# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=443 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 444 --- ## [Configure output Index name with kubernetes metadata field](https://discuss.elastic.co/t/configure-output-index-name-with-kubernetes-metadata-field/136622)
**Author:** [@orgoz](https://discuss.elastic.co/u/orgoz)\ **Replies:** 2\ **Last updated:** [June 21, 2018, 7:32am UTC](https://discuss.elastic.co/t/configure-output-index-name-with-kubernetes-metadata-field/136622 "2018-06-21T07:32:55Z")
Hi, I would like to have the kubernetes namespace in the index name, so I tried like this : output.elasticsearch: hosts: \['${ELASTICSEARCH\_HOST:elasticsearch}:${ELASTICSEARCH\_PORT:9200}'\] index: "%{\[kubernetes.na… --- ## [FIlebeat sends garbled messages to logstash](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-to-logstash/136662)
**Author:** [@breetty](https://discuss.elastic.co/u/breetty)\ **Replies:** 2\ **Last updated:** [June 21, 2018, 4:58am UTC](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-to-logstash/136662 "2018-06-21T04:58:32Z")
Hi, Around midnight, filebeat sends garbled messages like "message":"\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000" to logstash. The log file is… --- ## [Filebeat in docker doesn't send logs to logstash in another docker](https://discuss.elastic.co/t/filebeat-in-docker-doesnt-send-logs-to-logstash-in-another-docker/136199)
**Author:** [@bronweg](https://discuss.elastic.co/u/bronweg)\ **Replies:** 5\ **Last updated:** [June 21, 2018, 4:09am UTC](https://discuss.elastic.co/t/filebeat-in-docker-doesnt-send-logs-to-logstash-in-another-docker/136199 "2018-06-21T04:09:29Z")
Hi all, I'm newbie with elastic and also with docker. I have created four containers with FileBeat, Logstash, Elasticsearch and Kibana. I start FileBeat with -d "\*" to see DEBUG logs and I see a lot of "inputs" but no… --- ## [Autodiscover, docker, and nginx; "Fileset nginx/log is configured but doesn't exist"](https://discuss.elastic.co/t/autodiscover-docker-and-nginx-fileset-nginx-log-is-configured-but-doesnt-exist/136692)
**Author:** [@vputz](https://discuss.elastic.co/u/vputz)\ **Replies:** 1\ **Last updated:** [June 20, 2018, 10:25pm UTC](https://discuss.elastic.co/t/autodiscover-docker-and-nginx-fileset-nginx-log-is-configured-but-doesnt-exist/136692 "2018-06-20T22:25:43Z")
Okay, almost there! I have autodiscover running correctly and trying to parse logs from my docker containers, including nginx, using this filebeat.yml snippet: filebeat.config.modules.path: /usr/share/filebeat/modules.… --- ## [How to configure filebeat to grab today's file from a directory where many files have a name like access.log-yyyy.mm.dd](https://discuss.elastic.co/t/how-to-configure-filebeat-to-grab-todays-file-from-a-directory-where-many-files-have-a-name-like-access-log-yyyy-mm-dd/136552)
**Author:** [@lserranov](https://discuss.elastic.co/u/lserranov)\ **Replies:** 2\ **Last updated:** [June 20, 2018, 5:10pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-grab-todays-file-from-a-directory-where-many-files-have-a-name-like-access-log-yyyy-mm-dd/136552 "2018-06-20T17:10:11Z")
Hello, I have a directory with many files with name as in this format: access.log-yyyy.mm.dd Example: 1278720 Jun 9 23:59 access.log-2018.06.09 1337590 Jun 10 23:59 access.log-2018.06.10 12797116 Jun 11 23:59 acces… --- ## [Winlogbeat - How to determine correct channel names](https://discuss.elastic.co/t/winlogbeat-how-to-determine-correct-channel-names/136722)
**Author:** [@L33T](https://discuss.elastic.co/u/L33T)\ **Replies:** 5\ **Last updated:** [June 20, 2018, 4:14pm UTC](https://discuss.elastic.co/t/winlogbeat-how-to-determine-correct-channel-names/136722 "2018-06-20T16:14:32Z")
Hi, How do you set which event logs are collection in the winlogbeat.yml config file. I have some event logs for Hyper-V that are Application And Service Logs and are not in the windows logs section of the event viewer? … --- ## [PostgreSQL module got error when parsing AWS RDS PostgreSQL log](https://discuss.elastic.co/t/postgresql-module-got-error-when-parsing-aws-rds-postgresql-log/136209)
**Author:** [@nyamada2](https://discuss.elastic.co/u/nyamada2)\ **Replies:** 2\ **Last updated:** [June 20, 2018, 2:42pm UTC](https://discuss.elastic.co/t/postgresql-module-got-error-when-parsing-aws-rds-postgresql-log/136209 "2018-06-20T14:42:55Z")
I wrote a script that downloads AWS RDS PostgreSQL log files and let the filebeat reads log files using PostgreSQL module, though I found it fails to parse in kibana dashboard. There was a similar post before at below U… --- ## [Setting @timestamp in filebeat](https://discuss.elastic.co/t/setting-timestamp-in-filebeat/136224)
