# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=438 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 439 --- ## [Filebeat-god stopped](https://discuss.elastic.co/t/filebeat-god-stopped/139291)
**Author:** [@nandan\_bigdata](https://discuss.elastic.co/u/nandan_bigdata)\ **Replies:** 2\ **Last updated:** [July 11, 2018, 2:23am UTC](https://discuss.elastic.co/t/filebeat-god-stopped/139291 "2018-07-11T02:23:39Z")
Hello All, I am using filebeat to access one simple log file. filebeat.yml :- filebeat.inputs: type: log enabled: true paths: - /var/log/nandan.log output.elasticsearch: hosts: \["10.10.1.5:9200"\] nandan.log f… --- ## [Metricbeat Windows Perfmon Module Inconsistent Metric Intervals](https://discuss.elastic.co/t/metricbeat-windows-perfmon-module-inconsistent-metric-intervals/138021)
**Author:** [@chuhuethaoattv](https://discuss.elastic.co/u/chuhuethaoattv)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 6:16pm UTC](https://discuss.elastic.co/t/metricbeat-windows-perfmon-module-inconsistent-metric-intervals/138021 "2018-07-10T18:16:42Z")
Hello, I am using metricbeat to monitor a Windows box, and I have noticed that Windows Permon metrics is not consistent. I have it configured to every 60s, but I am noticing that there are gaps in the data in elasticsea… --- ## [Filebeat Inserts \\t in place of tabs in Logstash](https://discuss.elastic.co/t/filebeat-inserts-t-in-place-of-tabs-in-logstash/139402)
**Author:** [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 4:53pm UTC](https://discuss.elastic.co/t/filebeat-inserts-t-in-place-of-tabs-in-logstash/139402 "2018-07-10T16:53:34Z")
Hi, Need some help, I am shipping the logs using filebeat to remote Logstash and my log contains tabs in between. Following LS filter was working perfectly until yesterday. kv { value\_split =\> "::" trim\_value =\> ":… --- ## [Can Filebeat read from an S3 bucket](https://discuss.elastic.co/t/can-filebeat-read-from-an-s3-bucket/139398)
**Author:** [@jobse.batres](https://discuss.elastic.co/u/jobse.batres)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 4:23pm UTC](https://discuss.elastic.co/t/can-filebeat-read-from-an-s3-bucket/139398 "2018-07-10T16:23:39Z")
Hello, I'm new to Filebeat and I was wondering if it is possible to configure Filebeat (running inside docker containter) to read a log file from an S3 bucket and send the data to my elasticsearch cluster in AWS? Essen… --- ## [Filebeat mongo module, grok pattern is incorrect](https://discuss.elastic.co/t/filebeat-mongo-module-grok-pattern-is-incorrect/138971)
**Author:** [@cwray](https://discuss.elastic.co/u/cwray)\ **Replies:** 5\ **Last updated:** [July 10, 2018, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-mongo-module-grok-pattern-is-incorrect/138971 "2018-07-10T15:33:13Z")
The grok pattern ha an extra escape \\ in it in the ingest pip line. should look like this. %{TIMESTAMP\_ISO8601:mongodb.log.timestamp} %{WORD:mongodb.log.severity} %{WORD:mongodb.log.component} \*\\\[%{WORD:mongodb.log.c… --- ## [Error in Powershell during Config](https://discuss.elastic.co/t/error-in-powershell-during-config/139163)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 23\ **Last updated:** [July 10, 2018, 12:53pm UTC](https://discuss.elastic.co/t/error-in-powershell-during-config/139163 "2018-07-10T12:53:21Z")
I have been following the tutorial to get Winlogbeat installed, and I got stuck on this bit: https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-template.html#load-template-manually. Whenever I run this … --- ## [Low @timestamp precision cause wrong order of events with docker input](https://discuss.elastic.co/t/low-timestamp-precision-cause-wrong-order-of-events-with-docker-input/137051)
**Author:** [@smamontov](https://discuss.elastic.co/u/smamontov)\ **Replies:** 6\ **Last updated:** [July 10, 2018, 2:56pm UTC](https://discuss.elastic.co/t/low-timestamp-precision-cause-wrong-order-of-events-with-docker-input/137051 "2018-07-10T14:56:58Z")
Hi! I'm using Filebeat 6.3.0 and Docker 18.0.05-ce. Docker stores timestamps with nanoseconds, but elasticsearch date format precision is a millisecond. Looks like this issue never be fixed. Is there any elegant solu… --- ## [Configuration problem](https://discuss.elastic.co/t/configuration-problem/139112)
