# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=445 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 446 --- ## [Logstash is overloaded?](https://discuss.elastic.co/t/logstash-is-overloaded/135176)
**Author:** [@sfchrisgleason](https://discuss.elastic.co/u/sfchrisgleason)\ **Replies:** 5\ **Last updated:** [June 11, 2018, 12:47pm UTC](https://discuss.elastic.co/t/logstash-is-overloaded/135176 "2018-06-11T12:47:53Z")
Hey all, I've got an ELK stack for development and all was well, up until recently. Not quite sure what's going on, but I'm pretty sure it's logstash getting creamed and not able to keep up. The basics are I have an 8 … --- ## [Packetbeat installation problem](https://discuss.elastic.co/t/packetbeat-installation-problem/134732)
**Author:** [@Saketh\_Chandra\_Kolis](https://discuss.elastic.co/u/Saketh_Chandra_Kolis)\ **Replies:** 6\ **Last updated:** [June 11, 2018, 4:46am UTC](https://discuss.elastic.co/t/packetbeat-installation-problem/134732 "2018-06-11T04:46:51Z")
PS C:\\Program Files\\Packetbeat\> PowerShell.exe -ExecutionPolicy UnRestricted -File .\\install-service-packetbeat.ps1. Security warning Run only scripts that you trust. While scripts from the internet can be useful, this… --- ## [Publicly opening the elastic search ports](https://discuss.elastic.co/t/publicly-opening-the-elastic-search-ports/134353)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 4\ **Last updated:** [June 11, 2018, 4:36am UTC](https://discuss.elastic.co/t/publicly-opening-the-elastic-search-ports/134353 "2018-06-11T04:36:25Z")
Hi, I am having a reasonable number of servers in various geo locations. I am planning to install beats in those servers and to set a ELK setup as a core monitor server. So publicly opening a port will definitely inc… --- ## [Filebeat output two conditions](https://discuss.elastic.co/t/filebeat-output-two-conditions/135130)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 2\ **Last updated:** [June 11, 2018, 2:03am UTC](https://discuss.elastic.co/t/filebeat-output-two-conditions/135130 "2018-06-11T02:03:22Z")
\# send data to elasticsearch output.elasticsearch: hosts: \["http://172.17.91.21:9200"\] index: "logs-%{\[beat.version\]}-%{+yyyy.MM.dd}" indices: - index: "ftjf-test-jar\_logs-${ES\_DATE}-info" #when.equals: … --- ## [Output data to different sources using filebeat](https://discuss.elastic.co/t/output-data-to-different-sources-using-filebeat/135233)
**Author:** [@pauldon2](https://discuss.elastic.co/u/pauldon2)\ **Replies:** 2\ **Last updated:** [June 10, 2018, 7:23am UTC](https://discuss.elastic.co/t/output-data-to-different-sources-using-filebeat/135233 "2018-06-10T07:23:07Z")
Is it possible to configure a filebeat where data from modules is output directly to elasticsearch, and data from prospectors are output in the logstash? --- ## [Filebeat with Kubernetes on GCE](https://discuss.elastic.co/t/filebeat-with-kubernetes-on-gce/134875)
**Author:** [@Newbas](https://discuss.elastic.co/u/Newbas)\ **Replies:** 6\ **Last updated:** [June 10, 2018, 7:04am UTC](https://discuss.elastic.co/t/filebeat-with-kubernetes-on-gce/134875 "2018-06-10T07:04:46Z")
Hi to everyone. I am trying to send logs to logstash from GCE Kubernetes with use of Filebeat. I took example config for filebeat and just changed Elasticsearch on my logstash. DaemonSet starting and logs look like nor… --- ## [FileBeat Not Shipping changes as expected to Logstash](https://discuss.elastic.co/t/filebeat-not-shipping-changes-as-expected-to-logstash/135226)
**Author:** [@raghu\_ram](https://discuss.elastic.co/u/raghu_ram)\ **Replies:** 0\ **Last updated:** [June 9, 2018, 11:36am UTC](https://discuss.elastic.co/t/filebeat-not-shipping-changes-as-expected-to-logstash/135226 "2018-06-09T11:36:35Z")
I have an original html file first it shipped using file beat and log stash file opened successfully with all content Changed existing lines in html file , file beat detected those changes and shipped to log stash obs… --- ## [Winlogbeats not exporitng event.id or xml data](https://discuss.elastic.co/t/winlogbeats-not-exporitng-event-id-or-xml-data/135051)
