# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=449 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 450 --- ## [Kibana showing wrong histogram interval in output](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 13\ **Last updated:** [May 25, 2018, 2:37pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614 "2018-05-25T14:37:56Z")
I am creating query for histogram output of metricbeat cpu log. i tried this query as below. post metricbeat/\_search { "size": 0, "query" : { "bool": { "must": \[ { "range": { "@timestamp": { … --- ## [Filebeat to kafka message not in order](https://discuss.elastic.co/t/filebeat-to-kafka-message-not-in-order/131836)
**Author:** [@Manh\_Tien\_Bui](https://discuss.elastic.co/u/Manh_Tien_Bui)\ **Replies:** 3\ **Last updated:** [May 25, 2018, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-to-kafka-message-not-in-order/131836 "2018-05-25T12:52:52Z")
Hi all, I have a problem: Message in kafka not same formal ! My filebeat config: ###################### Filebeat Configuration Example ######################### #=========================== Filebeat prospectors ====… --- ## [Beat : vsphere module](https://discuss.elastic.co/t/beat-vsphere-module/130494)
**Author:** [@adelbot](https://discuss.elastic.co/u/adelbot)\ **Replies:** 11\ **Last updated:** [May 25, 2018, 12:09pm UTC](https://discuss.elastic.co/t/beat-vsphere-module/130494 "2018-05-25T12:09:48Z")
Is it possible to retrieve Tag Field like Custom field ? These "custom" field seems be in end of life at vmware. Why not retrieve the distributed network port group ? --- ## [Filter not working filbert nginx module](https://discuss.elastic.co/t/filter-not-working-filbert-nginx-module/133040)
**Author:** [@chitender](https://discuss.elastic.co/u/chitender)\ **Replies:** 7\ **Last updated:** [May 25, 2018, 9:09am UTC](https://discuss.elastic.co/t/filter-not-working-filbert-nginx-module/133040 "2018-05-25T09:09:18Z")
we are trying to setup central logging system by using Elasticsearch, Kibana and FileBeat. so to start with we are trying to visualise the Nginx logs with the help of Kibana. we installed Elasticsearch, Kibana and FileB… --- ## [Missing modules.path](https://discuss.elastic.co/t/missing-modules-path/132161)
**Author:** [@Invictus](https://discuss.elastic.co/u/Invictus)\ **Replies:** 3\ **Last updated:** [May 25, 2018, 9:02am UTC](https://discuss.elastic.co/t/missing-modules-path/132161 "2018-05-25T09:02:42Z")
hi members, as already pointed out in that request it seems necessary to enable healthcheck inside the container. So I tried to set the following commands in the container with these errors. \[root@c1c93cf2f46d metri… --- ## [Only using filebeats can I make a processor send to a different index](https://discuss.elastic.co/t/only-using-filebeats-can-i-make-a-processor-send-to-a-different-index/133061)
**Author:** [@staticfrost](https://discuss.elastic.co/u/staticfrost)\ **Replies:** 1\ **Last updated:** [May 25, 2018, 8:45am UTC](https://discuss.elastic.co/t/only-using-filebeats-can-i-make-a-processor-send-to-a-different-index/133061 "2018-05-25T08:45:17Z")
Hi, I want to just use filebeats to send two different logs to two different index. Is this possible? --- ## [Filebeat startup error (multiline)](https://discuss.elastic.co/t/filebeat-startup-error-multiline/133270)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 2\ **Last updated:** [May 25, 2018, 7:46am UTC](https://discuss.elastic.co/t/filebeat-startup-error-multiline/133270 "2018-05-25T07:46:56Z")
