# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=439 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 440 --- ## [Filebeat field name collision with external prospectors?](https://discuss.elastic.co/t/filebeat-field-name-collision-with-external-prospectors/138809)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 3\ **Last updated:** [July 6, 2018, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-field-name-collision-with-external-prospectors/138809 "2018-07-06T12:51:27Z")
After working through issues with the new host object in Logstash errors after upgrading to filebeat-6.3.0 we've decided to go down the long road of namespacing our critical fields away from anything libbeat might put in… --- ## [Php-fpm full status](https://discuss.elastic.co/t/php-fpm-full-status/138641)
**Author:** [@delayer](https://discuss.elastic.co/u/delayer)\ **Replies:** 2\ **Last updated:** [July 6, 2018, 12:47pm UTC](https://discuss.elastic.co/t/php-fpm-full-status/138641 "2018-07-06T12:47:05Z")
Hi all! I've discovered very useful php-fpm module of metricbeat fror pool state monitoring and it works like a charm. But for deeper investigation of fpm-related issues I need to know what script is running now. There … --- ## [Filebeat - Visualising cron tasks execution time](https://discuss.elastic.co/t/filebeat-visualising-cron-tasks-execution-time/138671)
**Author:** [@astropanic](https://discuss.elastic.co/u/astropanic)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 11:10am UTC](https://discuss.elastic.co/t/filebeat-visualising-cron-tasks-execution-time/138671 "2018-07-06T11:10:37Z")
Hi I have some entries in /var/log/cron.log like: Jul 5 10:40:01 sandbox-3 CRON\[30420\]: (root) CMD (\[30422\] echo2 'wopi' \> /tmp/wopi\_root.txt) Jul 5 10:40:01 sandbox-3 CRON\[30420\]: (CRON) error (grandchild #30422 fai… --- ## [Why beats does not add tag after aggregated mutilline](https://discuss.elastic.co/t/why-beats-does-not-add-tag-after-aggregated-mutilline/138716)
**Author:** [@2f41afb7656d94707a34](https://discuss.elastic.co/u/2f41afb7656d94707a34)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 9:58am UTC](https://discuss.elastic.co/t/why-beats-does-not-add-tag-after-aggregated-mutilline/138716 "2018-07-06T09:58:23Z")
After Logstash aggregated multiple logs, a tag will be added, while filebeat will not. This will affect my analysis of data and why filebeat does not add a tag？ --- ## [Load balancing : Filebeat](https://discuss.elastic.co/t/load-balancing-filebeat/138670)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 8:56am UTC](https://discuss.elastic.co/t/load-balancing-filebeat/138670 "2018-07-06T08:56:44Z")
Hi, Could you tell me if it is correcte : #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts # Send log to frghcslnetv10 hosts: \["172.16.250.29:5… --- ## [Content Field - Number of \*\*NEW\*\* Log Lines Harvested](https://discuss.elastic.co/t/content-field-number-of-new-log-lines-harvested/138656)
**Author:** [@olnrao](https://discuss.elastic.co/u/olnrao)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 8:49am UTC](https://discuss.elastic.co/t/content-field-number-of-new-log-lines-harvested/138656 "2018-07-06T08:49:38Z")
Can we have filebeat share the no. of new log lines It considered for processing It matched/filtered These numbers can then be used in multiple ways to assess the health of an application. Here are very simple use ca… --- ## [Harvesting specified number of most recent files](https://discuss.elastic.co/t/harvesting-specified-number-of-most-recent-files/138544)
**Author:** [@kskubala](https://discuss.elastic.co/u/kskubala)\ **Replies:** 5\ **Last updated:** [July 5, 2018, 3:30pm UTC](https://discuss.elastic.co/t/harvesting-specified-number-of-most-recent-files/138544 "2018-07-05T15:30:16Z")
Hi, I am wondering how to harvest only specified number of most recent files ? Or for example is there any way to not harvest files that have been renamed (but they always need to be read to the end so I think close\_re… --- ## [Filebeat multiline pattern for date format 'not working'!](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-date-format-not-working/138585)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 7\ **Last updated:** [July 5, 2018, 3:23pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern-for-date-format-not-working/138585 "2018-07-05T15:23:36Z")
