863 "2018-07-16T03:23:42Z")
Hi, I just want to confirm if the metric beats gather data if the machine/pc is on modern standby? --- ## [Filebeat strips last characters of JSON](https://discuss.elastic.co/t/filebeat-strips-last-characters-of-json/139894)
**Author:** [@Sander\_Ma](https://discuss.elastic.co/u/Sander_Ma)\ **Replies:** 3\ **Last updated:** [July 15, 2018, 8:11am UTC](https://discuss.elastic.co/t/filebeat-strips-last-characters-of-json/139894 "2018-07-15T08:11:35Z")
Hi all, I have a strange problem parsing a JSON-ish file. We log in a JSON format where a multiline string can be added in a Message field. TLDR; Filebeat doesn't send the last two }} of the file for some reason. So… --- ## [Two filbert.yml file](https://discuss.elastic.co/t/two-filbert-yml-file/139955)
**Author:** [@fconcha](https://discuss.elastic.co/u/fconcha)\ **Replies:** 2\ **Last updated:** [July 14, 2018, 8:29pm UTC](https://discuss.elastic.co/t/two-filbert-yml-file/139955 "2018-07-14T20:29:39Z")
Hello all, a question: can I create two files filebeat.yml on the same machine (both are here: /etc/filebeat/) and each one sent the same information but to different logstash? (not as loadbalancer) regards Felipe --- ## [MetricBeat´s installation stopped](https://discuss.elastic.co/t/metricbeat-s-installation-stopped/140000)
**Author:** [@Diego\_Moreno](https://discuss.elastic.co/u/Diego_Moreno)\ **Replies:** 3\ **Last updated:** [July 14, 2018, 11:47am UTC](https://discuss.elastic.co/t/metricbeat-s-installation-stopped/140000 "2018-07-14T11:47:55Z")
--- ## [Need a hand to install dashboard](https://discuss.elastic.co/t/need-a-hand-to-install-dashboard/140022)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 2\ **Last updated:** [July 14, 2018, 11:28am UTC](https://discuss.elastic.co/t/need-a-hand-to-install-dashboard/140022 "2018-07-14T11:28:33Z")
Hi. I need a bit of a hand to install some dashboards. I have some security enabled on my cluster so can't just upload them... I need a hand with the auditbeat dashboard but my beat is installed on a windows machine.. I… --- ## [Filebeat exclude lines not working](https://discuss.elastic.co/t/filebeat-exclude-lines-not-working/139879)
**Author:** [@HerberthObregon](https://discuss.elastic.co/u/HerberthObregon)\ **Replies:** 4\ **Last updated:** [July 14, 2018, 9:12am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-not-working/139879 "2018-07-14T09:12:04Z")
Filebeats does not exclude the lines as I expected my configuration is filebeat.prospectors: - type: log enabled: true paths: - /var/log/\*.log exclude\_lines: \['.js','.png','.svg','.json','.txt'\] #also i try… --- ## [How to enable filebeat to harvest .File Type?](https://discuss.elastic.co/t/how-to-enable-filebeat-to-harvest-file-type/138986)
**Author:** [@krisdinesh](https://discuss.elastic.co/u/krisdinesh)\ **Replies:** 10\ **Last updated:** [July 13, 2018, 11:46pm UTC](https://discuss.elastic.co/t/how-to-enable-filebeat-to-harvest-file-type/138986 "2018-07-13T23:46:15Z")
Hello, Please help me here. I have a file needs to be harvested by Filebeats 'D:\\apps\\jenkins\\jobs\\TestJob\\builds\\180\\log.File' but its not. --- ## [Make set\_version doesn't update ES template version suffix](https://discuss.elastic.co/t/make-set-version-doesnt-update-es-template-version-suffix/140013)
**Author:** [@fholzer](https://discuss.elastic.co/u/fholzer)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 10:14pm UTC](https://discuss.elastic.co/t/make-set-version-doesnt-update-es-template-version-suffix/140013 "2018-07-13T22:14:10Z")
Seems running make set\_version VERSION=X.Y.Z, then make update in custom beats doesn't update the version number used as part of the template name. It seems to always use the defaultBeatVersion in vendor/github.com/elast… --- ## [Processing of multiple once created files](https://discuss.elastic.co/t/processing-of-multiple-once-created-files/140004)
**Author:** [@pazderak](https://discuss.elastic.co/u/pazderak)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 9:37pm UTC](https://discuss.elastic.co/t/processing-of-multiple-once-created-files/140004 "2018-07-13T21:37:03Z")
hello, my application creates the log records as separate files, each log record is in one file. I tried to configure FileBeat to process them and send to logstash, but with no success. I used the latest available vers… --- ## [Filebeate multiline pattern for multiple expression](https://discuss.elastic.co/t/filebeate-multiline-pattern-for-multiple-expression/139956)
**Author:** [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 5:30pm UTC](https://discuss.elastic.co/t/filebeate-multiline-pattern-for-multiple-expression/139956 "2018-07-13T17:30:15Z")
Hi Everyone, Hope you all are doing great !! I'm trying to parse mulitple expression in multiline in my filebeat configuartion but i'm not able to meet the expected result. Type of logs i want to parse: expr1: 2018… --- ## [Refreshing configuration](https://discuss.elastic.co/t/refreshing-configuration/139830)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 2\ **Last updated:** [July 13, 2018, 4:48pm UTC](https://discuss.elastic.co/t/refreshing-configuration/139830 "2018-07-13T16:48:27Z")