**Author:** [@valbizures](https://discuss.elastic.co/u/valbizures)\ **Replies:** 9\ **Last updated:** [June 8, 2018, 10:25pm UTC](https://discuss.elastic.co/t/winlogbeats-not-exporitng-event-id-or-xml-data/135051 "2018-06-08T22:25:25Z")
I have events from a server being sent to logstash, but no eventids or xml data is being passed. Below are examples of the winlogbeats config and the logs I'm getting. It's sending all events, but information I would ne… --- ## [Metricbeat + Openshift](https://discuss.elastic.co/t/metricbeat-openshift/135046)
**Author:** [@arpitshah](https://discuss.elastic.co/u/arpitshah)\ **Replies:** 1\ **Last updated:** [June 8, 2018, 2:01pm UTC](https://discuss.elastic.co/t/metricbeat-openshift/135046 "2018-06-08T14:01:35Z")
Hi, I am able to get metricbeats running on openshift, but not able to get details about deploymentconfig and associated pods on dashboard. Deployment Object of kubernetes is coming through, so it seems openshift specif… --- ## [Filebeat 6.2.3 in Kubernetes : Read line error: decoding docker JSON](https://discuss.elastic.co/t/filebeat-6-2-3-in-kubernetes-read-line-error-decoding-docker-json/132976)
**Author:** [@orgoz](https://discuss.elastic.co/u/orgoz)\ **Replies:** 12\ **Last updated:** [June 8, 2018, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-6-2-3-in-kubernetes-read-line-error-decoding-docker-json/132976 "2018-06-08T13:46:55Z")
Hi, I have deployed Filebeat 6.2.3 in Kubernetes. All works great during few hours but something went wrong after a while. Logs of my ingress-nginx-controller are not indexed anymore, filebeat reports this error : 201… --- ## [Unable to create logrotated files in filebeat](https://discuss.elastic.co/t/unable-to-create-logrotated-files-in-filebeat/135136)
**Author:** [@sahara](https://discuss.elastic.co/u/sahara)\ **Replies:** 1\ **Last updated:** [June 8, 2018, 1:37pm UTC](https://discuss.elastic.co/t/unable-to-create-logrotated-files-in-filebeat/135136 "2018-06-08T13:37:37Z")
config file: filebeat.prospectors: - type: log enabled: true paths: - /var/log/pcapcapture/packets.json document\_type: "pcap\_file" json.keys\_under\_root: true fields: {log\_ty… --- ## [How to capture CPU context switch from metricbeat](https://discuss.elastic.co/t/how-to-capture-cpu-context-switch-from-metricbeat/135083)
**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\ **Replies:** 1\ **Last updated:** [June 8, 2018, 1:16pm UTC](https://discuss.elastic.co/t/how-to-capture-cpu-context-switch-from-metricbeat/135083 "2018-06-08T13:16:04Z")
Hi, Could someone please let me know if there is way to capture CPU context switch from metricbeat-6.2.3. Unable to find relevant field In official list of metricbeat fields in below URL - https://www.elastic.co/guide… --- ## [Where is add\_kubernetes\_metadata documented?](https://discuss.elastic.co/t/where-is-add-kubernetes-metadata-documented/135110)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 4\ **Last updated:** [June 8, 2018, 10:50am UTC](https://discuss.elastic.co/t/where-is-add-kubernetes-metadata-documented/135110 "2018-06-08T10:50:21Z")
At https://www.elastic.co/guide/en/beats/filebeat/current/add-kubernetes-metadata.html there is an example of "default indexers and matchers disabled and enables ones that the user is interested in" but no links that I… --- ## [Parse data](https://discuss.elastic.co/t/parse-data/135108)
**Author:** [@Arya\_Saha](https://discuss.elastic.co/u/Arya_Saha)\ **Replies:** 2\ **Last updated:** [June 8, 2018, 9:44am UTC](https://discuss.elastic.co/t/parse-data/135108 "2018-06-08T09:44:00Z")
If I update the filebeat.yml file with the log file path and host address of my elasticsearch,that will help me to parse the data from filebeat to elastic.ryt?? If yes,can you please tell me the steps to do so? --- ## [Creating simple pipeline to parse the docker logs](https://discuss.elastic.co/t/creating-simple-pipeline-to-parse-the-docker-logs/134952)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 7\ **Last updated:** [June 8, 2018, 3:58am UTC](https://discuss.elastic.co/t/creating-simple-pipeline-to-parse-the-docker-logs/134952 "2018-06-08T03:58:58Z")
As part of my lab exercise to learn the docker log parsing. I am creating simple pipeline in which beat will send the data to logstash and further logstash will index this data in ES by creating new index. root@elk-mach… --- ## [\[Solved\] Installing filebeat-6.2.2-amd64.deb, no modules.d](https://discuss.elastic.co/t/solved-installing-filebeat-6-2-2-amd64-deb-no-modules-d/134731)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 4\ **Last updated:** [June 8, 2018, 3:37am UTC](https://discuss.elastic.co/t/solved-installing-filebeat-6-2-2-amd64-deb-no-modules-d/134731 "2018-06-08T03:37:32Z")