Hi Guys, I have a problem with my multiline pattern in filebeat, my date format for Log-file p\_icn looks like \[6/13/18 8:11:25:022 CEST\] and I used these patterns '^\\\[\[0-9\]{1}/\[0-9\]{2}/\[0-9\]{2}' but it does not parset a… --- ## [Proper way to upgrade Metricbeat agent](https://discuss.elastic.co/t/proper-way-to-upgrade-metricbeat-agent/138521)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 1:24pm UTC](https://discuss.elastic.co/t/proper-way-to-upgrade-metricbeat-agent/138521 "2018-07-05T13:24:32Z")
Hello, Regarding upgrade of Metricbeat I have a few questions: Do I need every time to load Kibana dashboards when install new version of Metricbeat (Is this recommended action)? When doing upgrade from RPM packag… --- ## [Filebeat couldn't start](https://discuss.elastic.co/t/filebeat-couldnt-start/136046)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 13\ **Last updated:** [July 5, 2018, 9:56am UTC](https://discuss.elastic.co/t/filebeat-couldnt-start/136046 "2018-07-05T09:56:59Z")
Hi, I did this configuration on filebeat.yml but I had this error when I started it : - type: log enabled: true paths: - /var/log/network/FWEquin\_WAN\_R03-01M.log fields: log\_type: fortigate - type: log … --- ## [Metricbeats monitoring elasticsearch in docker: elasticsearch module or autodiscover?](https://discuss.elastic.co/t/metricbeats-monitoring-elasticsearch-in-docker-elasticsearch-module-or-autodiscover/138588)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 1\ **Last updated:** [July 5, 2018, 7:55am UTC](https://discuss.elastic.co/t/metricbeats-monitoring-elasticsearch-in-docker-elasticsearch-module-or-autodiscover/138588 "2018-07-05T07:55:16Z")
Hi there, I'm working on metricbeats 6.3 to monitor several applications in docker containers where one of them contains the official elasticsearch docker image. I'm using this syntax for docker: metricbeat.modules: #… --- ## [No filebeat index into elasticsearch indices](https://discuss.elastic.co/t/no-filebeat-index-into-elasticsearch-indices/138573)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 5\ **Last updated:** [July 5, 2018, 7:02am UTC](https://discuss.elastic.co/t/no-filebeat-index-into-elasticsearch-indices/138573 "2018-07-05T07:02:53Z")
\#===================== Filebeat inputs ======================= filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below ar… --- ## [Metricbeat on kubernetes - Desired pods and Available pods are wrong](https://discuss.elastic.co/t/metricbeat-on-kubernetes-desired-pods-and-available-pods-are-wrong/138202)
**Author:** [@akd](https://discuss.elastic.co/u/akd)\ **Replies:** 6\ **Last updated:** [July 5, 2018, 6:18am UTC](https://discuss.elastic.co/t/metricbeat-on-kubernetes-desired-pods-and-available-pods-are-wrong/138202 "2018-07-05T06:18:31Z")
Hi. I have deployed metricbeat daemonset on my kubernetes cluster with predefined kibana dashboards. I also deployed kube-state-metrics and I configure metricbeat according to it. I get metrics and seems good. However, a… --- ## [Metricbeat - mapping conflict](https://discuss.elastic.co/t/metricbeat-mapping-conflict/137124)
**Author:** [@anhlon](https://discuss.elastic.co/u/anhlon)\ **Replies:** 6\ **Last updated:** [July 4, 2018, 11:30pm UTC](https://discuss.elastic.co/t/metricbeat-mapping-conflict/137124 "2018-07-04T23:30:57Z")
Hi All, I am running into a problem with metricbeat. In my container I have a label "org.label-schema.build-date" which is set to the container build date. Things appear to be working fine, except over time, it causes… --- ## [Not able to include only required lines from filebeat](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599)
**Author:** [@HRG](https://discuss.elastic.co/u/HRG)\ **Replies:** 1\ **Last updated:** [July 4, 2018, 8:17pm UTC](https://discuss.elastic.co/t/not-able-to-include-only-required-lines-from-filebeat/138599 "2018-07-04T20:17:14Z")
Filebeat experts: I have gone through some existing forms topics to resolve the issue but i could not achieve it. From my log file, i wanted to extract only those line which has "Pub File" and "Published". I have provi… --- ## [Configuring system.filesystem to show useful mount stats](https://discuss.elastic.co/t/configuring-system-filesystem-to-show-useful-mount-stats/136914)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 6\ **Last updated:** [July 4, 2018, 4:59pm UTC](https://discuss.elastic.co/t/configuring-system-filesystem-to-show-useful-mount-stats/136914 "2018-07-04T16:59:17Z")