Use filebeat to collect logs. There are many lines in the collected log that need to be merged into one line. After referring to the official documentation, the following errors are reported: 2018-05-25T15:07:55.442+080… --- ## [How to convert http request to keyword type](https://discuss.elastic.co/t/how-to-convert-http-request-to-keyword-type/133038)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 3\ **Last updated:** [May 25, 2018, 6:41am UTC](https://discuss.elastic.co/t/how-to-convert-http-request-to-keyword-type/133038 "2018-05-25T06:41:52Z")
Hi All, I have a packetbeat elastic kibana setup. i want to download captured http.requests.body and http.response.body via kibana data downloads functionality. So i used kibana data table visualization option to displa… --- ## [How does filebeat keep track of what line it has read?](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086)
**Author:** [@solo](https://discuss.elastic.co/u/solo)\ **Replies:** 6\ **Last updated:** [May 25, 2018, 6:19am UTC](https://discuss.elastic.co/t/how-does-filebeat-keep-track-of-what-line-it-has-read/133086 "2018-05-25T06:19:06Z")
If I have a log file that are x MB long, and there is a new log entry. How does FIlebeat know where it should start to read again? Does it need to retrieve the entire file, or does it open the file from its last known … --- ## [Filebeat Invalid Frame Type Error](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250)
**Author:** [@kavinda](https://discuss.elastic.co/u/kavinda)\ **Replies:** 2\ **Last updated:** [May 25, 2018, 5:32am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250 "2018-05-25T05:32:28Z")
Hi All I have ELK stack running on AWS and i wanted to get logs from my windows PC as a filebeat stream so i installed filebeat in that windows host when i run my logstash configuration i get the fallowing error \[2018-… --- ## [Filebeat Crash](https://discuss.elastic.co/t/filebeat-crash/133200)
**Author:** [@surendrakotte](https://discuss.elastic.co/u/surendrakotte)\ **Replies:** 2\ **Last updated:** [May 25, 2018, 4:38am UTC](https://discuss.elastic.co/t/filebeat-crash/133200 "2018-05-25T04:38:05Z")
Hello All, FileBeat \[6.2.x\] crashes, how to identify the reason/fix it? Current config Filebeat write to ELastic search directly. Thanks in advance! --- ## [Winlogbeat - Logs for Windows 7/10 and X-pack](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134)
**Author:** [@peson79](https://discuss.elastic.co/u/peson79)\ **Replies:** 1\ **Last updated:** [May 24, 2018, 5:42pm UTC](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134 "2018-05-24T17:42:16Z")
Hi Im in a little bit of hurry. We are in a procurement process, handling the solution today 23.59. The customer have the demand to monitor Windows OS logs and especially the Security logs. I've been looking at Winlo… --- ## [Concealment of Beats](https://discuss.elastic.co/t/concealment-of-beats/132818)
**Author:** [@t03r1cht](https://discuss.elastic.co/u/t03r1cht)\ **Replies:** 15\ **Last updated:** [May 24, 2018, 1:52pm UTC](https://discuss.elastic.co/t/concealment-of-beats/132818 "2018-05-24T13:52:40Z")
Hi, I am currently deploying the Elastic Stack inside a honeynet for log data analysis of different honeypots. I'm using Beats to ship data directly from the honeypots to Logstash and Elasticsearch, however, I've found … --- ## [How to install and configure multiple filebeat in linux instance](https://discuss.elastic.co/t/how-to-install-and-configure-multiple-filebeat-in-linux-instance/130466)
**Author:** [@senthil\_murugan](https://discuss.elastic.co/u/senthil_murugan)\ **Replies:** 3\ **Last updated:** [May 24, 2018, 6:21am UTC](https://discuss.elastic.co/t/how-to-install-and-configure-multiple-filebeat-in-linux-instance/130466 "2018-05-24T06:21:51Z")
I have already installed one filebeat and it is working fine. I need to create multiple filebeat in the linux instances. How to start and stop the filebeat if we install multiple filebeat instances? How to differentiat… --- ## [Sending logs from filebeat to redis and then logstash](https://discuss.elastic.co/t/sending-logs-from-filebeat-to-redis-and-then-logstash/132718)
