# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=441 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 442 --- ## [Beats and Docker autodiscover - only works with container start/stop](https://discuss.elastic.co/t/beats-and-docker-autodiscover-only-works-with-container-start-stop/137853)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 3\ **Last updated:** [June 29, 2018, 8:14am UTC](https://discuss.elastic.co/t/beats-and-docker-autodiscover-only-works-with-container-start-stop/137853 "2018-06-29T08:14:22Z")
Quick question about the filebeat and metricbeat "autodiscover" feature for Docker. Does this work with "static" containers, or does metric/log collection from within the docker container only begin if the beats notice … --- ## [Problem with java stacktaces](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415)
**Author:** [@Kubson](https://discuss.elastic.co/u/Kubson)\ **Replies:** 2\ **Last updated:** [June 29, 2018, 8:03am UTC](https://discuss.elastic.co/t/problem-with-java-stacktaces/137415 "2018-06-29T08:03:14Z")
Hello, there is possibility to join java error stacktrace to above log line? \[2018-06-26%2012\_17\_15\] I'm totally don't know what i need to change. Below is my configuration of multiline codec from filebeat.yml and al… --- ## [Poll\_file with icmp](https://discuss.elastic.co/t/poll-file-with-icmp/137719)
**Author:** [@Anthony\_Chung](https://discuss.elastic.co/u/Anthony_Chung)\ **Replies:** 3\ **Last updated:** [June 29, 2018, 7:54am UTC](https://discuss.elastic.co/t/poll-file-with-icmp/137719 "2018-06-29T07:54:36Z")
Hi, Just wondering if anyone have successfully used the watch.poll\_file option for icmp monitoring? I tried following the sample from here, but got the error: Exiting: error loading config file: yaml: line 30: mapping … --- ## [Tag send to logstash appears in lower case](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757)
**Author:** [@Moreth](https://discuss.elastic.co/u/Moreth)\ **Replies:** 2\ **Last updated:** [June 29, 2018, 7:16am UTC](https://discuss.elastic.co/t/tag-send-to-logstash-appears-in-lower-case/137757 "2018-06-29T07:16:17Z")
Hi! We got a weird problem, when we sent an event with filebeat that has a tag with lower and uper case, to logstash, in elasticsearch appear as lower case Filebeat example: Kibana received: Thanks a lot --- ## [Is it possible to read only new / changed log files which come after filebeat start?](https://discuss.elastic.co/t/is-it-possible-to-read-only-new-changed-log-files-which-come-after-filebeat-start/137907)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 6:28am UTC](https://discuss.elastic.co/t/is-it-possible-to-read-only-new-changed-log-files-which-come-after-filebeat-start/137907 "2018-06-29T06:28:03Z")
Hi, I am using ELK GA 6.3.0. I am using Filebeat to read log files from multiple servers and publish them to my Kafka cluster. My log folders already has really huge log files which collectively contains trillions of lo… --- ## [Direct different log to different Kafka topic](https://discuss.elastic.co/t/direct-different-log-to-different-kafka-topic/137873)
**Author:** [@Niloo\_F](https://discuss.elastic.co/u/Niloo_F)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 10:55pm UTC](https://discuss.elastic.co/t/direct-different-log-to-different-kafka-topic/137873 "2018-06-28T22:55:48Z")
Hi, How can I direct logs from different inputs (all same type: log) to different topics in my kafka cluster. Thanks N. --- ## [Kerberos configuration for WinLogBeat](https://discuss.elastic.co/t/kerberos-configuration-for-winlogbeat/137812)
**Author:** [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 7:29pm UTC](https://discuss.elastic.co/t/kerberos-configuration-for-winlogbeat/137812 "2018-06-28T19:29:03Z")
Is there any way to configure Kerberos for Winlogbeat to feed Kafka? --- ## [Elastic not saving data from Filebeat](https://discuss.elastic.co/t/elastic-not-saving-data-from-filebeat/137756)
**Author:** [@newbee14](https://discuss.elastic.co/u/newbee14)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 5:57pm UTC](https://discuss.elastic.co/t/elastic-not-saving-data-from-filebeat/137756 "2018-06-28T17:57:51Z")
docker run -d --name elasticsearch \\ -p 9200 -p 9300 -e "discovery.type=single-node" \\ docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.0 docker run --rm -d --name filebeat \\ --link elasticsearch… --- ## [Decapsulating traffic in a GRE tunnel](https://discuss.elastic.co/t/decapsulating-traffic-in-a-gre-tunnel/137503)