Hi there, I'm trying to configure metricbeats to show disk usage, particularly for /root /boot /data mount points. I've set up metricbeats.yml like this for system.filesystem module: - module: system enabled: true … --- ## [Filebeat setup error](https://discuss.elastic.co/t/filebeat-setup-error/138247)
**Author:** [@eric\_Igbinosun](https://discuss.elastic.co/u/eric_Igbinosun)\ **Replies:** 6\ **Last updated:** [July 4, 2018, 4:42pm UTC](https://discuss.elastic.co/t/filebeat-setup-error/138247 "2018-07-04T16:42:27Z")
hello guys getting up filebeat after installation when i run the filebeat setup cmd, i get this error. Exiting: error loading config file: yaml : line 45: did not find '\_' indicator is it because i have not setup kiba… --- ## [Failed to open persistent datastore: MapViewOfFile](https://discuss.elastic.co/t/failed-to-open-persistent-datastore-mapviewoffile/138537)
**Author:** [@BabkaFox](https://discuss.elastic.co/u/BabkaFox)\ **Replies:** 2\ **Last updated:** [July 4, 2018, 4:33pm UTC](https://discuss.elastic.co/t/failed-to-open-persistent-datastore-mapviewoffile/138537 "2018-07-04T16:33:00Z")
When I launch auditbeat, I see such a message: "failed to open persistent datastore: MapViewOfFile: Not enough storage is available to process this command". The file beats.db has a size of 1 gigabyte and no longer incr… --- ## [Response Time in Http module (Metricbeat)](https://discuss.elastic.co/t/response-time-in-http-module-metricbeat/138167)
**Author:** [@SakshamSaxena97](https://discuss.elastic.co/u/SakshamSaxena97)\ **Replies:** 1\ **Last updated:** [July 4, 2018, 3:08pm UTC](https://discuss.elastic.co/t/response-time-in-http-module-metricbeat/138167 "2018-07-04T15:08:51Z")
Can response time be extracted from http module configuration of metricbeat which GET requests a particular endpoint. My config for http module is listed below: - module: http metricsets: \["json"\] period: 10s hosts:… --- ## [Best Beat for Apache Tomcat Log with dashboard in Kibana](https://discuss.elastic.co/t/best-beat-for-apache-tomcat-log-with-dashboard-in-kibana/138527)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 5\ **Last updated:** [July 4, 2018, 2:19pm UTC](https://discuss.elastic.co/t/best-beat-for-apache-tomcat-log-with-dashboard-in-kibana/138527 "2018-07-04T14:19:02Z")
Hi, Which is the best beat for configuring the apache tomcat logs to get parsed using kibana . I have tried with filebeat, metricbeat(jolokia - but no dashboards :frowning: ) but nothing was successfull. Request to ad… --- ## [Loadbalancing with filebeat](https://discuss.elastic.co/t/loadbalancing-with-filebeat/138552)
**Author:** [@Rajat\_bhardwaj](https://discuss.elastic.co/u/Rajat_bhardwaj)\ **Replies:** 2\ **Last updated:** [July 4, 2018, 1:11pm UTC](https://discuss.elastic.co/t/loadbalancing-with-filebeat/138552 "2018-07-04T13:11:46Z")
Hi, I have setup elasticsearch, logstash and kibana on 3 hosts. Logstash hosts are behind an AWS ELB (TCP, 5000 port). Now, I want my filebeat to balance the log streams between these three hosts. How can I achieve this… --- ## [The System cannot find the path error](https://discuss.elastic.co/t/the-system-cannot-find-the-path-error/138216)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 14\ **Last updated:** [July 4, 2018, 12:41pm UTC](https://discuss.elastic.co/t/the-system-cannot-find-the-path-error/138216 "2018-07-04T12:41:47Z")
I will be as descriptive as I can: I have been fiddling with ELK for 2/3 days now, just got it to work. I have it installed in one of our servers in a linux OS and use VMware console to connect to it. I can access Kiban… --- ## [How to set path in Filebeat.yml](https://discuss.elastic.co/t/how-to-set-path-in-filebeat-yml/138510)
