# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=444 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 445 --- ## [Watcher Alerts from MetricBeat metrics](https://discuss.elastic.co/t/watcher-alerts-from-metricbeat-metrics/133202)
**Author:** [@elkuser](https://discuss.elastic.co/u/elkuser)\ **Replies:** 2\ **Last updated:** [June 16, 2018, 5:06pm UTC](https://discuss.elastic.co/t/watcher-alerts-from-metricbeat-metrics/133202 "2018-06-16T17:06:12Z")
Can we configure Watcher Alerts from MetricBeat metrics? For example, if Beats detects a spike in CPU or Memory usage, I'd like to set up a Watcher alert for that event, whenever it crosses a specified threshold. Any go… --- ## [Use script output in Filebeat](https://discuss.elastic.co/t/use-script-output-in-filebeat/135983)
**Author:** [@Naruhodou](https://discuss.elastic.co/u/Naruhodou)\ **Replies:** 2\ **Last updated:** [June 15, 2018, 5:05pm UTC](https://discuss.elastic.co/t/use-script-output-in-filebeat/135983 "2018-06-15T17:05:36Z")
I'm trying to use the output of a script as a field in my Filebeat. The command is: kafkadev3-k1:~/kafka\_2.10-0.10.2.0$ echo $(clustername) kafkadev3 In which 'clustername' is an alias for a certain script. I want to u… --- ## [Filebeat cannot keep up](https://discuss.elastic.co/t/filebeat-cannot-keep-up/135628)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 6\ **Last updated:** [June 15, 2018, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-cannot-keep-up/135628 "2018-06-15T14:45:00Z")
HI All, I am using filebeat to send events to logstash. These event are produced at a rate between 300 ~ 800 events p/s. If I look at my log and look at the events I see a 4 ~ 6 hours difference where the events pushed … --- ## [Issue in elasticsearch configurations](https://discuss.elastic.co/t/issue-in-elasticsearch-configurations/135020)
**Author:** [@riccardopierpaoli](https://discuss.elastic.co/u/riccardopierpaoli)\ **Replies:** 1\ **Last updated:** [June 15, 2018, 2:42pm UTC](https://discuss.elastic.co/t/issue-in-elasticsearch-configurations/135020 "2018-06-15T14:42:13Z")
Hello, I'm new in Elasticsearch x-pack plug-in and I have a problem to configure Metricbeat. My configuration is composed by 2 clusters: one for monitoring, compound by one node (port 9202) and one cluster for data node… --- ## [Filebeat-god is stopped](https://discuss.elastic.co/t/filebeat-god-is-stopped/136103)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [June 15, 2018, 2:30pm UTC](https://discuss.elastic.co/t/filebeat-god-is-stopped/136103 "2018-06-15T14:30:15Z")
Can someone explain to me this error ? \[root@frghcslnetv03 filebeat\]# service filebeat status filebeat-god is stopped --- ## [How to collect the logs from multiple machines to my server efficiently?](https://discuss.elastic.co/t/how-to-collect-the-logs-from-multiple-machines-to-my-server-efficiently/135902)
**Author:** [@Pawan\_Chandra](https://discuss.elastic.co/u/Pawan_Chandra)\ **Replies:** 11\ **Last updated:** [June 15, 2018, 11:39am UTC](https://discuss.elastic.co/t/how-to-collect-the-logs-from-multiple-machines-to-my-server-efficiently/135902 "2018-06-15T11:39:55Z")
I want to send logs from multiple machines to my server via some end point. But I know that my files to be written is a log file which has the limits for a number of logs storage( maybe some 1000's). My logs would be any… --- ## [Filebeat.yml problem](https://discuss.elastic.co/t/filebeat-yml-problem/135883)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 3\ **Last updated:** [June 15, 2018, 9:05am UTC](https://discuss.elastic.co/t/filebeat-yml-problem/135883 "2018-06-15T09:05:25Z")
Hi, I did this configuration on filebeat.yml but I had this error when I started it : - type: log enabled: true paths: - /var/log/network/FWEquin\_WAN\_R03-01M.log fields: log\_type: fortigate - type: log … --- ## [How to setup kibana dashboard for windows](https://discuss.elastic.co/t/how-to-setup-kibana-dashboard-for-windows/135288)