**Author:** [@Sweendog](https://discuss.elastic.co/u/Sweendog)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 12:47pm UTC](https://discuss.elastic.co/t/decapsulating-traffic-in-a-gre-tunnel/137503 "2018-06-28T12:47:52Z")
Hi, I may be missing it, but I can't seem to find how to have packetbeat strip GRE headers from a L2 tunnel I have set up. Basically, when looking at the traffic in tcpdump, tshark, or wireshark, you can see the traffi… --- ## [Filebeat Multiline Logger Issues](https://discuss.elastic.co/t/filebeat-multiline-logger-issues/136744)
**Author:** [@Aman\_Singhal](https://discuss.elastic.co/u/Aman_Singhal)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 12:53am UTC](https://discuss.elastic.co/t/filebeat-multiline-logger-issues/136744 "2018-06-28T00:53:27Z")
HI All I need help to find out why my multiline line not working with filebeat , I already all the help avaliable on internet - i am using 6.3.0 version of filebeat my filebeat.yml is as below filebeat.prospectors: t… --- ## [ERR Failed to publish events caused by: read tcp 172.16.1.2:46410-\>172.16.0.254:5044: i/o timeout](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-172-16-1-2-46410-172-16-0-254-i-o-timeout/137320)
**Author:** [@mksavic](https://discuss.elastic.co/u/mksavic)\ **Replies:** 5\ **Last updated:** [June 27, 2018, 10:57pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-172-16-1-2-46410-172-16-0-254-i-o-timeout/137320 "2018-06-27T22:57:37Z")
Hello, I am getting the following error messages in Metricbeat: 2018/06/25 21:45:44.685001 async.go:235: ERR Failed to publish events caused by: read tcp 172.16.1.2:46410-\>172.16.0.254:5044: i/o timeout 2018/06/25 21:4… --- ## [How to configure Metricbeat to collect filesystem data for NFS mount?](https://discuss.elastic.co/t/how-to-configure-metricbeat-to-collect-filesystem-data-for-nfs-mount/137521)
**Author:** [@Rick\_Liu](https://discuss.elastic.co/u/Rick_Liu)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 5:15pm UTC](https://discuss.elastic.co/t/how-to-configure-metricbeat-to-collect-filesystem-data-for-nfs-mount/137521 "2018-06-27T17:15:27Z")
OS: Ubutnu 14.04.5 Version: Metricbeat 6.3.0 After starting Metricbeat at one of the node with NFS mount point, the data post to elasticsearch contains only the devices of "/dev/mapper/ubuntu--vg-root" (mount point: … --- ## [Grok patter issue](https://discuss.elastic.co/t/grok-patter-issue/137654)
**Author:** [@Abdur\_Raqeeb1](https://discuss.elastic.co/u/Abdur_Raqeeb1)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 4:55pm UTC](https://discuss.elastic.co/t/grok-patter-issue/137654 "2018-06-27T16:55:18Z")
HI, Please help me here as my logstash config is getting failed.Please find the error and logstash config file match =\> { "message" =\> { '%{IP:remote\_address} - "remote user" - \\\["local time" %{HTTPDATE:time}\] "Reque… --- ## [System/load not registered in Windows](https://discuss.elastic.co/t/system-load-not-registered-in-windows/137624)
**Author:** [@CDR](https://discuss.elastic.co/u/CDR)\ **Replies:** 3\ **Last updated:** [June 27, 2018, 4:44pm UTC](https://discuss.elastic.co/t/system-load-not-registered-in-windows/137624 "2018-06-27T16:44:27Z")
I am getting the error "metricset 'system/load' is not registered, metricset not found". I know that on Windows the system/load metricset is not supported. It is commented out in my metricbeat.yml file: #==============… --- ## [Intermittant Metricbeat data on K8s](https://discuss.elastic.co/t/intermittant-metricbeat-data-on-k8s/137636)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 4:31pm UTC](https://discuss.elastic.co/t/intermittant-metricbeat-data-on-k8s/137636 "2018-06-27T16:31:25Z")
I've just started playing with Metricbeat on K8s, and am trying to make sense of the data that's coming in. To take the supplied "\[Metricbeat Kubernetes\] Overview" dashboard as an example, sometimes it shows all zeros ra… --- ## [Add\_docker\_metadata not working with match\_source: false](https://discuss.elastic.co/t/add-docker-metadata-not-working-with-match-source-false/136874)