**Author:** [@xiaosong](https://discuss.elastic.co/u/xiaosong)\ **Replies:** 1\ **Last updated:** [July 4, 2018, 10:41am UTC](https://discuss.elastic.co/t/how-to-set-path-in-filebeat-yml/138510 "2018-07-04T10:41:34Z")
All log file like xxxx20180702.log. How to choose today's log file only. Is there any config like this：xxxx{now/d}.log --- ## [How to overwrite the @timestamp with the value in the log?](https://discuss.elastic.co/t/how-to-overwrite-the-timestamp-with-the-value-in-the-log/138427)
**Author:** [@prateedshetty](https://discuss.elastic.co/u/prateedshetty)\ **Replies:** 3\ **Last updated:** [July 4, 2018, 10:16am UTC](https://discuss.elastic.co/t/how-to-overwrite-the-timestamp-with-the-value-in-the-log/138427 "2018-07-04T10:16:28Z")
There is NO logstash in the picture. We are using filebeat to directly push logs to Kibana. --- ## [Unable to publish logs from Windows Server](https://discuss.elastic.co/t/unable-to-publish-logs-from-windows-server/137998)
**Author:** [@arun\_govindasamy](https://discuss.elastic.co/u/arun_govindasamy)\ **Replies:** 4\ **Last updated:** [July 4, 2018, 7:49am UTC](https://discuss.elastic.co/t/unable-to-publish-logs-from-windows-server/137998 "2018-07-04T07:49:07Z")
I am using Filebeat 5.6 to send logs to elastic. After starting the file beat , always getting below line in log file. C:\\opt\\filebeat\\bin\>filebeat -e -d "publish" 2018/06/29 14:43:03.372455 beat.go:297: INFO Home path:… --- ## [Filebeat IIS Default Dashboards](https://discuss.elastic.co/t/filebeat-iis-default-dashboards/137003)
**Author:** [@Markus\_Ziegler](https://discuss.elastic.co/u/Markus_Ziegler)\ **Replies:** 7\ **Last updated:** [July 4, 2018, 4:30am UTC](https://discuss.elastic.co/t/filebeat-iis-default-dashboards/137003 "2018-07-04T04:30:10Z")
Hello! I tried to setup the filebeat iis module, following this guide: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-iis.html After executing all the described steps, I wanted to try the created… --- ## [Is it possible to collect the file owner (username) for a log file?](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358)
**Author:** [@Dan\_Shechter](https://discuss.elastic.co/u/Dan_Shechter)\ **Replies:** 1\ **Last updated:** [July 3, 2018, 2:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-collect-the-file-owner-username-for-a-log-file/138358 "2018-07-03T14:16:03Z")
We are using filebeat to collect hadoop / yarn userlogs when running yarn applications. Currently, our hadoop/yarn setup uses hadoop's authentication mechanisms, and therefore, the userlogs (normally under /var/log/yarn… --- ## [No custom module fields in Kibana](https://discuss.elastic.co/t/no-custom-module-fields-in-kibana/137319)
**Author:** [@mvasilenko](https://discuss.elastic.co/u/mvasilenko)\ **Replies:** 5\ **Last updated:** [July 3, 2018, 12:51pm UTC](https://discuss.elastic.co/t/no-custom-module-fields-in-kibana/137319 "2018-07-03T12:51:35Z")
Hello, I'm interested in creating custom Filebeat module, to parse our app log, so I've followed this guide https://www.elastic.co/elasticon/conf/2018/sf/build-your-own-filebeat-module, simulated pipeline, grok patte… --- ## [How to add locale timezone in metricbeat](https://discuss.elastic.co/t/how-to-add-locale-timezone-in-metricbeat/137845)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 4\ **Last updated:** [July 3, 2018, 12:29pm UTC](https://discuss.elastic.co/t/how-to-add-locale-timezone-in-metricbeat/137845 "2018-07-03T12:29:44Z")
Hi All, I have installed metricbeat 6.3.0 in my windows 8 and I configured few metricsets in system module and I am sending data to logstash output and also I have the enable the add\_locale in the metricbeat.yml as like… --- ## [Verifying ELK stack containers in beats on a host in different network](https://discuss.elastic.co/t/verifying-elk-stack-containers-in-beats-on-a-host-in-different-network/137785)
**Author:** [@pamarthich](https://discuss.elastic.co/u/pamarthich)\ **Replies:** 2\ **Last updated:** [July 3, 2018, 12:25pm UTC](https://discuss.elastic.co/t/verifying-elk-stack-containers-in-beats-on-a-host-in-different-network/137785 "2018-07-03T12:25:47Z")
Hello everyone, I was trying to implement ELK stack using docker to collect logs from the machines which are in different network, would say that my docker Engine is in a private Network A and my hosts are in anot… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=438) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=440)