# Beats

**URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=447

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 448

---

## [Some paragraphs of document missing in ES index](https://discuss.elastic.co/t/some-paragraphs-of-document-missing-in-es-index/134191)

<div class="topic-metadata">

**Author:** [@Ole](https://discuss.elastic.co/u/Ole)\
**Replies:** 4\
**Last updated:** [June 1, 2018, 11:18am UTC](https://discuss.elastic.co/t/some-paragraphs-of-document-missing-in-es-index/134191 "2018-06-01T11:18:31Z")

</div>

I don't know for sure if this is a problem on Filebeat's side or if its from Logstash/Elasticsearch. I have a setup of Filebeat, Logstash and Elasticsearch. I use filebeat as the input for my Logstash and Elasticsearch …

---

## [Filebeat prospector\_format](https://discuss.elastic.co/t/filebeat-prospector-format/133606)

<div class="topic-metadata">

**Author:** [@Josh\_Vj](https://discuss.elastic.co/u/Josh_Vj)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 11:00am UTC](https://discuss.elastic.co/t/filebeat-prospector-format/133606 "2018-06-01T11:00:39Z")

</div>

Hi, i have below settigs in filebeat.yaml type: log multiline.pattern: '^\<!--' multiline.negate: true multiline.match: after below is the message I m trying stream into ECS. But in ECS all the below lines are format…

---

## [SSL communication between Filebeat 5.6.2 and Kafka 0.10](https://discuss.elastic.co/t/ssl-communication-between-filebeat-5-6-2-and-kafka-0-10/133612)

<div class="topic-metadata">

**Author:** [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 10:51am UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-5-6-2-and-kafka-0-10/133612 "2018-06-01T10:51:48Z")

</div>

Hi, We are sending filebeat output to Kafka running in 3 nodes. We have enabled 2-way SSL communication in Kafka. Now we want to make filebeat (client for kafka) to be authenticated by Kafka. My doubt is how to update …

---

## [How to disable loading Metricbeat template in 6.x?](https://discuss.elastic.co/t/how-to-disable-loading-metricbeat-template-in-6-x/134044)

<div class="topic-metadata">

**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 10:48am UTC](https://discuss.elastic.co/t/how-to-disable-loading-metricbeat-template-in-6-x/134044 "2018-06-01T10:48:58Z")

</div>

According to https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-template.html I need to set setup.template.enabled: false to stop Metricbeat loading its template (which interferes with my manually…

---

## [How to Flush\_pattern](https://discuss.elastic.co/t/how-to-flush-pattern/133154)

<div class="topic-metadata">

**Author:** [@jurisn](https://discuss.elastic.co/u/jurisn)\
**Replies:** 3\
**Last updated:** [June 1, 2018, 10:45am UTC](https://discuss.elastic.co/t/how-to-flush-pattern/133154 "2018-06-01T10:45:15Z")

</div>

Hi, I have some log file: 12:07:10.698 \[ INFO\] \[aa\] MqConsume(): New message "Message108" received from Topic "Topic1" 12:07:10.698 \[DEBUG\] \[aa\] MqMessageHeaders(): Processing message headers 12:07:10.699 \[ INFO\] \[aa…

---

## [Filebeat and redis set up issue on aws](https://discuss.elastic.co/t/filebeat-and-redis-set-up-issue-on-aws/133666)

<div class="topic-metadata">

**Author:** [@remo](https://discuss.elastic.co/u/remo)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-and-redis-set-up-issue-on-aws/133666 "2018-06-01T09:22:17Z")

</div>

I am setting up elk on aws using filebeat and redis. I have installed filebeat 6.2.4 using docker. also i have setup redis 3.2 using docker. But i am unable to send logs from filebeat to redis. I m getting eror in file…

---

## [New feature requesting in heartbeat](https://discuss.elastic.co/t/new-feature-requesting-in-heartbeat/133778)

<div class="topic-metadata">

**Author:** [@WanLi\_Chen](https://discuss.elastic.co/u/WanLi_Chen)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 9:20am UTC](https://discuss.elastic.co/t/new-feature-requesting-in-heartbeat/133778 "2018-06-01T09:20:34Z")

</div>

There is only icmp\_rtt\_us ,the RTT time ,adding a packet loss percent would be wonderful....