**Author:** [@pa.cloud](https://discuss.elastic.co/u/pa.cloud)\ **Replies:** 9\ **Last updated:** [June 27, 2018, 4:13pm UTC](https://discuss.elastic.co/t/add-docker-metadata-not-working-with-match-source-false/136874 "2018-06-27T16:13:11Z")
Hi, Though I could successfully use add\_docker\_metadata with "~" as well as if I set match\_source: true But i am unable to get it to work if i set match\_source: false. Please see my config below. Not sure if it's beca… --- ## [Metricbeat can't create index into Elasticsearch](https://discuss.elastic.co/t/metricbeat-cant-create-index-into-elasticsearch/137635)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 4\ **Last updated:** [June 27, 2018, 3:34pm UTC](https://discuss.elastic.co/t/metricbeat-cant-create-index-into-elasticsearch/137635 "2018-06-27T15:34:55Z")
Hi all, My metricbeat configured to monitor system and my apache web server but it can't create any index to ES , When i'm trying to test configuration return Ok so what should i do ? This is my metricbeat.yml file ht… --- ## [Filtering by event id](https://discuss.elastic.co/t/filtering-by-event-id/137640)
**Author:** [@Astarandel](https://discuss.elastic.co/u/Astarandel)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 3:12pm UTC](https://discuss.elastic.co/t/filtering-by-event-id/137640 "2018-06-27T15:12:54Z")
Hello guys, I m trying the following configuration: winlogbeat.event\_logs: - name: Application level: critical, error, warning ignore\_older: 48h - name: Security event\_id: 500-820 level: critical, e… --- ## [Is there a reliable way to measure packetbeat capture loss?](https://discuss.elastic.co/t/is-there-a-reliable-way-to-measure-packetbeat-capture-loss/137610)
**Author:** [@aadhi0319](https://discuss.elastic.co/u/aadhi0319)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 12:07pm UTC](https://discuss.elastic.co/t/is-there-a-reliable-way-to-measure-packetbeat-capture-loss/137610 "2018-06-27T12:07:58Z")
We are looking for a reliable way to measure Packetbeat capture loss. AF\_Packet is enabled and the network sees peak traffic of around 700 mbps. I tried looking for other posters' solutions to this and the few that I co… --- ## [Any way to use prometheus to monitor filebeat](https://discuss.elastic.co/t/any-way-to-use-prometheus-to-monitor-filebeat/137560)
**Author:** [@prometheus1](https://discuss.elastic.co/u/prometheus1)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 9:02am UTC](https://discuss.elastic.co/t/any-way-to-use-prometheus-to-monitor-filebeat/137560 "2018-06-27T09:02:24Z")
I have a prometheus monitoring setup. I need some sort of exporter from filebeat to scrape metrics from. I see filebeat already has X-Pack monitoring which needs an ES backend. Is there any way to support prometheus metr… --- ## [Metricbeat monitoring for different user id's](https://discuss.elastic.co/t/metricbeat-monitoring-for-different-user-ids/136158)
**Author:** [@Dinesh\_Senthil\_Kumar](https://discuss.elastic.co/u/Dinesh_Senthil_Kumar)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 7:08am UTC](https://discuss.elastic.co/t/metricbeat-monitoring-for-different-user-ids/136158 "2018-06-27T07:08:39Z")
Hi I am using metricbeat for monitoring my windows stack, we have a windows box enabled with 25 user remote connectivity. We are unable to monitor the usage of all the users. I am getting CPU and process metrics relate… --- ## [ELK Cluster Design Best Approach](https://discuss.elastic.co/t/elk-cluster-design-best-approach/137376)
**Author:** [@eswarloges](https://discuss.elastic.co/u/eswarloges)\ **Replies:** 4\ **Last updated:** [June 27, 2018, 6:46am UTC](https://discuss.elastic.co/t/elk-cluster-design-best-approach/137376 "2018-06-27T06:46:51Z")
Hi All, We are working on designing ELK cluster for our client. We came up with the below design approach. Filebeat will source the data from log files, add tags and send it to Kafka Producer Kafka consumer will read … --- ## [Filebeat losing pointer and reading file from start](https://discuss.elastic.co/t/filebeat-losing-pointer-and-reading-file-from-start/137331)