**Author:** [@Saketh\_Chandra\_Kolis](https://discuss.elastic.co/u/Saketh_Chandra_Kolis)\ **Replies:** 10\ **Last updated:** [June 15, 2018, 8:42am UTC](https://discuss.elastic.co/t/how-to-setup-kibana-dashboard-for-windows/135288 "2018-06-15T08:42:02Z")
PS C:\\Program Files\\Packetbeat\> ./scripts/import\_dashboards -es http://localhost:9200/ Failed to set the mapping: 400 Bad Request Created temporary directory C:\\Users\\Mahe\\AppData\\Local\\Temp\\tmp300680327 Downloading http… --- ## [Filebeat processors not working as expected](https://discuss.elastic.co/t/filebeat-processors-not-working-as-expected/135022)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 3\ **Last updated:** [June 15, 2018, 4:24am UTC](https://discuss.elastic.co/t/filebeat-processors-not-working-as-expected/135022 "2018-06-15T04:24:57Z")
Here is my filebeat.yml file. First Issue : It was working fine with single processor when I was not testing the and condition, as soon as I added the and condition. I am getting error. $ ./filebeat Exiting: error loadi… --- ## [Filebeat and packetbeat not sending \_source data](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300)
**Author:** [@shivang\_patel](https://discuss.elastic.co/u/shivang_patel)\ **Replies:** 10\ **Last updated:** [June 14, 2018, 9:50am UTC](https://discuss.elastic.co/t/filebeat-and-packetbeat-not-sending-source-data/135300 "2018-06-14T09:50:51Z")
Hi, Before 3 days, all beats are sending data properly on my elastic instance. I was noticed new version is available. So, I upgraded all beats including elastic and kiban from 6.2.3 to 6.2.4. (i am using all beats acc… --- ## [Metribeat not picking up process stats](https://discuss.elastic.co/t/metribeat-not-picking-up-process-stats/135743)
**Author:** [@SIVA\_S2018](https://discuss.elastic.co/u/SIVA_S2018)\ **Replies:** 1\ **Last updated:** [June 14, 2018, 7:19am UTC](https://discuss.elastic.co/t/metribeat-not-picking-up-process-stats/135743 "2018-06-14T07:19:08Z")
Hi, We use metricbeat in our deployment to collect system stats including running processes. One of the processes usually reported by metribeat across our app infrastructure is jboss application. However metricbeat has … --- ## [MsSQL Log beat](https://discuss.elastic.co/t/mssql-log-beat/135765)
**Author:** [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Replies:** 1\ **Last updated:** [June 14, 2018, 7:05am UTC](https://discuss.elastic.co/t/mssql-log-beat/135765 "2018-06-14T07:05:40Z")
Hi, Is there a way to pull in MsSQL logs into elastic ? Some filebeat plugin... maybe? Looked across the beats forum didn't see any real discussions on the topic. Didn't see anything specific in GitHub. Thanks Scot … --- ## [How to rename filebeat fields](https://discuss.elastic.co/t/how-to-rename-filebeat-fields/135155)
**Author:** [@springCkWyy](https://discuss.elastic.co/u/springCkWyy)\ **Replies:** 4\ **Last updated:** [June 13, 2018, 6:14pm UTC](https://discuss.elastic.co/t/how-to-rename-filebeat-fields/135155 "2018-06-13T18:14:19Z")
how to rename filebeat fields? I need 'rename' source to 'path'. and need to rename 'beat.hostname' to 'host'. Beacause I use ‘path’ and 'host' in es. thank you @@@ --- ## [Panic: reflect: call of reflect.Value.Int on zero Value](https://discuss.elastic.co/t/panic-reflect-call-of-reflect-value-int-on-zero-value/135705)
**Author:** [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Replies:** 2\ **Last updated:** [June 13, 2018, 3:37pm UTC](https://discuss.elastic.co/t/panic-reflect-call-of-reflect-value-int-on-zero-value/135705 "2018-06-13T15:37:37Z")
Hi, Having trouble getting started with heartbeat. I'd like it to ping another host. Here's my setup: $ sudo cat heartbeat.yml | sed -e '/^ \*#/d; /^ \*$/d' heartbeat.monitors: - type: icmp schedule: '\*… --- ## [Metricbeat for SQL Server](https://discuss.elastic.co/t/metricbeat-for-sql-server/135436)
**Author:** [@tgspacelabs](https://discuss.elastic.co/u/tgspacelabs)\ **Replies:** 6\ **Last updated:** [June 13, 2018, 2:42pm UTC](https://discuss.elastic.co/t/metricbeat-for-sql-server/135436 "2018-06-13T14:42:33Z")
I am trying to create perfmon counters for SQL Server in metricbeat. I added the following to my metricbeat.yml file but the service will not start properly. The service starts fine when the SQL Server perfmon counter … --- ## [MultiLine Pattern](https://discuss.elastic.co/t/multiline-pattern/135358)