---

## [Filebeat Module Creation](https://discuss.elastic.co/t/filebeat-module-creation/134110)

<div class="topic-metadata">

**Author:** [@djtecha](https://discuss.elastic.co/u/djtecha)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 8:51am UTC](https://discuss.elastic.co/t/filebeat-module-creation/134110 "2018-06-01T08:51:04Z")

</div>

So I've started playing around with the filebeat modules and I enjoy the idea of having a tight coupling between Viz, field mapping, ingest pipeline and source files. But I kind of am stuck on fully switching over to it.…

---

## [Best Beats for Security Analytics and login checks](https://discuss.elastic.co/t/best-beats-for-security-analytics-and-login-checks/134140)

<div class="topic-metadata">

**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\
**Replies:** 1\
**Last updated:** [June 1, 2018, 6:32am UTC](https://discuss.elastic.co/t/best-beats-for-security-analytics-and-login-checks/134140 "2018-06-01T06:32:51Z")

</div>

Hi, I am having the following platform OS - centos 7.4 ES - 6.2 Logstash - 6.2 Kibana - 6.2 Currently Iam using Packetbeat,filebeat and metricbeats in my clients. May I know whats the best beat that I can use in ca…

---

## [Unable to start auditbeat daemon process](https://discuss.elastic.co/t/unable-to-start-auditbeat-daemon-process/133670)

<div class="topic-metadata">

**Author:** [@vitt-bagal](https://discuss.elastic.co/u/vitt-bagal)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 5:38am UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-daemon-process/133670 "2018-06-01T05:38:16Z")

</div>

Able to built auditbeat on ubuntu 16.04 container & used default auditbeat.yml to start auditbeat daemon process. But unable to start it. sudo ./auditbeat -e -c auditbeat.yml -d "publish" & command is failing with below…

---

## [No index found in kibana index pattern after ship a json-format log file to ES](https://discuss.elastic.co/t/no-index-found-in-kibana-index-pattern-after-ship-a-json-format-log-file-to-es/134053)

<div class="topic-metadata">

**Author:** [@Kevin.Wu](https://discuss.elastic.co/u/Kevin.Wu)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 3:02am UTC](https://discuss.elastic.co/t/no-index-found-in-kibana-index-pattern-after-ship-a-json-format-log-file-to-es/134053 "2018-06-01T03:02:13Z")

</div>

Hi, guys I'm a newbee to FileBeat. Recently, I was trying to ship a custom json-format log file to ES. The file looks like this: {"id":"8cb66f382d418648d0a26f5de7369e315eb06a82","status":"running","configPath":"/mnt/…

---

## [Filebeat cant send large log data to es](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012)

<div class="topic-metadata">

**Author:** [@XIAOXIELM](https://discuss.elastic.co/u/XIAOXIELM)\
**Replies:** 2\
**Last updated:** [June 1, 2018, 2:18am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012 "2018-06-01T02:18:04Z")

</div>

Now at product env. When I restart es（filebeat is still running）, I will meet an issue that filebeat doesn't send the log info to es. one line log is too large（7K） may cause this issue? the filebeat.yml type: log ig…

---

## [Corrupted messages when using PGSQL protocol](https://discuss.elastic.co/t/corrupted-messages-when-using-pgsql-protocol/134051)

<div class="topic-metadata">

**Author:** [@kauf](https://discuss.elastic.co/u/kauf)\
**Replies:** 1\
**Last updated:** [May 31, 2018, 10:21pm UTC](https://discuss.elastic.co/t/corrupted-messages-when-using-pgsql-protocol/134051 "2018-05-31T22:21:52Z")

