# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=440 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 441 --- ## [Incorrect default for Filebeat logging.files.keepfiles](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293)
**Author:** [@lachlancooper](https://discuss.elastic.co/u/lachlancooper)\ **Replies:** 2\ **Last updated:** [July 3, 2018, 12:15pm UTC](https://discuss.elastic.co/t/incorrect-default-for-filebeat-logging-files-keepfiles/138293 "2018-07-03T12:15:23Z")
The documented default value for Filebeat's logging.files.keepfiles is 7, but in my testing this doesn't seem to be accurate. The actual default seems to be 0, meaning Filebeat doesn't keep any rotated log files. How to… --- ## [Conditional index + pipeline in output?](https://discuss.elastic.co/t/conditional-index-pipeline-in-output/138163)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 3\ **Last updated:** [July 3, 2018, 9:12am UTC](https://discuss.elastic.co/t/conditional-index-pipeline-in-output/138163 "2018-07-03T09:12:52Z")
I noticed here that you can do conditional selection of indices in the output. I was trying to carry that over to also use a specific pipeline when sending to that index as well. Here's what I have; output.elasticsearc… --- ## [Can't disable metricbeat metrics module](https://discuss.elastic.co/t/cant-disable-metricbeat-metrics-module/134271)
**Author:** [@fozboz](https://discuss.elastic.co/u/fozboz)\ **Replies:** 8\ **Last updated:** [July 3, 2018, 9:08am UTC](https://discuss.elastic.co/t/cant-disable-metricbeat-metrics-module/134271 "2018-07-03T09:08:49Z")
It seems that I'm unable to disable to metrics module in metricbeat. My metricbeat.yml is thusly: output.logstash: hosts: \["logstash1:5044","logstash2:5044"\] loadbalance: true metricbeat.modules: - module: apache … --- ## [Multiline pattern on basis of timestamp](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162)
**Author:** [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\ **Replies:** 5\ **Last updated:** [July 3, 2018, 8:47am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162 "2018-07-03T08:47:11Z")
I'm trying to implement multiline pattern on the basis of timestamp. My grok pattern in logstash are as follows: match =\> { "message" =\> "(?m)%{TIMESTAMP\_ISO8601:timestamp}\\s\*-\\s\*%{LOGLEVEL\_TEST:level}\\s\*-\\s\*%{GREEDYD… --- ## [Unable to change the default index name in Winlogbeat.yml](https://discuss.elastic.co/t/unable-to-change-the-default-index-name-in-winlogbeat-yml/138291)
**Author:** [@johnnyli](https://discuss.elastic.co/u/johnnyli)\ **Replies:** 1\ **Last updated:** [July 3, 2018, 8:17am UTC](https://discuss.elastic.co/t/unable-to-change-the-default-index-name-in-winlogbeat-yml/138291 "2018-07-03T08:17:03Z")
According to the manual at https://www.elastic.co/guide/en/beats/winlogbeat/6.2/winlogbeat-template.html I should include these lines to change the name of the index but winlogbeat service would crash when trying to sta… --- ## [Problem: Custom Filebeat Module to parse modified nginx log Grok Error](https://discuss.elastic.co/t/problem-custom-filebeat-module-to-parse-modified-nginx-log-grok-error/138149)
**Author:** [@markdaku](https://discuss.elastic.co/u/markdaku)\ **Replies:** 15\ **Last updated:** [July 3, 2018, 4:23am UTC](https://discuss.elastic.co/t/problem-custom-filebeat-module-to-parse-modified-nginx-log-grok-error/138149 "2018-07-03T04:23:30Z")
Hello All, Long story made shorter. I've created on my network a DNS black hole for ad server dns resolution. It works perfectly. My DNS serves up a dummy internal address for all of the adhosts in a list. But now I… --- ## [Faild put to /\_ingest/pipeline with custom json](https://discuss.elastic.co/t/faild-put-to-ingest-pipeline-with-custom-json/137209)
**Author:** [@hjfeng1988](https://discuss.elastic.co/u/hjfeng1988)\ **Replies:** 17\ **Last updated:** [July 3, 2018, 3:49am UTC](https://discuss.elastic.co/t/faild-put-to-ingest-pipeline-with-custom-json/137209 "2018-07-03T03:49:48Z")
I write a cutstom josn file refer to filebeat6.3.0 modues config file /usr/share/filebeat/module/system/syslog/ingest/pipeline.json { "description": "Pipeline for parsing /var/log/cmd.log.", "processors": \[{ … --- ## [Entire log is read when it changes](https://discuss.elastic.co/t/entire-log-is-read-when-it-changes/137175)
