# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=437 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 438 --- ## [Filebeat configuration file](https://discuss.elastic.co/t/filebeat-configuration-file/139488)
**Author:** [@CCH0124](https://discuss.elastic.co/u/CCH0124)\ **Replies:** 4\ **Last updated:** [July 13, 2018, 12:42am UTC](https://discuss.elastic.co/t/filebeat-configuration-file/139488 "2018-07-13T00:42:37Z")
Kibana has used nginx as a reverse proxy. kibana version 6.2 filebeat version 6.3 filebeat.config: inputs: enabled: true modules: enabled: true filebeat.inputs: enabled: true filebeat.modules: - modu… --- ## [Configuring Metricbeat to send data to other machine](https://discuss.elastic.co/t/configuring-metricbeat-to-send-data-to-other-machine/139583)
**Author:** [@jtstorey](https://discuss.elastic.co/u/jtstorey)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 8:49pm UTC](https://discuss.elastic.co/t/configuring-metricbeat-to-send-data-to-other-machine/139583 "2018-07-12T20:49:23Z")
I have two VMs. One of them is running elasticsearch and kibana, the other is running metricbeat. I am trying to get the 2nd VM to send its data to the 1st. I thought that the only configuration was to put the IP of the … --- ## [Alert on repeated ping failures](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981)
**Author:** [@Rob2](https://discuss.elastic.co/u/Rob2)\ **Replies:** 10\ **Last updated:** [July 12, 2018, 7:14pm UTC](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981 "2018-07-12T19:14:19Z")
I'd like to set up: a dashboard showing the ping status of a number of systems (perhaps a table of system names and their status) alerts indicating when systems have stopped responding to the last X ping attempts. I c… --- ## [PacketBeat Performance- how lightweight it really is](https://discuss.elastic.co/t/packetbeat-performance-how-lightweight-it-really-is/139744)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 4:42pm UTC](https://discuss.elastic.co/t/packetbeat-performance-how-lightweight-it-really-is/139744 "2018-07-12T16:42:16Z")
As per the docs "Packetbeat can run on the same servers as your application processes or on its own servers. When running on dedicated servers, Packetbeat can get the traffic from the switch’s mirror ports or from tappin… --- ## [Filebeat with Docker mounted logs handle restart duplicates](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711)
**Author:** [@Rob\_Davidson](https://discuss.elastic.co/u/Rob_Davidson)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-with-docker-mounted-logs-handle-restart-duplicates/139711 "2018-07-12T14:48:28Z")
Im currently sending logs via a mounted volume. docker-compose.yml looks like the following version: '3' services: filebeat: image: docker.elastic.co/beats/filebeat:6.3.0 container\_name: filebeat volumes:… --- ## [Filebeat installation (without rpm/deb) and running without root](https://discuss.elastic.co/t/filebeat-installation-without-rpm-deb-and-running-without-root/139678)
**Author:** [@scheuri](https://discuss.elastic.co/u/scheuri)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-installation-without-rpm-deb-and-running-without-root/139678 "2018-07-12T14:41:53Z")
Hello all I am tasked to install and configure filebeat (yet rather unknown to me) on several servers in order to forward application logs to ELK. The server themselves will not use anything from ELK (except filebeat to… --- ## [MB 6.3.1 - Missing field: max, Missing field: value for ZlibMemUsage](https://discuss.elastic.co/t/mb-6-3-1-missing-field-max-missing-field-value-for-zlibmemusage/139664)
**Author:** [@james5](https://discuss.elastic.co/u/james5)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 2:39pm UTC](https://discuss.elastic.co/t/mb-6-3-1-missing-field-max-missing-field-value-for-zlibmemusage/139664 "2018-07-12T14:39:33Z")
In 6.3.0 and 6.3.1 (I tried to upgrade), I am seeing in the log file 2018-07-12T12:10:38.985+0800 ERROR schema/schema.go:41 Error on field 'value': Missing field: value, Error: Error converting param to int: ZlibMem… --- ## [Filebeat and GELF](https://discuss.elastic.co/t/filebeat-and-gelf/139660)