**Author:** [@michas](https://discuss.elastic.co/u/michas)\ **Replies:** 2\ **Last updated:** [June 20, 2018, 2:10pm UTC](https://discuss.elastic.co/t/setting-timestamp-in-filebeat/136224 "2018-06-20T14:10:27Z")
Recent versions of filebeat allow to dissect log messages directly. (Without the need of logstash or an ingestion pipeline.) Therefore I would like to avoid any overhead and send the dissected fields directly to ES. Cu… --- ## [Can't get log level in filebeat](https://discuss.elastic.co/t/cant-get-log-level-in-filebeat/136450)
**Author:** [@xdholy](https://discuss.elastic.co/u/xdholy)\ **Replies:** 5\ **Last updated:** [June 20, 2018, 10:21am UTC](https://discuss.elastic.co/t/cant-get-log-level-in-filebeat/136450 "2018-06-20T10:21:25Z")
Hi, in our project we store all our logs in one log file with the log pattern: timestamp-server-id-loglevel-program-module-... I set up a filebeat-logstash-es stream and i want to apply different grok patterns to diffe… --- ## [Docker+filebeat cannot get logs](https://discuss.elastic.co/t/docker-filebeat-cannot-get-logs/136071)
**Author:** [@qiao\_tyrant](https://discuss.elastic.co/u/qiao_tyrant)\ **Replies:** 4\ **Last updated:** [June 20, 2018, 7:53am UTC](https://discuss.elastic.co/t/docker-filebeat-cannot-get-logs/136071 "2018-06-20T07:53:42Z")
I am using filebeat 6.3.0. I use the official Dockerfile to create a filebeat docker. But when I run this container, \[docker run xxx/custom\_image\] It only returns \[monitoring\] log/log.go:124 Non-zero metrics in t… --- ## [Dashboards and visualizations seem out of date](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112)
**Author:** [@CW360\_Michael](https://discuss.elastic.co/u/CW360_Michael)\ **Replies:** 5\ **Last updated:** [June 19, 2018, 8:56pm UTC](https://discuss.elastic.co/t/dashboards-and-visualizations-seem-out-of-date/136112 "2018-06-19T20:56:05Z")
After upgrading everything to 6.3 the only issues I'm seeing are with Filebeat dashboards and visualizations. Here's a screenshot showing the UI throwing fits: \[Filebeat\_Nginx\_\_Overview-\_Kibana\] I've removed and reins… --- ## [Filebeat character encoding problem!](https://discuss.elastic.co/t/filebeat-character-encoding-problem/136486)
**Author:** [@Pratik.Lal](https://discuss.elastic.co/u/Pratik.Lal)\ **Replies:** 9\ **Last updated:** [June 19, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-character-encoding-problem/136486 "2018-06-19T16:57:56Z")
It looks like filebeat didn't handle \> character properly and displayed the Unicode hex equivalent i.e. \\u003c142 in output. Other fields are displayed just fine. Any recommendations? Filebeat version: 6.3 Input: SYSL… --- ## [Winlogbeat and Scheduled Task Logs (or others)](https://discuss.elastic.co/t/winlogbeat-and-scheduled-task-logs-or-others/136517)
**Author:** [@wyliebsd](https://discuss.elastic.co/u/wyliebsd)\ **Replies:** 4\ **Last updated:** [June 19, 2018, 4:25pm UTC](https://discuss.elastic.co/t/winlogbeat-and-scheduled-task-logs-or-others/136517 "2018-06-19T16:25:41Z")
Could someone possibly assist me in capturing Schedule Task logs with Winlogbeat? Right now my config is like this: winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: Security - name: System -… --- ## [Beat data with SSL vs unencrypted - no visible difference in the packets](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533)
**Author:** [@beatit](https://discuss.elastic.co/u/beatit)\ **Replies:** 2\ **Last updated:** [June 19, 2018, 4:10pm UTC](https://discuss.elastic.co/t/beat-data-with-ssl-vs-unencrypted-no-visible-difference-in-the-packets/136533 "2018-06-19T16:10:15Z")
Greets. I'm using metricbeat 6.2.4 on Windows and Logstash 6.3.0-1 on Debian 8. I got SSL set up and then thought for the heck of it I'd compare packets in Wireshark and found that the traffic looks exactly the same wh… --- ## [Change the default index pattern of winlogbeat?](https://discuss.elastic.co/t/change-the-default-index-pattern-of-winlogbeat/136478)