**Author:** [@joshsmoore](https://discuss.elastic.co/u/joshsmoore)\ **Replies:** 4\ **Last updated:** [July 3, 2018, 2:04am UTC](https://discuss.elastic.co/t/entire-log-is-read-when-it-changes/137175 "2018-07-03T02:04:42Z")
Hi I am using filebeats and I am having some problems with my backup log file. This file is written to once a day. The problem is that when this log file is updated the entire file is read and sent to logstash twice. … --- ## [Logstash errors after upgrading to filebeat-6.3.0](https://discuss.elastic.co/t/logstash-errors-after-upgrading-to-filebeat-6-3-0/135984)
**Author:** [@gregvolk](https://discuss.elastic.co/u/gregvolk)\ **Replies:** 28\ **Last updated:** [July 2, 2018, 11:50pm UTC](https://discuss.elastic.co/t/logstash-errors-after-upgrading-to-filebeat-6-3-0/135984 "2018-07-02T23:50:55Z")
After upgrading from filebeat-6.2.4 to filebeat-6.3.0 none of my log messages make into logstash. I did not make any filebeat.yml or logstash.conf changes during the upgrade. The logstash.stdout is full of errors like th… --- ## [I have created Custom Module in filebeat for squid](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212)
**Author:** [@BKS089](https://discuss.elastic.co/u/BKS089)\ **Replies:** 1\ **Last updated:** [July 2, 2018, 5:23pm UTC](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212 "2018-07-02T17:23:03Z")
I am using this pipeline json file to filter log { "description": "Pipeline for parsing squid access logs", "processors": \[ { "grok": { "field": "message", "trace\_match": true, "patterns": \[ "%{NUMBER:timestamp… --- ## [Cant build new beats](https://discuss.elastic.co/t/cant-build-new-beats/138207)
**Author:** [@debasish283](https://discuss.elastic.co/u/debasish283)\ **Replies:** 1\ **Last updated:** [July 2, 2018, 5:21pm UTC](https://discuss.elastic.co/t/cant-build-new-beats/138207 "2018-07-02T17:21:43Z")
I'm following this refrence after doing make package I get below error am I missing something Thanks --- ## [Sample Dashboard Errors?](https://discuss.elastic.co/t/sample-dashboard-errors/138003)
**Author:** [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Replies:** 7\ **Last updated:** [July 2, 2018, 3:56pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003 "2018-07-02T15:56:28Z")
Hi Everyone, I'm building a proof of concept using ELK + Winlogbeat to provide us with tools analysing data from Windows Event logs. In this environment I have 2 servers: log server + ELK server It looks like everythi… --- ## [Not Logging Account Lockout (4740)](https://discuss.elastic.co/t/not-logging-account-lockout-4740/138023)
**Author:** [@Innove](https://discuss.elastic.co/u/Innove)\ **Replies:** 2\ **Last updated:** [July 2, 2018, 1:46pm UTC](https://discuss.elastic.co/t/not-logging-account-lockout-4740/138023 "2018-07-02T13:46:15Z")
I have winlogbeat installed on a few desktops and our primary domain controller with all of them pointing to a SecurityOnion server with ELK. If I clear event logs (1102) for example, the event quickly shows up in my Kib… --- ## [Change log output of Filebeat](https://discuss.elastic.co/t/change-log-output-of-filebeat/138184)
**Author:** [@solo](https://discuss.elastic.co/u/solo)\ **Replies:** 2\ **Last updated:** [July 2, 2018, 11:47am UTC](https://discuss.elastic.co/t/change-log-output-of-filebeat/138184 "2018-07-02T11:47:44Z")
My logs path is: /var/log/filebeat How can i change it to /opt/filebeat/log/filebeat.log ? I cant see any options for changing this in my filebeat.yml file. I only have this: #================================ Logging … --- ## [Jolokia module not found exception](https://discuss.elastic.co/t/jolokia-module-not-found-exception/137999)
**Author:** [@Phani\_Nadiminti](https://discuss.elastic.co/u/Phani_Nadiminti)\ **Replies:** 5\ **Last updated:** [July 2, 2018, 10:52am UTC](https://discuss.elastic.co/t/jolokia-module-not-found-exception/137999 "2018-07-02T10:52:21Z")
Hi All, I have installed jolokia agent and attached to the java process successfully . but in metric beat yml i have specified following configuration and getting error please advice me how to install jolokia module in… --- ## [Is Beats mandatory to use, while using log stash JDBC plug in?](https://discuss.elastic.co/t/is-beats-mandatory-to-use-while-using-log-stash-jdbc-plug-in/137727)