</div>

We are using packetbeat version 6.2.4 to log all SQL requests. The relevant part of configuration is: packetbeat.flows: enabled: false packetbeat.protocols: - type: pgsql ports: \[5432\] send\_request: true send\_…

---

## [Filebeat: Match literal \* or \*\* in messages](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757)

<div class="topic-metadata">

**Author:** [@Krog](https://discuss.elastic.co/u/Krog)\
**Replies:** 4\
**Last updated:** [May 31, 2018, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757 "2018-05-31T16:22:27Z")

</div>

I have log files that contain the following: \<15:00:51.504 DBG ... \<15:00:52.173 \*WRN\* SM ... \<15:00:52.173 \*\*ERR\*\* TSS ... \<15:00:52.173 TRC EWF ... I would like to drop any messages that do not contain WRN or ERR fro…

---

## [Filebeats 6.3 tcp client crash](https://discuss.elastic.co/t/filebeats-6-3-tcp-client-crash/133759)

<div class="topic-metadata">

**Author:** [@emrith](https://discuss.elastic.co/u/emrith)\
**Replies:** 6\
**Last updated:** [May 31, 2018, 2:27pm UTC](https://discuss.elastic.co/t/filebeats-6-3-tcp-client-crash/133759 "2018-05-31T14:27:07Z")

</div>

I'm running filebeat version 6.3.0 (amd64), libbeat 6.3.0 \[489ad50276d34fd597cb31faa644aba1ecf47574 built 2018-05-11 19:02:09 +0000 UTC\] after a week of running we get this in the log 2018-05-29T10:55:39.577-0600 E…

---

## [Filebeat won't talk to logstash after upgrade to 6.x](https://discuss.elastic.co/t/filebeat-wont-talk-to-logstash-after-upgrade-to-6-x/133906)

<div class="topic-metadata">

**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\
**Replies:** 4\
**Last updated:** [May 31, 2018, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-wont-talk-to-logstash-after-upgrade-to-6-x/133906 "2018-05-31T13:36:50Z")

</div>

Upgraded the system to the latest 6.x, but when filebeat tries to talk to logstash I get 2018-05-30T15:17:14.438Z ERROR logstash/async.go:235 Failed to publish events caused by: write tcp 172.16.1.241:38472-\>…

---

## [Unable to drop events](https://discuss.elastic.co/t/unable-to-drop-events/133993)

<div class="topic-metadata">

**Author:** [@limp15000](https://discuss.elastic.co/u/limp15000)\
**Replies:** 5\
**Last updated:** [May 31, 2018, 1:02pm UTC](https://discuss.elastic.co/t/unable-to-drop-events/133993 "2018-05-31T13:02:06Z")

</div>

Hi, I am very to ELK. I've setup a GPO which forwards sysmon and sercurity logs to a server. Then I have winlogbeat which sends the log to logstash. Everything works like a charm except now I am trying to filter the eve…

---

## [Filebeat: ES not receiving index from filebeat](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016)

<div class="topic-metadata">

**Author:** [@jemueldalino](https://discuss.elastic.co/u/jemueldalino)\
**Replies:** 3\
**Last updated:** [May 31, 2018, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016 "2018-05-31T12:26:14Z")

</div>

I'm trying to explore the security recipe for suspicious login activity in my local machine https://github.com/elastic/examples/blob/master/Machine%20Learning/Security%20Analytics%20Recipes/suspicious\_login\_activity/con…

---

## [How to create multi indices with multi logs from filebeat?](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779)

<div class="topic-metadata">

**Author:** [@alantany](https://discuss.elastic.co/u/alantany)\
**Replies:** 2\
**Last updated:** [May 31, 2018, 8:22am UTC](https://discuss.elastic.co/t/how-to-create-multi-indices-with-multi-logs-from-filebeat/130779 "2018-05-31T08:22:05Z")

</div>

Hi, Recently I use filebeat+logstash+ES (all is 6.x) to colect some logs ,I want diferent log create diferent index,how can I do with it? I read docs and said document\_type was deprecated in 6.x，So I configured with FI…