**Author:** [@waitangi](https://discuss.elastic.co/u/waitangi)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 12:16pm UTC](https://discuss.elastic.co/t/configuration-problem/139112 "2018-07-10T12:16:01Z")
Hello I have a problem with filebeat configuration. When paths configuration looks like this all works fine (index created document indexed): paths: - C:\\Users\\pawnow\\logstash\\iis-log.log However I need to parse iis … --- ## [Filebeat issue](https://discuss.elastic.co/t/filebeat-issue/139151)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 10\ **Last updated:** [July 10, 2018, 10:40am UTC](https://discuss.elastic.co/t/filebeat-issue/139151 "2018-07-10T10:40:15Z")
When i am starting the service of filebeat it is giving this error. Starting filebeat: Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'/etc/filebeat/filebeat.yml') w… --- ## [Logs pulling from different server](https://discuss.elastic.co/t/logs-pulling-from-different-server/139092)
**Author:** [@amritesh\_mishra](https://discuss.elastic.co/u/amritesh_mishra)\ **Replies:** 3\ **Last updated:** [July 9, 2018, 8:22pm UTC](https://discuss.elastic.co/t/logs-pulling-from-different-server/139092 "2018-07-09T20:22:52Z")
Hi, I was looking for a following pipeline : RemoteServers(FileBeat) =\> Central Server (LogStash) =\> ElasticSearch I want FileBeat to copy files from client servers to a central repository (specific directory) and the… --- ## [Metricbeat: Failed to encode event: unsupported float value: NaN](https://discuss.elastic.co/t/metricbeat-failed-to-encode-event-unsupported-float-value-nan/139093)
**Author:** [@cck](https://discuss.elastic.co/u/cck)\ **Replies:** 1\ **Last updated:** [July 9, 2018, 6:30pm UTC](https://discuss.elastic.co/t/metricbeat-failed-to-encode-event-unsupported-float-value-nan/139093 "2018-07-09T18:30:09Z")
I am trying to inspect docker containers with metricbeat:6.3.0 in docker, and post data to elasticsearch: 6.3.0, and my host is Ubuntu16.04, the metricbeat.yml and docker.yml works when I install metricbeat on host dire… --- ## [Connecting Metricbeat to Hawtio](https://discuss.elastic.co/t/connecting-metricbeat-to-hawtio/139214)
**Author:** [@ehed810](https://discuss.elastic.co/u/ehed810)\ **Replies:** 1\ **Last updated:** [July 9, 2018, 6:23pm UTC](https://discuss.elastic.co/t/connecting-metricbeat-to-hawtio/139214 "2018-07-09T18:23:22Z")
Is it possible to connect Metricbeat to Hawtio? I am trying to connect Metricbeat to Hawtio to access the Jolokia connections I have within Hawtio. --- ## [Error gopath -](https://discuss.elastic.co/t/error-gopath/139207)
**Author:** [@charafouddine\_ahmed](https://discuss.elastic.co/u/charafouddine_ahmed)\ **Replies:** 0\ **Last updated:** [July 9, 2018, 3:42pm UTC](https://discuss.elastic.co/t/error-gopath/139207 "2018-07-09T15:42:26Z")
ahmed@ahmed-Charafouddine:~/go/src/github.com/ahmed/lsbeat$ make go build main.go:8:2: cannot find package "github.com/charafouddineahmed/lsbeat/beater" in any of: /home/ahmed/go/src/github.com/ahmed/lsbeat/vendor/gi… --- ## [Need to monitor apache workers and requests](https://discuss.elastic.co/t/need-to-monitor-apache-workers-and-requests/138707)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 3\ **Last updated:** [July 9, 2018, 1:13pm UTC](https://discuss.elastic.co/t/need-to-monitor-apache-workers-and-requests/138707 "2018-07-09T13:13:09Z")
I have an instance with "Elasticsearch , Logstash and kibana" and filebeats installed in other multiple instances i'm trying to monitor apache2 requests , workers and so on, Discover tab in kibana working fine but Visu… --- ## [Filebeat memory leak on Kubernetes?](https://discuss.elastic.co/t/filebeat-memory-leak-on-kubernetes/137208)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 10\ **Last updated:** [July 9, 2018, 10:35am UTC](https://discuss.elastic.co/t/filebeat-memory-leak-on-kubernetes/137208 "2018-07-09T10:35:47Z")
I have been running Filebeat in a DaemonSet using the "autodiscover" feature for a couple of weeks, and all worked fine. But at some point on Friday the Filebeat instances started eating memory until they got killed by t… --- ## [Failed json lines being ignored](https://discuss.elastic.co/t/failed-json-lines-being-ignored/137617)