**Author:** [@Preethi](https://discuss.elastic.co/u/Preethi)\ **Replies:** 4\ **Last updated:** [July 2, 2018, 6:23am UTC](https://discuss.elastic.co/t/is-beats-mandatory-to-use-while-using-log-stash-jdbc-plug-in/137727 "2018-07-02T06:23:14Z")
Hi, When I implement ELK for a large scale application, Do I need to include the Beats to take data from RDBS and pass through Kafka, Then logstash will come to act? I want to know what are the components needs to be u… --- ## [Postgres logs not properly parsed by filebeat](https://discuss.elastic.co/t/postgres-logs-not-properly-parsed-by-filebeat/137371)
**Author:** [@amitphulera](https://discuss.elastic.co/u/amitphulera)\ **Replies:** 10\ **Last updated:** [July 1, 2018, 8:25pm UTC](https://discuss.elastic.co/t/postgres-logs-not-properly-parsed-by-filebeat/137371 "2018-07-01T20:25:07Z")
Hi, I have started with Elastic Stack recently. My use case is to monitor multiple raspberry pis with Beats module and visualize the data in Kibana Dashboards. I tried to set up Metricbeat and filebeat on Raspi 3, it w… --- ## [Filebeat index template suggestion](https://discuss.elastic.co/t/filebeat-index-template-suggestion/138072)
**Author:** [@markdaku](https://discuss.elastic.co/u/markdaku)\ **Replies:** 0\ **Last updated:** [July 1, 2018, 5:30am UTC](https://discuss.elastic.co/t/filebeat-index-template-suggestion/138072 "2018-07-01T05:30:02Z")
The modules are all fairly well self contained. Except for 1 important thing. The index template is all merged into the monster one at the top of the beat. Shouldn't there be a template in each module directory instea… --- ## [Packetbeat for telecom grade network traces](https://discuss.elastic.co/t/packetbeat-for-telecom-grade-network-traces/138061)
**Author:** [@Luke\_Devon](https://discuss.elastic.co/u/Luke_Devon)\ **Replies:** 1\ **Last updated:** [June 30, 2018, 3:17pm UTC](https://discuss.elastic.co/t/packetbeat-for-telecom-grade-network-traces/138061 "2018-06-30T15:17:37Z")
Hi, I am thinking of implementing Packetbeats to send telecom grade packet traces to eleasticsearch. In a telecom network, we are dealing with different types of protocol stacks such as SS7 (including GSM MAP), and TCP… --- ## [Not all the files picked at the same time](https://discuss.elastic.co/t/not-all-the-files-picked-at-the-same-time/137956)
**Author:** [@Akilen\_Pandian](https://discuss.elastic.co/u/Akilen_Pandian)\ **Replies:** 7\ **Last updated:** [June 29, 2018, 9:36pm UTC](https://discuss.elastic.co/t/not-all-the-files-picked-at-the-same-time/137956 "2018-06-29T21:36:10Z")
Hi There I am new to filebeat. I am setting up logstash server to monitor log files from different process. Process run at a fix time and output is stored in a log file. This is my config \` filebeat: prospectors: - … --- ## [Ingest Pipeline is not updated on Module Changes](https://discuss.elastic.co/t/ingest-pipeline-is-not-updated-on-module-changes/138029)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 8:02pm UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-updated-on-module-changes/138029 "2018-06-29T20:02:10Z")
Hi, I've created a new Filebeat module to parse some custom log formats. As expected on initial startup with the new module enabled Filebeat correctly created the ingest pipeline in Elasticsearch. I've since made some … --- ## [Client\_id variable](https://discuss.elastic.co/t/client-id-variable/138026)
**Author:** [@savvy](https://discuss.elastic.co/u/savvy)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 7:52pm UTC](https://discuss.elastic.co/t/client-id-variable/138026 "2018-06-29T19:52:07Z")
Can we set the client id as a variable in filebeat.yml file? Here we are using filebeat 6.x Here is the sample config file below: #----------------------------- Kafka output -------------------------------- output.kafk… --- ## [JSON log, only root level fields being indexed](https://discuss.elastic.co/t/json-log-only-root-level-fields-being-indexed/137955)