**Author:** [@83500bcd6348a4be6df4](https://discuss.elastic.co/u/83500bcd6348a4be6df4)\ **Replies:** 3\ **Last updated:** [June 13, 2018, 2:26pm UTC](https://discuss.elastic.co/t/multiline-pattern/135358 "2018-06-13T14:26:54Z")
How to Write Multiline Patter to Pick the Multiple Lines between =-=-=-=-=-=- as single Message or record, the log i want to parse looks like this --- ## [Filebeat Windows | Time sync](https://discuss.elastic.co/t/filebeat-windows-time-sync/121513)
**Author:** [@adachi](https://discuss.elastic.co/u/adachi)\ **Replies:** 5\ **Last updated:** [June 13, 2018, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-windows-time-sync/121513 "2018-06-13T13:02:19Z")
Hi! While using Filebeat on Windows Server 2008 R2 I've encountered problem with keeping time in sync. filebeat.yml: filebeat.prospectors: - type: log enabled: true paths: - E:\\logs\\log1\\\*.log - E:\\logs\\log… --- ## [Http.response 404](https://discuss.elastic.co/t/http-response-404/131322)
**Author:** [@ikrot](https://discuss.elastic.co/u/ikrot)\ **Replies:** 14\ **Last updated:** [June 13, 2018, 9:04am UTC](https://discuss.elastic.co/t/http-response-404/131322 "2018-06-13T09:04:50Z")
Hi, Could you help me please to figure out what is going on? Packetbeat returns http.response 404 for existing files. But in the same time when I check it manually with CURL it returns 200 packetbeat version 5.6.4 e… --- ## [Can only start a prospector when all related states are finished](https://discuss.elastic.co/t/can-only-start-a-prospector-when-all-related-states-are-finished/133644)
**Author:** [@xdholy](https://discuss.elastic.co/u/xdholy)\ **Replies:** 6\ **Last updated:** [June 13, 2018, 8:18am UTC](https://discuss.elastic.co/t/can-only-start-a-prospector-when-all-related-states-are-finished/133644 "2018-06-13T08:18:46Z")
Hello, I'm getting this error multiple times now. I realize I shouldn't define multiple prospectors over one file, but i put all my server's log into same log file. I need to use multiple prospector to define different… --- ## [Kibana dashboards import failed](https://discuss.elastic.co/t/kibana-dashboards-import-failed/135104)
**Author:** [@l33tname](https://discuss.elastic.co/u/l33tname)\ **Replies:** 5\ **Last updated:** [June 12, 2018, 11:18pm UTC](https://discuss.elastic.co/t/kibana-dashboards-import-failed/135104 "2018-06-12T23:18:34Z")
Is this a bug or or is it not possible to import the dashboards with this metricbeat version to kibana? metricbeat version 6.2.4 (amd64), libbeat 6.2.4 Exiting: Error importing Kibana dashboards: fail to create the Kib… --- ## [Filebeat can't exclude HTTP200](https://discuss.elastic.co/t/filebeat-cant-exclude-http200/135061)
**Author:** [@marcandre](https://discuss.elastic.co/u/marcandre)\ **Replies:** 6\ **Last updated:** [June 12, 2018, 10:04pm UTC](https://discuss.elastic.co/t/filebeat-cant-exclude-http200/135061 "2018-06-12T22:04:20Z")
Hello, I am trying to exclude HTTP 200 code from the logs sent to elasticsearch by filebeat Here an example of the message: IP- - \[07/Jun/2018:22:39:23 +0000\] "HEAD / HTTP/1.1" 200 - "-" "Mozilla/5.0 (X11; Linux x86\_6… --- ## [Building filebeat from source](https://discuss.elastic.co/t/building-filebeat-from-source/135559)
**Author:** [@George\_Kraft](https://discuss.elastic.co/u/George_Kraft)\ **Replies:** 2\ **Last updated:** [June 12, 2018, 8:27pm UTC](https://discuss.elastic.co/t/building-filebeat-from-source/135559 "2018-06-12T20:27:32Z")
I would like to build filebeat from source. Here are my requirements. Download https://github.com/elastic/beats/archive/v6.2.4.tar.gz once. No Internet access during build. phase 1, build Intel image for Linux phase 2… --- ## [Problem with "docker" prospector and "error decoding json" logs](https://discuss.elastic.co/t/problem-with-docker-prospector-and-error-decoding-json-logs/132828)
**Author:** [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)\ **Replies:** 4\ **Last updated:** [June 12, 2018, 5:32pm UTC](https://discuss.elastic.co/t/problem-with-docker-prospector-and-error-decoding-json-logs/132828 "2018-06-12T17:32:00Z")
When using the docker prospector and specifying containers.ids: \* my logs are constantly spammed with: 2018-05-21T17:39:31.019Z ERROR reader/json.go:32 Error decoding JSON: json: cannot unmarshal number into Go value of… --- ## [Cannot connect to the Docker daemon](https://discuss.elastic.co/t/cannot-connect-to-the-docker-daemon/135406)