---

## [Filebeat monitoring](https://discuss.elastic.co/t/filebeat-monitoring/133852)

<div class="topic-metadata">

**Author:** [@ashok9177](https://discuss.elastic.co/u/ashok9177)\
**Replies:** 6\
**Last updated:** [May 31, 2018, 5:09am UTC](https://discuss.elastic.co/t/filebeat-monitoring/133852 "2018-05-31T05:09:24Z")

</div>

Hello, below is my filebeat configuration, getting an error Exiting: more than one namespace configured accessing config # filebeat filebeat.prospectors: type: log paths: /opt/id/logs/\* fields: component: idr m…

---

## [ELK setup for Apache Application Logs](https://discuss.elastic.co/t/elk-setup-for-apache-application-logs/132697)

<div class="topic-metadata">

**Author:** [@rdurai](https://discuss.elastic.co/u/rdurai)\
**Replies:** 5\
**Last updated:** [May 31, 2018, 3:42am UTC](https://discuss.elastic.co/t/elk-setup-for-apache-application-logs/132697 "2018-05-31T03:42:01Z")

</div>

Hello, another newbie here. I am bit confused about setting up the ELK for Apache2 application log aggregation. My setup is as follows, all components are version 6.2.3; Apache Logs(3X) --\> Filebeat --\> Logstash --\> El…

---

## [Is it possible to add custom Authentication headers to filebeat output being sent to logstash behind an nginx proxy?](https://discuss.elastic.co/t/is-it-possible-to-add-custom-authentication-headers-to-filebeat-output-being-sent-to-logstash-behind-an-nginx-proxy/133959)

<div class="topic-metadata">

**Author:** [@alilland](https://discuss.elastic.co/u/alilland)\
**Replies:** 1\
**Last updated:** [May 31, 2018, 2:58am UTC](https://discuss.elastic.co/t/is-it-possible-to-add-custom-authentication-headers-to-filebeat-output-being-sent-to-logstash-behind-an-nginx-proxy/133959 "2018-05-31T02:58:41Z")

</div>

As the title says, in the Filebeat config file is it possible to define custom headers to be sent on output to Logstash? the Filebeat documentation does not make it sound like thats an option that is available https://…

---

## [Flushing after yourself](https://discuss.elastic.co/t/flushing-after-yourself/129204)

<div class="topic-metadata">

**Author:** [@ecc256](https://discuss.elastic.co/u/ecc256)\
**Replies:** 20\
**Last updated:** [May 30, 2018, 10:18pm UTC](https://discuss.elastic.co/t/flushing-after-yourself/129204 "2018-05-30T22:18:11Z")

</div>

I’ve rewritten logstash processing logic with beats. Beats starts a lot faster, consumes less memory and feels snappier. Overall beats are pleasure to work with, even debugging is fun. The only problem it keeps loosin…

---

## [How to send apache logs using filebeat?](https://discuss.elastic.co/t/how-to-send-apache-logs-using-filebeat/133800)

<div class="topic-metadata">

**Author:** [@Saketh\_Chandra\_Kolis](https://discuss.elastic.co/u/Saketh_Chandra_Kolis)\
**Replies:** 3\
**Last updated:** [May 30, 2018, 10:14pm UTC](https://discuss.elastic.co/t/how-to-send-apache-logs-using-filebeat/133800 "2018-05-30T22:14:01Z")

</div>

hi, I am new to filebeat. I didn't understand the filebeat documentation.In filebeat.yml when the you specify the path to directory which has your log files,how are the going get parsed,is there any use of config file w…

---

## [Unable to collect data in elastic cloud using internet proxy](https://discuss.elastic.co/t/unable-to-collect-data-in-elastic-cloud-using-internet-proxy/133125)