**Author:** [@danimaiochi](https://discuss.elastic.co/u/danimaiochi)\ **Replies:** 6\ **Last updated:** [July 9, 2018, 9:27am UTC](https://discuss.elastic.co/t/failed-json-lines-being-ignored/137617 "2018-07-09T09:27:21Z")
Hello guys! Recently I discovered the json processor and it made my life much easier! The only problem I'm encountering with it, is that if a line fails to be pushed, the "on\_failure" is not executed. example: pipeli… --- ## [Minimal filebeat config: syslog -\> file](https://discuss.elastic.co/t/minimal-filebeat-config-syslog-file/138968)
**Author:** [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)\ **Replies:** 3\ **Last updated:** [July 9, 2018, 9:07am UTC](https://discuss.elastic.co/t/minimal-filebeat-config-syslog-file/138968 "2018-07-09T09:07:10Z")
In an attempt to walk before running I thought I'd set up a filebeat instance as a syslog server and then use logger to send log messages to it. My Docker Compose configuration for setting up filebeat is filebeat: im… --- ## [Filebeat: docker autodiscover - do I have things right?](https://discuss.elastic.co/t/filebeat-docker-autodiscover-do-i-have-things-right/138404)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 5\ **Last updated:** [July 9, 2018, 8:44am UTC](https://discuss.elastic.co/t/filebeat-docker-autodiscover-do-i-have-things-right/138404 "2018-07-09T08:44:11Z")
Hi there, After reading and watching this information: https://www.elastic.co/guide/en/beats/filebeat/6.3/configuration-autodiscover.html https://www.elastic.co/webinars/elasticsearch-log-collection-with-kubernetes… --- ## [My filebeat registry file has no data "is empty"](https://discuss.elastic.co/t/my-filebeat-registry-file-has-no-data-is-empty/138389)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 5\ **Last updated:** [July 9, 2018, 8:42am UTC](https://discuss.elastic.co/t/my-filebeat-registry-file-has-no-data-is-empty/138389 "2018-07-09T08:42:28Z")
Hi all, i have a problem with my filebeat , the registry file is empty and still empty so nothing to monitor what should i have to do to fix this issue ? Thanks, --- ## [Where to find the valid structure of filebeat?](https://discuss.elastic.co/t/where-to-find-the-valid-structure-of-filebeat/139099)
**Author:** [@Nina\_brown](https://discuss.elastic.co/u/Nina_brown)\ **Replies:** 1\ **Last updated:** [July 9, 2018, 8:40am UTC](https://discuss.elastic.co/t/where-to-find-the-valid-structure-of-filebeat/139099 "2018-07-09T08:40:45Z")
I'm trying to config a simple filebeat.yml file, but I get syntax errors and I cannot find more details on what is the correct structure for that. Here is my filebeat.yml file but I get the error "line 8: did not find e… --- ## [Metricbeat dashboards doesnot show all data](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 11\ **Last updated:** [July 9, 2018, 8:39am UTC](https://discuss.elastic.co/t/metricbeat-dashboards-doesnot-show-all-data/135712 "2018-07-09T08:39:23Z")
Hey Guys, I have installed metricbeat in some virtual machines and started sending data to elasticsearch. I have imported default dashboards also for the same. The problem is, the dashboard is not visualizing all data,… --- ## [Module system.yml doesn't exist](https://discuss.elastic.co/t/module-system-yml-doesnt-exist/138338)
**Author:** [@hamish](https://discuss.elastic.co/u/hamish)\ **Replies:** 10\ **Last updated:** [July 9, 2018, 6:36am UTC](https://discuss.elastic.co/t/module-system-yml-doesnt-exist/138338 "2018-07-09T06:36:25Z")
I'm struggling... A lot of the setup and config just doesn't make sense, or looks completely wrong. I've installed metricbeat via 64-bit RPM on RHEL-7. There's a /etc/metricbeat config directory created and binaries are… --- ## [Insserv-compat required on openSUSE Leap 15](https://discuss.elastic.co/t/insserv-compat-required-on-opensuse-leap-15/138034)