**Author:** [@cdrouin](https://discuss.elastic.co/u/cdrouin)\ **Replies:** 5\ **Last updated:** [June 12, 2018, 4:03pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-docker-daemon/135406 "2018-06-12T16:03:12Z")
Hi I'm getting an error running a custom image on my local dev maching using Docker for Windows (in Linux Container Mode). Error 2018-06-11T15:16:44.491Z ERROR instance/beat.go:667 Exiting: Cannot connect … --- ## [Metribeat module system output to elasticsearch with incorrect period](https://discuss.elastic.co/t/metribeat-module-system-output-to-elasticsearch-with-incorrect-period/135470)
**Author:** [@geXingW](https://discuss.elastic.co/u/geXingW)\ **Replies:** 2\ **Last updated:** [June 12, 2018, 8:47am UTC](https://discuss.elastic.co/t/metribeat-module-system-output-to-elasticsearch-with-incorrect-period/135470 "2018-06-12T08:47:58Z")
I set my metricbeat system module output to elasticsearch hosts('192.168.2.1:9200', '192.168.2.2:9200') with 5s period. But elasticsearch seems save data every ten seconds: \[image\] Here's my metribeat.yaml: - module:… --- ## [Filebeat appending new lines even if there is change only in existing line](https://discuss.elastic.co/t/filebeat-appending-new-lines-even-if-there-is-change-only-in-existing-line/135207)
**Author:** [@Yenike\_Raghu\_Ram](https://discuss.elastic.co/u/Yenike_Raghu_Ram)\ **Replies:** 1\ **Last updated:** [June 12, 2018, 8:05am UTC](https://discuss.elastic.co/t/filebeat-appending-new-lines-even-if-there-is-change-only-in-existing-line/135207 "2018-06-12T08:05:01Z")
Say like in original file I ve 2 lines a b We've modified one line say 'a' now output file in logstash is like a -- original data b a -- modified data b I am expecting it to be like log file to have only two lin… --- ## [Unable to change default docker user](https://discuss.elastic.co/t/unable-to-change-default-docker-user/134728)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 2\ **Last updated:** [June 11, 2018, 11:36pm UTC](https://discuss.elastic.co/t/unable-to-change-default-docker-user/134728 "2018-06-11T23:36:50Z")
I'm using rancher, and I'm trying to setup a container to read from all the configured log directories on the host filesystem (i.e. /var/log). However, the default id used by docker.elastic.co/beats/filebeat:6.2.2 is 10… --- ## [Read line error: decoding docker JSON: EOF - autodiscover docker with bad json](https://discuss.elastic.co/t/read-line-error-decoding-docker-json-eof-autodiscover-docker-with-bad-json/135429)
**Author:** [@toyssan1](https://discuss.elastic.co/u/toyssan1)\ **Replies:** 0\ **Last updated:** [June 11, 2018, 8:17pm UTC](https://discuss.elastic.co/t/read-line-error-decoding-docker-json-eof-autodiscover-docker-with-bad-json/135429 "2018-06-11T20:17:00Z")
Running filebeat version 6.2.4 with the autodiscover prospector for docker. If the docker container restarts(crashes) creating a bad entry in the log file, filebeat gets stuck on the bad json entry Example: {"log":"20… --- ## [Kibana Discover tab and Index Patterns shows nothing after creating Filebeat default index](https://discuss.elastic.co/t/kibana-discover-tab-and-index-patterns-shows-nothing-after-creating-filebeat-default-index/135390)
**Author:** [@devesh.mehta](https://discuss.elastic.co/u/devesh.mehta)\ **Replies:** 2\ **Last updated:** [June 11, 2018, 4:12pm UTC](https://discuss.elastic.co/t/kibana-discover-tab-and-index-patterns-shows-nothing-after-creating-filebeat-default-index/135390 "2018-06-11T16:12:34Z")
Hi, My newly configured ELK stop working after I created the first index for Filebeat. \[root@elk01 optimize\]# curl http://elk01:9200/\_cat/indices?v health status index … --- ## [Re-import archived Windows Event Logs](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393)
**Author:** [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Replies:** 7\ **Last updated:** [June 11, 2018, 3:53pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393 "2018-06-11T15:53:35Z")
I have Windows Event Logs archived on my Windows Event Collector that are forwarded events from my endpoints. How can I re-import those into an ELK 6 stack? My WEC server has Winlogbeat installed and is sending the curr… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=443) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=445)