**Author:** [@jro](https://discuss.elastic.co/u/jro)\ **Replies:** 9\ **Last updated:** [June 29, 2018, 5:45pm UTC](https://discuss.elastic.co/t/json-log-only-root-level-fields-being-indexed/137955 "2018-06-29T17:45:06Z")
The logfile contains json log entries like this: {"priority":"INFO","messageType":"HTTP\_RESPONSE","message":{"type":"HTTP\_RESPONSE","name":"Create User","status":"200","reason":"OK","response":"{id=1234, name=My Name}"}… --- ## [Using Filebeat on files synced via Rsync](https://discuss.elastic.co/t/using-filebeat-on-files-synced-via-rsync/137440)
**Author:** [@slhck](https://discuss.elastic.co/u/slhck)\ **Replies:** 9\ **Last updated:** [June 29, 2018, 2:04pm UTC](https://discuss.elastic.co/t/using-filebeat-on-files-synced-via-rsync/137440 "2018-06-29T14:04:48Z")
I am using Filebeat 6.3.0 to forward log files from a Rails application to Logstash. The files originate from a server that I cannot configure to use Filebeat, hence they are being transferred to the Filebeat/Logstash ho… --- ## [Metricbeat error while reading apache status](https://discuss.elastic.co/t/metricbeat-error-while-reading-apache-status/137914)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 1:16pm UTC](https://discuss.elastic.co/t/metricbeat-error-while-reading-apache-status/137914 "2018-06-29T13:16:22Z")
hello, I am getting below error while reading apache status metric. My apache httpd is running on 51443 port. How can I make metricbeat to read form there? br, Sunil --- ## [Filebeat stopped frequently when sending to Logstash](https://discuss.elastic.co/t/filebeat-stopped-frequently-when-sending-to-logstash/137687)
**Author:** [@mugil1988](https://discuss.elastic.co/u/mugil1988)\ **Replies:** 4\ **Last updated:** [June 29, 2018, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-stopped-frequently-when-sending-to-logstash/137687 "2018-06-29T13:12:39Z")
Hi Team, I have installed file beat 5.5.1 version in production server.. Filebeat was worked properly till yesterday But today filebeat is stopping suddenly without any error.. Once I restart the file beat..it's ship… --- ## [Make package fails for beats plugin](https://discuss.elastic.co/t/make-package-fails-for-beats-plugin/137953)
**Author:** [@Manjukb](https://discuss.elastic.co/u/Manjukb)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 1:08pm UTC](https://discuss.elastic.co/t/make-package-fails-for-beats-plugin/137953 "2018-06-29T13:08:33Z")
trying to build a new beats plugin make package fails with bellow error Working directory=/go Copying main source folder /source to folder /go Fetching dependencies... Execute /scripts/before\_build.sh cp: cannot stat … --- ## [Filebeat not detecting all changes made to csv File](https://discuss.elastic.co/t/filebeat-not-detecting-all-changes-made-to-csv-file/137908)
**Author:** [@ganessen23](https://discuss.elastic.co/u/ganessen23)\ **Replies:** 5\ **Last updated:** [June 29, 2018, 12:59pm UTC](https://discuss.elastic.co/t/filebeat-not-detecting-all-changes-made-to-csv-file/137908 "2018-06-29T12:59:49Z")
Hello, I am facing difficulties over Filebeat. My present scenario is that I am using Filebeat (installed in a windows server) to send data (in csv File format) to Logstash and finally to Elasticsearch (both tools inst… --- ## [Killing container with id docker://filebeat:Need to kill Pod](https://discuss.elastic.co/t/killing-container-with-id-docker-filebeat-need-to-kill-pod/137791)
**Author:** [@sszabo](https://discuss.elastic.co/u/sszabo)\ **Replies:** 2\ **Last updated:** [June 29, 2018, 11:15am UTC](https://discuss.elastic.co/t/killing-container-with-id-docker-filebeat-need-to-kill-pod/137791 "2018-06-29T11:15:10Z")
Running filebeat v6.0.1 on kubernetes v1.9.8 the beats die after a few minutes. We don't have a quota set for this namespace: --- apiVersion: extensions/v1beta1 kind: DaemonSet metadata: name: filebeat namespace: ku… --- ## [Autodiscover : not getting logs](https://discuss.elastic.co/t/autodiscover-not-getting-logs/137929)
**Author:** [@Theo\_Delahayes](https://discuss.elastic.co/u/Theo_Delahayes)\ **Replies:** 2\ **Last updated:** [June 29, 2018, 10:26am UTC](https://discuss.elastic.co/t/autodiscover-not-getting-logs/137929 "2018-06-29T10:26:30Z")
Hi, I've tried the autodiscover feature to get the logs of selenium grid nodes wrapped in docker containers (that are supposed to be scaled dynamically) and it does not seems to find it, the test i ran was with one cont… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=439) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=441)