**Author:** [@brisingertrece](https://discuss.elastic.co/u/brisingertrece)\ **Replies:** 2\ **Last updated:** [June 19, 2018, 3:35pm UTC](https://discuss.elastic.co/t/change-the-default-index-pattern-of-winlogbeat/136478 "2018-06-19T15:35:35Z")
Hi, I am trying to change the default pattern for the indexes generated by winlogbeat. I have followed the indications of the official documentation, but at some point I have missed something ... winlogbeat.yml: #===… --- ## [Filebeat - Dashboard system not working](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434)
**Author:** [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Replies:** 10\ **Last updated:** [June 19, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434 "2018-06-19T13:47:35Z")
Hello, Elasticsearch Version 6.2.4 Filebeat Client 6.3.0 I send logs from filebeat's client under Centos 7 with output to Elasticsearch. I setup the 3 node cluster with geoip, user-agent plugin and reboot each node … --- ## [Filebeat requirements](https://discuss.elastic.co/t/filebeat-requirements/136378)
**Author:** [@Armando\_Ayala](https://discuss.elastic.co/u/Armando_Ayala)\ **Replies:** 3\ **Last updated:** [June 19, 2018, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-requirements/136378 "2018-06-19T12:52:08Z")
Hi! I need help with the following question: what hardware resources does Filebeat need at least to run? (CPU, Disk, Memory) Thank you! --- ## [Failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/134330)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 7\ **Last updated:** [June 19, 2018, 6:00am UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/134330 "2018-06-19T06:00:33Z")
I get the following error ERROR pipeline/output.go:92 c when trying to add the following to the packetbeat.yml processors: include\_fields.fields: \["http.request.body"\] connection to elasticsearch is ok 2018-06-03T… --- ## [Ingest pipeline test: Error publishing events (retrying): temporary bulk send failure](https://discuss.elastic.co/t/ingest-pipeline-test-error-publishing-events-retrying-temporary-bulk-send-failure/136371)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 1\ **Last updated:** [June 19, 2018, 4:35am UTC](https://discuss.elastic.co/t/ingest-pipeline-test-error-publishing-events-retrying-temporary-bulk-send-failure/136371 "2018-06-19T04:35:27Z")
I'm working on testing an ingest node pipeline for a log file. The first test ran great. I had to make a change to the pipeline and since I cannot get any data in: 2018-06-18T16:49:47-04:00 INFO Metrics logging every 30… --- ## [Filter DNS queries by domains list](https://discuss.elastic.co/t/filter-dns-queries-by-domains-list/136285)
**Author:** [@alex\_h](https://discuss.elastic.co/u/alex_h)\ **Replies:** 3\ **Last updated:** [June 19, 2018, 4:15am UTC](https://discuss.elastic.co/t/filter-dns-queries-by-domains-list/136285 "2018-06-19T04:15:56Z")
Hello, the setup I'm working with consists of: machine A - where I'd like to install packetbeat machine B - where elastsearch is listening I have DNS queries forwarded to machine A. I would like to filter the DNS tr… --- ## [Filebeat Mutiline not working](https://discuss.elastic.co/t/filebeat-mutiline-not-working/136352)
**Author:** [@Aman\_Singhal](https://discuss.elastic.co/u/Aman_Singhal)\ **Replies:** 1\ **Last updated:** [June 18, 2018, 6:30pm UTC](https://discuss.elastic.co/t/filebeat-mutiline-not-working/136352 "2018-06-18T18:30:19Z")
i have filebeat/logstash/elasticsearch/kibana (6.0.3) version I tried multi-line with filebeat for sample logs first but its not working log file Exception in thread "main" java.lang.NullPointerException at com.examp… --- ## [Multiple Filebeat Prospectors and Filebeat Modules](https://discuss.elastic.co/t/multiple-filebeat-prospectors-and-filebeat-modules/136305)
**Author:** [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\ **Replies:** 2\ **Last updated:** [June 18, 2018, 3:12pm UTC](https://discuss.elastic.co/t/multiple-filebeat-prospectors-and-filebeat-modules/136305 "2018-06-18T15:12:35Z")
Hi, I would like to use Filebeat system and audit modules and send its output directly to Elasticsearch and in the same Filebeat instance I want to pass few other application logs using prospectors and send the output t… --- ## [Connection error between filebeat server and elasticsearch server: EOF error](https://discuss.elastic.co/t/connection-error-between-filebeat-server-and-elasticsearch-server-eof-error/136260)