**Author:** [@NiceGuyIT](https://discuss.elastic.co/u/NiceGuyIT)\ **Replies:** 2\ **Last updated:** [July 9, 2018, 3:02am UTC](https://discuss.elastic.co/t/insserv-compat-required-on-opensuse-leap-15/138034 "2018-07-09T03:02:31Z")
After installing several beats, they failed to start with the following. # systemctl enable packetbeat.service Synchronizing state of packetbeat.service with SysV service script with /usr/lib/systemd/systemd-sysv-instal… --- ## [Getting multiline to work](https://discuss.elastic.co/t/getting-multiline-to-work/139020)
**Author:** [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)\ **Replies:** 2\ **Last updated:** [July 8, 2018, 2:29pm UTC](https://discuss.elastic.co/t/getting-multiline-to-work/139020 "2018-07-08T14:29:04Z")
I have another question on getting mulitline to work with syslog, but I thought I'd simplify my configuration a little and remove syslog from the equation. The Docker Compose config for the filebeat container is file… --- ## [Filebeat send different files to different output](https://discuss.elastic.co/t/filebeat-send-different-files-to-different-output/139036)
**Author:** [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Replies:** 1\ **Last updated:** [July 8, 2018, 1:48pm UTC](https://discuss.elastic.co/t/filebeat-send-different-files-to-different-output/139036 "2018-07-08T13:48:33Z")
Hi, We have a requirement where we need to parse two different logs using filebeat. Send the first file content to Kafka Since the second file has lot of irrelevant information, some basic filtering will be done in fi… --- ## [Using Filebeat for logging ssh log in](https://discuss.elastic.co/t/using-filebeat-for-logging-ssh-log-in/133822)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 12\ **Last updated:** [July 8, 2018, 10:57am UTC](https://discuss.elastic.co/t/using-filebeat-for-logging-ssh-log-in/133822 "2018-07-08T10:57:01Z")
Hi, I am using the following configuration, OS - CentOS Linux release 7.4.1708 (Core) ES - 6.2 LogStash - 6.2 Kibana - 6.2 FileBeat - 6.2 I was using the filebeat for pushing the logs from the server to the kibana… --- ## [SSL communication between Filebeat and Kafka](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303)
**Author:** [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Replies:** 5\ **Last updated:** [July 7, 2018, 4:06pm UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303 "2018-07-07T16:06:21Z")
Hi All, We have a cluster where we have 2-way SSL authentication enabled in Kafka. Also we have log management setup in the same cluster like FileBeat --\> Kafka --\> Logstash --\> ElasticSearch --\> Kibana. Now since SSL… --- ## [Using Filebeat dedicated and send logs to different IP](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823)
**Author:** [@Wahyu](https://discuss.elastic.co/u/Wahyu)\ **Replies:** 4\ **Last updated:** [July 6, 2018, 2:37pm UTC](https://discuss.elastic.co/t/using-filebeat-dedicated-and-send-logs-to-different-ip/138823 "2018-07-06T14:37:10Z")
Hi, I am a newcomer here especially logs monitory system. I am learning to build log system. Basically, i choose the opensource :slight\_smile: So, i have 2 VPS right now. In the first VPS (x.x.x.x), there are Graylog… --- ## [Rotate on time](https://discuss.elastic.co/t/rotate-on-time/138927)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 2:16pm UTC](https://discuss.elastic.co/t/rotate-on-time/138927 "2018-07-06T14:16:51Z")
Hi, Is it possible to make filebeat rotate a file based on time instead of on filesize? So that you can make it rotate once per hour or once per day or whatever you choose? Cheers, Eric --- ## [Filbeats not forwarding logs to logstash with back off now error](https://discuss.elastic.co/t/filbeats-not-forwarding-logs-to-logstash-with-back-off-now-error/137637)
**Author:** [@01n12](https://discuss.elastic.co/u/01n12)\ **Replies:** 6\ **Last updated:** [July 6, 2018, 12:58pm UTC](https://discuss.elastic.co/t/filbeats-not-forwarding-logs-to-logstash-with-back-off-now-error/137637 "2018-07-06T12:58:54Z")
I'm facing a problem to forward logs from filebeats to logstash, my filbeats always throw a debug value backoff now and the following are logs of it, would some help me and also please help me to reprocess the logs from … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=437) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=439)