**Author:** [@paano](https://discuss.elastic.co/u/paano)\ **Replies:** 3\ **Last updated:** [June 27, 2018, 1:25am UTC](https://discuss.elastic.co/t/filebeat-losing-pointer-and-reading-file-from-start/137331 "2018-06-27T01:25:38Z")
Beats: 6.2.3 Have using filebeat for most of the our ELK solution to stream log files in to Elastic. IN one of the scenario, filebeat is reading the file from start. scenario: On a secure server, have rsync service sh… --- ## [I'm trying to monitor apache requests and workers using ELK](https://discuss.elastic.co/t/im-trying-to-monitor-apache-requests-and-workers-using-elk/137466)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 2\ **Last updated:** [June 26, 2018, 9:46pm UTC](https://discuss.elastic.co/t/im-trying-to-monitor-apache-requests-and-workers-using-elk/137466 "2018-06-26T21:46:48Z")
Hi all, This is my metricbeat.yml configuration file used to monitor apache into kibana after following this steps https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-configuration.html no index for metr… --- ## [How to configure syslog output in winlogbeat](https://discuss.elastic.co/t/how-to-configure-syslog-output-in-winlogbeat/137490)
**Author:** [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Replies:** 7\ **Last updated:** [June 26, 2018, 7:18pm UTC](https://discuss.elastic.co/t/how-to-configure-syslog-output-in-winlogbeat/137490 "2018-06-26T19:18:50Z")
In the documentation https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html there is a configuration option: logging.to\_syslog When true, writes all logging output to the syslog. while th… --- ## [Metricbeat Ceph stats collection breaks for Ceph Mimic release](https://discuss.elastic.co/t/metricbeat-ceph-stats-collection-breaks-for-ceph-mimic-release/137496)
**Author:** [@jrosser](https://discuss.elastic.co/u/jrosser)\ **Replies:** 1\ **Last updated:** [June 26, 2018, 7:17pm UTC](https://discuss.elastic.co/t/metricbeat-ceph-stats-collection-breaks-for-ceph-mimic-release/137496 "2018-06-26T19:17:27Z")
Metricbeat's Ceph module queries the API provided by ceph-rest-api, a command-line tool provided with Ceph versions up to Luminous. This is documented here: http://docs.ceph.com/docs/luminous/man/8/ceph-rest-api/ This … --- ## [Filebeat Autodiscover Hints Breaking Template](https://discuss.elastic.co/t/filebeat-autodiscover-hints-breaking-template/137310)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 10\ **Last updated:** [June 26, 2018, 3:58pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-hints-breaking-template/137310 "2018-06-26T15:58:08Z")
Hi, We're using the below to scrape Kubernetes logs based on the presence of a specific annotation: filebeat.autodiscover: providers: - type: kubernetes in\_cluster: true tags: … --- ## [Filebeat mysql module slowlog - error.message: Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-mysql-module-slowlog-error-message-provided-grok-expressions-do-not-match-field-value/135945)
**Author:** [@Rodrigo\_Floriano](https://discuss.elastic.co/u/Rodrigo_Floriano)\ **Replies:** 10\ **Last updated:** [June 26, 2018, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-mysql-module-slowlog-error-message-provided-grok-expressions-do-not-match-field-value/135945 "2018-06-26T15:53:25Z")
Hi, all! I want use Filebeat MySQL Module for collecting slowlogs into Elasticsearch to view in Kibana Dashboard. I would like to resolve this issue only without using Logstash, only filebeat module. Anyone can help m… --- ## [How to exclude a sub directory and all of it's files](https://discuss.elastic.co/t/how-to-exclude-a-sub-directory-and-all-of-its-files/137317)
**Author:** [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\ **Replies:** 1\ **Last updated:** [June 26, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-exclude-a-sub-directory-and-all-of-its-files/137317 "2018-06-26T14:59:18Z")
Hello, I am trying to exclude a sub directory and all of its files in file beat . In the documentation, i know that there is a flag called "exclude\_files". But having hard time to figure out how to use it to exclude a… --- ## [Filebeat Stats / metrics](https://discuss.elastic.co/t/filebeat-stats-metrics/137423)
**Author:** [@sivakr](https://discuss.elastic.co/u/sivakr)\ **Replies:** 1\ **Last updated:** [June 26, 2018, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-stats-metrics/137423 "2018-06-26T14:23:56Z")
How can I view Filebeat metrics ? Is there any statsd exporter ? I'm aware its possible with Xpack but I'm trying to stick with -oss version It would be great if I can visualize event out rate in grafana ! [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=440) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=442)