I've killed HB, made changes for heartbeat.monitors on my heartbeat.yml config file, and restarted HB... but it keeps monitoring the old configuration? Changes include commenting out a full type and changing tags on othe… --- ## [How can i pass a extra field](https://discuss.elastic.co/t/how-can-i-pass-a-extra-field/139870)
**Author:** [@Chiranjeevi\_Medichar](https://discuss.elastic.co/u/Chiranjeevi_Medichar)\ **Replies:** 3\ **Last updated:** [July 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/how-can-i-pass-a-extra-field/139870 "2018-07-13T14:24:44Z")
can i pass a extra field in filebeat not only a message --- ## [Docker - logging the container id](https://discuss.elastic.co/t/docker-logging-the-container-id/139831)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 2\ **Last updated:** [July 13, 2018, 12:27pm UTC](https://discuss.elastic.co/t/docker-logging-the-container-id/139831 "2018-07-13T12:27:02Z")
Hi, I'm running filebeat 6.3 as a container on my machine, watching /var/lib/docker/containers//.log (mapped as a volume), and collecting all the logs of all the containers in that machine. In order to distinguish bet… --- ## [Syslog and multiline](https://discuss.elastic.co/t/syslog-and-multiline/139010)
**Author:** [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 10:32am UTC](https://discuss.elastic.co/t/syslog-and-multiline/139010 "2018-07-13T10:32:54Z")
I'm trying to get logging from a service connected to filebeat (running in another container). The log messages are sent using syslog and many of them are split over several lines so I want to set up multiline, but I can… --- ## [How to decode gzip response body?](https://discuss.elastic.co/t/how-to-decode-gzip-response-body/139876)
**Author:** [@nice98jh](https://discuss.elastic.co/u/nice98jh)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 9:37am UTC](https://discuss.elastic.co/t/how-to-decode-gzip-response-body/139876 "2018-07-13T09:37:55Z")
Can Packetbeat decode gzip body? "response": { "phrase": "OK", "headers": { "content-length": 307, "content-type": "application/json;charset=UTF-8" }, "body": "\\u001f�\\b\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0003m�… --- ## [Anyone worked with logbeat in the users' workstations?](https://discuss.elastic.co/t/anyone-worked-with-logbeat-in-the-users-workstations/139836)
**Author:** [@Pedro\_Trindade](https://discuss.elastic.co/u/Pedro_Trindade)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 8:55am UTC](https://discuss.elastic.co/t/anyone-worked-with-logbeat-in-the-users-workstations/139836 "2018-07-13T08:55:24Z")
I recently read two articles with interesting windows events to monitor involving Software and Service installations, Kernel Erros, External Medias and so on. For monitoring and alerting based on that I would need to di… --- ## [Cpu utilization visualization using metricbeat](https://discuss.elastic.co/t/cpu-utilization-visualization-using-metricbeat/139721)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 4\ **Last updated:** [July 13, 2018, 7:58am UTC](https://discuss.elastic.co/t/cpu-utilization-visualization-using-metricbeat/139721 "2018-07-13T07:58:30Z")
I have my CPU metrics coming up and have been visualizing them using the Visual blinder in time series, every thing seems fine but when today suddenly the CPU from one of the BOX went to 100% , i was unable to see the sa… --- ## [EKS experience grpc error after install Metricbeat](https://discuss.elastic.co/t/eks-experience-grpc-error-after-install-metricbeat/139802)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 1\ **Last updated:** [July 13, 2018, 7:31am UTC](https://discuss.elastic.co/t/eks-experience-grpc-error-after-install-metricbeat/139802 "2018-07-13T07:31:42Z")
We are using AWS EKS and follow github and elastic doc to install Metricbeat I've feeling this is EKS side problem, but would like to know see if any chance there can fix in metricbeat config level ? Error : // grp… --- ## [Features in filebeat apache2 licence](https://discuss.elastic.co/t/features-in-filebeat-apache2-licence/139888)
**Author:** [@Akram1](https://discuss.elastic.co/u/Akram1)\ **Replies:** 6\ **Last updated:** [July 13, 2018, 7:27am UTC](https://discuss.elastic.co/t/features-in-filebeat-apache2-licence/139888 "2018-07-13T07:27:06Z")
Hi, I am hoping to find the list of features in apache2 licence available for following: FileBeat ElasticSearch Kibana Logstash MetricBeat Any kind of help will be much appreciated. Thanks --- ## [Metrcibeat 6.2.4](https://discuss.elastic.co/t/metrcibeat-6-2-4/139456)
**Author:** [@sa2kumar](https://discuss.elastic.co/u/sa2kumar)\ **Replies:** 3\ **Last updated:** [July 13, 2018, 2:58am UTC](https://discuss.elastic.co/t/metrcibeat-6-2-4/139456 "2018-07-13T02:58:53Z")
I am using elasticsearch 6.2.4 and metricbeat 6.2.4 in my environment. I am trying to get the index system.cpu.total.norm.pct from metricbeat to use it as a variable in elastalert for sending system overall cpu usage not… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=435) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=437)