I'm a little confused. I installed filebeat-6.2.2-amd64.deb, however, there is nothing in /etc/filebeat, and none of the modules (i.e. system.yml, system.yml.disabled) can be found anywhere in /etc or /usr They exist in… --- ## [Filebeat lost data when elasticsearch is down](https://discuss.elastic.co/t/filebeat-lost-data-when-elasticsearch-is-down/134879)
**Author:** [@anson\_ch](https://discuss.elastic.co/u/anson_ch)\ **Replies:** 4\ **Last updated:** [June 8, 2018, 2:14am UTC](https://discuss.elastic.co/t/filebeat-lost-data-when-elasticsearch-is-down/134879 "2018-06-08T02:14:35Z")
I have experienced a lost data issue with filebeat ----\> elasticsearch. when one pod of elasticsearch cluster is down, i found that the filebeat had lost log data. The related configuration is as follows : elasticsea… --- ## [Provided Grok expressions do not match field value for response code 408](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-response-code-408/133776)
**Author:** [@gregbacchus](https://discuss.elastic.co/u/gregbacchus)\ **Replies:** 3\ **Last updated:** [June 7, 2018, 10:16pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-response-code-408/133776 "2018-06-07T22:16:00Z")
Hi, I'm using Filebeat 6.2.4 with the apache module (and Apache 2.4.7). My other\_vhosts\_access.log contains some logs like below: my-host-name.com:80 1.2.3.4 - - \[30/May/2018:02:14:12 +0000\] "-" 408 0 "-" "-" and whe… --- ## [Error decoding JSON: json: cannot unmarshal string into Go value of type map\[string\]interface {}](https://discuss.elastic.co/t/error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/134498)
**Author:** [@john.akash](https://discuss.elastic.co/u/john.akash)\ **Replies:** 9\ **Last updated:** [June 7, 2018, 5:15pm UTC](https://discuss.elastic.co/t/error-decoding-json-json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/134498 "2018-06-07T17:15:25Z")
Hi Team, We are using filebeat-6.0.1-1 and trying to parse a custom log to ES (5.5.x), { "Level":"DEBUG", "Date": "2018-06-04 20:11:24.277", "Thread": "\[https-jsse-nio-8443-exec-9\]", "Context": "RestProcessor", "Log": … --- ## [Repeat: Filebeat include is not working when logs are in both json and non-json format](https://discuss.elastic.co/t/repeat-filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/134868)
**Author:** [@cweiss](https://discuss.elastic.co/u/cweiss)\ **Replies:** 3\ **Last updated:** [June 7, 2018, 3:08pm UTC](https://discuss.elastic.co/t/repeat-filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/134868 "2018-06-07T15:08:08Z")
This is more or less a duplicate of the problem described here: Filebeat include is not working when logs are in both json and non-json format. It was closed without resolution :frowning: . We are trying to parse JSON c… --- ## [Filebeat Client/Server Version Mismatch](https://discuss.elastic.co/t/filebeat-client-server-version-mismatch/134872)
**Author:** [@dieg0](https://discuss.elastic.co/u/dieg0)\ **Replies:** 3\ **Last updated:** [June 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-client-server-version-mismatch/134872 "2018-06-07T14:08:49Z")
We have one server (A) running a docker cluster (Node.js and Elasticsearch) and a separate server (B) running ELK Stack. Logs should get shipped from Server A using filebet, it is installed independent from docker clust… --- ## [FileBeat not Creating New Index in Elasticsearch](https://discuss.elastic.co/t/filebeat-not-creating-new-index-in-elasticsearch/134807)
**Author:** [@83500bcd6348a4be6df4](https://discuss.elastic.co/u/83500bcd6348a4be6df4)\ **Replies:** 9\ **Last updated:** [June 7, 2018, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-not-creating-new-index-in-elasticsearch/134807 "2018-06-07T13:01:03Z")
When I'm Running FileBeat to Send the Log File from path - C:\\ProgramData\\Elastic\\Elasticsearch\\logs\\elasticsearch.log using the following filebeat.yml file filebeat.prospectors: type: log enabled: false paths: … --- ## [Could not load data from filebeat into logstash](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966)