**Author:** [@Wahyu](https://discuss.elastic.co/u/Wahyu)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 2:36pm UTC](https://discuss.elastic.co/t/filebeat-and-gelf/139660 "2018-07-12T14:36:53Z")
Hello guys, Yesterday, i succeeded to do configuration and run Filebeat. After that, i visited my Graylog website and try to add inputs (Beats) with port 5044. Until now, i don't receive any message. I read the article … --- ## [Heartbeat Not Sending Logs to Elasticsearch/Kibana](https://discuss.elastic.co/t/heartbeat-not-sending-logs-to-elasticsearch-kibana/139631)
**Author:** [@ps895r](https://discuss.elastic.co/u/ps895r)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 2:34pm UTC](https://discuss.elastic.co/t/heartbeat-not-sending-logs-to-elasticsearch-kibana/139631 "2018-07-12T14:34:46Z")
I have elk stack setup and working. I used docker-elk, which is up on github and it pulling Elasticsearch, Logstash and Kibana versions 6.2.4. I then pulled the docker image for Heartbeat 6.3.0. I was able to start it an… --- ## [Wrong timestamp from metricbeat 6.3.0](https://discuss.elastic.co/t/wrong-timestamp-from-metricbeat-6-3-0/138693)
**Author:** [@MrFrost](https://discuss.elastic.co/u/MrFrost)\ **Replies:** 6\ **Last updated:** [July 12, 2018, 10:57am UTC](https://discuss.elastic.co/t/wrong-timestamp-from-metricbeat-6-3-0/138693 "2018-07-12T10:57:29Z")
Hello, I have no idea what can be wrong, but timestamp for data sent by metricbeat is incorrect. i did double check elasticsearch and server date and time that is set. On server PC my time is lets say 12:30 pm CEST I… --- ## [Filebeat to ignore already existing content only for the first time](https://discuss.elastic.co/t/filebeat-to-ignore-already-existing-content-only-for-the-first-time/139541)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 9:36am UTC](https://discuss.elastic.co/t/filebeat-to-ignore-already-existing-content-only-for-the-first-time/139541 "2018-07-12T09:36:01Z")
I am planning to have filebeat deployed in production where the log files are already huge in size and will be backed up only after it reaches 300MB. I am running filebeat as a windows service in my windows 2012 server. … --- ## [Json format and types](https://discuss.elastic.co/t/json-format-and-types/139540)
**Author:** [@dmccuk](https://discuss.elastic.co/u/dmccuk)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 8:56am UTC](https://discuss.elastic.co/t/json-format-and-types/139540 "2018-07-12T08:56:26Z")
Hi, I've been setting up filebeat to send json formatted logs over to logstash before storing in ES. I'm not sure if my issue is related to filebeat or logstash. ISSUE: Once the JSON formated files have made there was… --- ## [Error GOPATH](https://discuss.elastic.co/t/error-gopath/139204)
**Author:** [@charafouddine\_ahmed](https://discuss.elastic.co/u/charafouddine_ahmed)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 7:58am UTC](https://discuss.elastic.co/t/error-gopath/139204 "2018-07-12T07:58:14Z")
Hello, I want to create my own Beat but unfortunately, I am faced with several problems that I can not solve or I do not understand. In particular the GOPATH. What's the point ? Because without really understanding it… --- ## [Filebeat config error](https://discuss.elastic.co/t/filebeat-config-error/139350)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 3\ **Last updated:** [July 12, 2018, 1:49am UTC](https://discuss.elastic.co/t/filebeat-config-error/139350 "2018-07-12T01:49:25Z")
}} 2018-07-10T14:14:14.001+0100 INFO instance/beat.go:225 Setup Beat: filebeat; Version: 6.3.1 2018-07-10T14:14:14.001+0100 DEBUG \[beat\] instance/beat.go:242 Initializing output plugins 2018-07-10T14… --- ## [MongoDB Module - Grok Expression does not match](https://discuss.elastic.co/t/mongodb-module-grok-expression-does-not-match/139241)