<div class="topic-metadata">

**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Replies:** 4\
**Last updated:** [May 30, 2018, 6:23pm UTC](https://discuss.elastic.co/t/unable-to-collect-data-in-elastic-cloud-using-internet-proxy/133125 "2018-05-30T18:23:04Z")

</div>

Hey Guys, I have been cracking my head from past three days. Got my elastic cloud instance, when i'm trying to send data to elastic cloud from my servers i'm getting error like it was not able to resolve the elastic cl…

---

## [Multiline cuts off character](https://discuss.elastic.co/t/multiline-cuts-off-character/132468)

<div class="topic-metadata">

**Author:** [@manuelk](https://discuss.elastic.co/u/manuelk)\
**Replies:** 8\
**Last updated:** [May 30, 2018, 2:06pm UTC](https://discuss.elastic.co/t/multiline-cuts-off-character/132468 "2018-05-30T14:06:38Z")

</div>

Hello, we´ve a case where Multiline seems to cut off the first character of a string within Filebeat 6.2.4. Mulitline setting: multiline.pattern: '^(\*.JOB)|Cooldown' multiline.negate: true multiline.match: after M…

---

## [TLS Windows Certificate Manager](https://discuss.elastic.co/t/tls-windows-certificate-manager/133486)

<div class="topic-metadata">

**Author:** [@anon80523324](https://discuss.elastic.co/u/anon80523324)\
**Replies:** 2\
**Last updated:** [May 30, 2018, 12:24pm UTC](https://discuss.elastic.co/t/tls-windows-certificate-manager/133486 "2018-05-30T12:24:29Z")

</div>

Hello. Is it possible use the certificate store when setting up TLS with Beats on Windows or do I have to copy the files to a some location in the file system? I think it can be used for CAs if certificate\_authorities is…

---

## [Beats dashboard 1.3 load errors](https://discuss.elastic.co/t/beats-dashboard-1-3-load-errors/133634)

<div class="topic-metadata">

**Author:** [@Guido\_van\_Brakel](https://discuss.elastic.co/u/Guido_van_Brakel)\
**Replies:** 4\
**Last updated:** [May 30, 2018, 11:15am UTC](https://discuss.elastic.co/t/beats-dashboard-1-3-load-errors/133634 "2018-05-30T11:15:17Z")

</div>

When I try to load the beats dashboards, I get lots of errors like this ./load.sh -url http://127.0.0.1:9200 Loading dashboards to http://127.0.0.1:9200 in .kibana {"acknowledged":true,"shards\_acknowledged":true,"inde…

---

## [Filebeat not coming up](https://discuss.elastic.co/t/filebeat-not-coming-up/133752)

<div class="topic-metadata">

**Author:** [@abhat](https://discuss.elastic.co/u/abhat)\
**Replies:** 1\
**Last updated:** [May 30, 2018, 9:52am UTC](https://discuss.elastic.co/t/filebeat-not-coming-up/133752 "2018-05-30T09:52:19Z")

</div>

Hi Team, Filebeat is not coming up. Getting below error in the logs - 2018-05-29T15:55:52-04:00 INFO Setup Beat: filebeat; Version: 5.1.1 2018-05-29T15:55:52-04:00 INFO Max Retries set to: 3 2018-05-29T15:55:52-04:0…

---

## [Filebeat 6.2.4 running as root on Red Hat Linux](https://discuss.elastic.co/t/filebeat-6-2-4-running-as-root-on-red-hat-linux/132067)

<div class="topic-metadata">

**Author:** [@solo](https://discuss.elastic.co/u/solo)\
**Replies:** 3\
**Last updated:** [May 22, 2018, 7:13am UTC](https://discuss.elastic.co/t/filebeat-6-2-4-running-as-root-on-red-hat-linux/132067 "2018-05-22T07:13:29Z")

</div>

Hi. Somehow Filebat insists on running as root, and not as filebeat user. Should not Filebeat run as the filebeat user? My setup: Linux: Red Hat Enterprise Linux Server release 6.9 Java: openjdk version "1.8.0\_161" …

[Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=446)

[Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=448)