**Author:** [@umang\_bhargava](https://discuss.elastic.co/u/umang_bhargava)\ **Replies:** 2\ **Last updated:** [June 7, 2018, 12:35pm UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966 "2018-06-07T12:35:57Z")
Greetings everyone! I want to feed my log file from fealbeat into logstash. But i am not able to do it. I am receiving these errors. \[2018-06-05T11:30:44,112\]\[INFO \]\[logstash.agent \] Pipelines running {:count… --- ## [IIS data type filebeat 6.3](https://discuss.elastic.co/t/iis-data-type-filebeat-6-3/134741)
**Author:** [@stestaz](https://discuss.elastic.co/u/stestaz)\ **Replies:** 2\ **Last updated:** [June 7, 2018, 7:17am UTC](https://discuss.elastic.co/t/iis-data-type-filebeat-6-3/134741 "2018-06-07T07:17:07Z")
Hi, I'm trying to put iis logs in kibana using filebeat, I've seen that the stable version 6.2 still not have this implemented so I've compiled the new 6.3 version. In this version de module is present but the data are… --- ## [Auditbeat auditd disk space action?](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695)
**Author:** [@ryannelle](https://discuss.elastic.co/u/ryannelle)\ **Replies:** 1\ **Last updated:** [June 6, 2018, 9:53pm UTC](https://discuss.elastic.co/t/auditbeat-auditd-disk-space-action/134695 "2018-06-06T21:53:39Z")
Curious, does the Auditbeat auditd module have a space\_left, admin\_space\_left or disk\_full action like auditd does? If my disk starts filling up I need syslog to start logging that I am running out of space, and if the … --- ## [Filebeat-failover](https://discuss.elastic.co/t/filebeat-failover/134685)
**Author:** [@surendrakotte](https://discuss.elastic.co/u/surendrakotte)\ **Replies:** 5\ **Last updated:** [June 6, 2018, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-failover/134685 "2018-06-06T16:45:48Z")
Hello, Do we have a way to configure failover for filebeat process? Thanks in advance! Surendra --- ## [Filebeat fails to send docker container logs to Logstash](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419)
**Author:** [@Dolores](https://discuss.elastic.co/u/Dolores)\ **Replies:** 3\ **Last updated:** [June 6, 2018, 2:59pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-docker-container-logs-to-logstash/134419 "2018-06-06T14:59:50Z")
I have a custom image of filebeat, and I am trying to forward all docker container logs to logstash and later on to see them on Kibana (through Elasticsearch). I can't see what am I doing wrong, as I cant see any logs on… --- ## [Filebeat Nginx error module @timestamp wrong in Kibana](https://discuss.elastic.co/t/filebeat-nginx-error-module-timestamp-wrong-in-kibana/134456)
**Author:** [@surj08](https://discuss.elastic.co/u/surj08)\ **Replies:** 3\ **Last updated:** [June 6, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-nginx-error-module-timestamp-wrong-in-kibana/134456 "2018-06-06T13:47:40Z")
Hello I'm having an issue with filebeat 6.2.4 with the Nginx error module. The access module works fine and the data pulls into kibana with the correct time. However, the error logs show up 4 hours late with the default… --- ## [Filebeat 401 Unauth](https://discuss.elastic.co/t/filebeat-401-unauth/134709)
**Author:** [@d3sire](https://discuss.elastic.co/u/d3sire)\ **Replies:** 1\ **Last updated:** [June 6, 2018, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-401-unauth/134709 "2018-06-06T13:04:55Z")
Hey, I have set up filebeat with elasticsearch output. My ES instance is behind nginx reverse proxy with basic auth. I have tested my login:password with curl and everything works fine. However, I keep getting 401 unaut… --- ## [Filebeat Load Balancing to Docker Logstash Containers](https://discuss.elastic.co/t/filebeat-load-balancing-to-docker-logstash-containers/134266)
**Author:** [@Krog](https://discuss.elastic.co/u/Krog)\ **Replies:** 8\ **Last updated:** [June 6, 2018, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-load-balancing-to-docker-logstash-containers/134266 "2018-06-06T12:20:18Z")
Greetings: I have filebeat configured to load balance to 12 logstash docker containers on a different server. They all share the same IP address but utilize different ports. I only ever see one instance that is proces… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=444) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=446)