**Author:** [@James\_Quigley](https://discuss.elastic.co/u/James_Quigley)\ **Replies:** 4\ **Last updated:** [July 11, 2018, 8:48pm UTC](https://discuss.elastic.co/t/mongodb-module-grok-expression-does-not-match/139241 "2018-07-11T20:48:49Z")
The default grok expression created by filebeat for the ingest node pipeline does not match the logs sent to ES. Not using any sort of custom mongo logs, everything is just default. Tried writing my own Grok expression,… --- ## [Rollups for beats?](https://discuss.elastic.co/t/rollups-for-beats/135951)
**Author:** [@christopher-b](https://discuss.elastic.co/u/christopher-b)\ **Replies:** 4\ **Last updated:** [July 11, 2018, 5:23pm UTC](https://discuss.elastic.co/t/rollups-for-beats/135951 "2018-07-11T17:23:38Z")
Now that Elastic Stack 6.3 has shipped with the Rollups API, I'm wondering if there is any plan to develop a set of "default" or jumping-off point rollup configs for Beats. I'm sure many people would like to rollup their… --- ## [Filebeat not reading logs from log files .Non-zero metrics in the last 30s](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323)
**Author:** [@pkshara](https://discuss.elastic.co/u/pkshara)\ **Replies:** 7\ **Last updated:** [July 11, 2018, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323 "2018-07-11T17:02:54Z")
Hi Team, I am running filebeat in linux server , i have logstash 2.3 , Es 2.3 version and filebeat 6.2.0 version . Is this the issue with compatibility . Filebeat config gives the log info as "Non-zero metrics in the l… --- ## [No matching indices found with metricbeat](https://discuss.elastic.co/t/no-matching-indices-found-with-metricbeat/139572)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [July 11, 2018, 1:52pm UTC](https://discuss.elastic.co/t/no-matching-indices-found-with-metricbeat/139572 "2018-07-11T13:52:19Z")
Please what this error means ? --- ## [Metricsets are ignored](https://discuss.elastic.co/t/metricsets-are-ignored/139517)
**Author:** [@jordan](https://discuss.elastic.co/u/jordan)\ **Replies:** 2\ **Last updated:** [July 11, 2018, 1:51pm UTC](https://discuss.elastic.co/t/metricsets-are-ignored/139517 "2018-07-11T13:51:33Z")
with the configuration below I keep getting all metricbeat fields in kibana: processes, network etc. I would expect to have only the cpu data based on my config. Are my expectation wrong? What is the purpose of metrics… --- ## [Couldn't find the modules](https://discuss.elastic.co/t/couldnt-find-the-modules/139565)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [July 11, 2018, 12:32pm UTC](https://discuss.elastic.co/t/couldnt-find-the-modules/139565 "2018-07-11T12:32:23Z")
Hi, I just install Metricbeat but I could not find : metricbeat.modules: - module: system metricsets: - cpu - filesystem - memory - network - process enabled: true period: 10s processes: \['.… --- ## [Elastic output for modules and logstash output for prospectors?](https://discuss.elastic.co/t/elastic-output-for-modules-and-logstash-output-for-prospectors/139535)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 4\ **Last updated:** [July 11, 2018, 11:35am UTC](https://discuss.elastic.co/t/elastic-output-for-modules-and-logstash-output-for-prospectors/139535 "2018-07-11T11:35:25Z")
Hi all, is it possible to send module's data directy to logstash, but prospector data to logstash indexer? --- ## [Deploying Winlogbeat to collect event logs from a dev environment](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 3\ **Last updated:** [July 11, 2018, 10:45am UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378 "2018-07-11T10:45:18Z")
Now that I have deployed winlogbeat to collect events from my event viewers, how can I go on about collecting events from my development environment? Would it work something like this: Instead of installing winlogbeat … --- ## [Multiple files with different Multilnes](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132)
**Author:** [@astrovj](https://discuss.elastic.co/u/astrovj)\ **Replies:** 3\ **Last updated:** [July 11, 2018, 10:13am UTC](https://discuss.elastic.co/t/multiple-files-with-different-multilnes/137132 "2018-07-11T10:13:01Z")
I am attempting to read 2 files with multiline logs. But I am not getting the desired result. In test1.log line starts with date. In test2.log line starts with time. I get results for each log individually but when I … --- ## [Jolokia setup on metricbeat](https://discuss.elastic.co/t/jolokia-setup-on-metricbeat/137460)