**Author:** [@A3TH3RIUS](https://discuss.elastic.co/u/A3TH3RIUS)\ **Replies:** 6\ **Last updated:** [June 18, 2018, 2:41pm UTC](https://discuss.elastic.co/t/connection-error-between-filebeat-server-and-elasticsearch-server-eof-error/136260 "2018-06-18T14:41:54Z")
hi everyone, I'm trying to set up two communicating servers, one having elasticsearch and one with Filebeat ... The problem is that I can not get the logs on my elasticsearch server and in the Filebeat log file I get t… --- ## [Filebeat Client TLS connection failed to ELK Host](https://discuss.elastic.co/t/filebeat-client-tls-connection-failed-to-elk-host/136319)
**Author:** [@howardweng](https://discuss.elastic.co/u/howardweng)\ **Replies:** 2\ **Last updated:** [June 18, 2018, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-client-tls-connection-failed-to-elk-host/136319 "2018-06-18T14:40:06Z")
Target is to use Filebeat Client uses TLS connection failed to ELK Host telnet shows work as following. telnet 209.xx.173.45 5044 Trying 209.xx.173.45... Connected to 209.97.173.45. Escape character is '^\]'. Certif… --- ## [Winlogbeat speeding up clocks on windows servers by 1 second every minute](https://discuss.elastic.co/t/winlogbeat-speeding-up-clocks-on-windows-servers-by-1-second-every-minute/135175)
**Author:** [@Darren\_Stokes](https://discuss.elastic.co/u/Darren_Stokes)\ **Replies:** 14\ **Last updated:** [June 18, 2018, 2:03pm UTC](https://discuss.elastic.co/t/winlogbeat-speeding-up-clocks-on-windows-servers-by-1-second-every-minute/135175 "2018-06-18T14:03:25Z")
Today I started to run winlogbeat on a number of Windows 2008 R2 servers and was succesfully transferring windows eventlogs to my elk stack without any problems. We ran into a problem later on in the day with time acros… --- ## [Monitoring files in a directory](https://discuss.elastic.co/t/monitoring-files-in-a-directory/136289)
**Author:** [@rohitnrl](https://discuss.elastic.co/u/rohitnrl)\ **Replies:** 4\ **Last updated:** [June 18, 2018, 12:21pm UTC](https://discuss.elastic.co/t/monitoring-files-in-a-directory/136289 "2018-06-18T12:21:03Z")
Hi, I have a directory where files are being written really quick. Is there a way i can access the newly written file to that directory and then pass the information to elasticsearch. --- ## [Winlogbeat does not write specific eventlog status in registry file](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750)
**Author:** [@ld57](https://discuss.elastic.co/u/ld57)\ **Replies:** 7\ **Last updated:** [June 18, 2018, 12:16pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750 "2018-06-18T12:16:38Z")
Hello all, We meet a strange issue where a specific monitored eventlog does not appear in the registry file, and when we restart winlogbeat, it resends again from the beginning. This does not affect eventlogs system, s… --- ## [Kubernetes autodiscover provider with "hostNetwork: true"](https://discuss.elastic.co/t/kubernetes-autodiscover-provider-with-hostnetwork-true/136091)
**Author:** [@hamelg](https://discuss.elastic.co/u/hamelg)\ **Replies:** 2\ **Last updated:** [June 18, 2018, 8:34am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-provider-with-hostnetwork-true/136091 "2018-06-18T08:34:57Z")
I want to setup a metricbeat pod to gather host's metrics AND also to collect other metrics in containers via the kubernetes provider. Exemple : ## Collect apache metrics in apache containers metricbeat.autodiscover… --- ## [Filebeat multiline issue](https://discuss.elastic.co/t/filebeat-multiline-issue/136176)
**Author:** [@Dinesh\_Senthil\_Kumar](https://discuss.elastic.co/u/Dinesh_Senthil_Kumar)\ **Replies:** 1\ **Last updated:** [June 18, 2018, 8:01am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/136176 "2018-06-18T08:01:02Z")
hi am using filebeat for log parsing with multiline feature. for me all the events are going as a single event. need to spilt it based on the each events. --- ## [Filebeat - Ingest Node - Parsing Date](https://discuss.elastic.co/t/filebeat-ingest-node-parsing-date/136229)
**Author:** [@motamedi791](https://discuss.elastic.co/u/motamedi791)\ **Replies:** 1\ **Last updated:** [June 18, 2018, 4:56am UTC](https://discuss.elastic.co/t/filebeat-ingest-node-parsing-date/136229 "2018-06-18T04:56:44Z")
My applications publishes logs in the following format: \[2018-06-17 21:39:14.779\] \[root\] \[info\] The rest of message I would like to extract the @timestamp from the log message. So I created the following pipeline in el… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=442) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=444)