**Author:** [@dmccuk](https://discuss.elastic.co/u/dmccuk)\ **Replies:** 2\ **Last updated:** [July 11, 2018, 9:46am UTC](https://discuss.elastic.co/t/jolokia-setup-on-metricbeat/137460 "2018-07-11T09:46:04Z")
Hi All, I've been following the steps to setup the jolokia module within metricbeat and I must be doing something wrong so I need some help. I'm attempting to monitor the JMX and collect data out of mbeans for the Java … --- ## [Send MetricBeat metrics to a REST endpoint](https://discuss.elastic.co/t/send-metricbeat-metrics-to-a-rest-endpoint/139520)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 1\ **Last updated:** [July 11, 2018, 9:12am UTC](https://discuss.elastic.co/t/send-metricbeat-metrics-to-a-rest-endpoint/139520 "2018-07-11T09:12:50Z")
Hi, Currently, we are using Metricbeat to send some metrics to Logstash. The logstash details is configured in metricbeat.yml file: output.logstash: hosts: \["logstashurl.com:5044"\] We want to send the metrics to a R… --- ## [IIS logs -Provided Grok expressions do not match field value](https://discuss.elastic.co/t/iis-logs-provided-grok-expressions-do-not-match-field-value/139341)
**Author:** [@neo](https://discuss.elastic.co/u/neo)\ **Replies:** 2\ **Last updated:** [July 11, 2018, 8:19am UTC](https://discuss.elastic.co/t/iis-logs-provided-grok-expressions-do-not-match-field-value/139341 "2018-07-11T08:19:04Z")
Hi,i make an module for my iis log,i use the default filebeat grok for IIS to parse the message, and I get an error like "Provided Grok expressions do not match field value:" one example of my message log is 2018-07-… --- ## [Beats plugin development in gitlab](https://discuss.elastic.co/t/beats-plugin-development-in-gitlab/139479)
**Author:** [@Manjukb](https://discuss.elastic.co/u/Manjukb)\ **Replies:** 5\ **Last updated:** [July 11, 2018, 7:21am UTC](https://discuss.elastic.co/t/beats-plugin-development-in-gitlab/139479 "2018-07-11T07:21:46Z")
Hi is there any dependency on github while building beats plugin ?? i want to put it private gitlab i have no github private repo Thanks --- ## [New data getting index with old data - Filebeat - Elasticsearch](https://discuss.elastic.co/t/new-data-getting-index-with-old-data-filebeat-elasticsearch/139444)
**Author:** [@nandan\_bigdata](https://discuss.elastic.co/u/nandan_bigdata)\ **Replies:** 4\ **Last updated:** [July 11, 2018, 6:15am UTC](https://discuss.elastic.co/t/new-data-getting-index-with-old-data-filebeat-elasticsearch/139444 "2018-07-11T06:15:29Z")
Hello Everyone, In my architecture, I am using 3 elastic components such as:- Filebeat Elasticsearch Kibana filebeat.yml configuration file is :- #=========================== Filebeat inputs =======================… --- ## [Can we set kafka output topic dynamically in filebeat?](https://discuss.elastic.co/t/can-we-set-kafka-output-topic-dynamically-in-filebeat/137778)
**Author:** [@Jaskirat\_Singh](https://discuss.elastic.co/u/Jaskirat_Singh)\ **Replies:** 6\ **Last updated:** [July 11, 2018, 4:00am UTC](https://discuss.elastic.co/t/can-we-set-kafka-output-topic-dynamically-in-filebeat/137778 "2018-07-11T04:00:23Z")
Hey all, I am using filebeat to read log files and output them to kafka.My log file contains lines like this: :2018/06/28 10:59:37 {"data":"test message","topic":"account\_4"} and filebeat read it like this: "@timest… --- ## [How to run filebeat without Kibana?](https://discuss.elastic.co/t/how-to-run-filebeat-without-kibana/139087)
**Author:** [@Wahyu](https://discuss.elastic.co/u/Wahyu)\ **Replies:** 6\ **Last updated:** [July 11, 2018, 2:45am UTC](https://discuss.elastic.co/t/how-to-run-filebeat-without-kibana/139087 "2018-07-11T02:45:36Z")
Hello Dear, I would like to run filebeat. But it always asks Kibana. Could i run filebeat setup without Kibana ? This is the error. [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=436) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=438)