**Author:** [@remo](https://discuss.elastic.co/u/remo)\ **Replies:** 9\ **Last updated:** [May 24, 2018, 9:34am UTC](https://discuss.elastic.co/t/sending-logs-from-filebeat-to-redis-and-then-logstash/132718 "2018-05-24T09:34:56Z")
I am trying to send my logs from filebeat into redis and then from redis into logstash and elasticsearch. My log file is in json format. What configuration is to be made in my filebeat.yml so that the output is redis. I… --- ## [Filebeat reading from another Linux server](https://discuss.elastic.co/t/filebeat-reading-from-another-linux-server/133084)
**Author:** [@solo](https://discuss.elastic.co/u/solo)\ **Replies:** 1\ **Last updated:** [May 24, 2018, 7:30am UTC](https://discuss.elastic.co/t/filebeat-reading-from-another-linux-server/133084 "2018-05-24T07:30:03Z")
Hi, I have three Red Hat Linux servers. I only have admin access at one of them and that is the one running Filebeat, Logstash, Elasticsearch and Kibana. My other two servers are have a log file each that I somehow nee… --- ## [Filebeat error when trying to send logs from filebeat to logstash](https://discuss.elastic.co/t/filebeat-error-when-trying-to-send-logs-from-filebeat-to-logstash/132992)
**Author:** [@remo](https://discuss.elastic.co/u/remo)\ **Replies:** 3\ **Last updated:** [May 24, 2018, 5:27am UTC](https://discuss.elastic.co/t/filebeat-error-when-trying-to-send-logs-from-filebeat-to-logstash/132992 "2018-05-24T05:27:06Z")
I am getting this error when I am trying to send logs from filebeat to logstash. Failed to connect: dial tcp 127.0.0.1:5044: connectex: No connection could be made because the target machine actively refused it. Please… --- ## [Can we have multiple output.logstash in filebeat.yml](https://discuss.elastic.co/t/can-we-have-multiple-output-logstash-in-filebeat-yml/132977)
**Author:** [@sksingh888888](https://discuss.elastic.co/u/sksingh888888)\ **Replies:** 4\ **Last updated:** [May 23, 2018, 10:55am UTC](https://discuss.elastic.co/t/can-we-have-multiple-output-logstash-in-filebeat-yml/132977 "2018-05-23T10:55:44Z")
Hi, I have a logging system, where I have configured filebeat with one output.logstash:, now I want to add another logstash. Is it possible to do that ? Something like: output.logstash: hosts: \["10.0.2.4:5051"\] host… --- ## [Logstash does not receive logs from Filebeat on another machine](https://discuss.elastic.co/t/logstash-does-not-receive-logs-from-filebeat-on-another-machine/132951)
**Author:** [@koko191](https://discuss.elastic.co/u/koko191)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 9:18am UTC](https://discuss.elastic.co/t/logstash-does-not-receive-logs-from-filebeat-on-another-machine/132951 "2018-05-23T09:18:19Z")
This is a dummy setup for me to play with the Elastic stack before getting into the production environment. My setup: I'm running two Ubuntu 16.04 VMs using VirtualBox. These two instances have been configured to commu… --- ## [Ctrl+C does not stop immediately](https://discuss.elastic.co/t/ctrl-c-does-not-stop-immediately/131562)
**Author:** [@Sundar\_V](https://discuss.elastic.co/u/Sundar_V)\ **Replies:** 3\ **Last updated:** [May 23, 2018, 8:19am UTC](https://discuss.elastic.co/t/ctrl-c-does-not-stop-immediately/131562 "2018-05-23T08:19:59Z")
Hello, I'm running metricbeats and pressing Ctrl+C stops immediately when I'm not running any modules other than system. However, when I'm running other modules such as redis, mysql etc, pressing Ctrl+C does not stop im… --- ## [Filebeat Aggregate & LoadBalance](https://discuss.elastic.co/t/filebeat-aggregate-loadbalance/132260)
**Author:** [@manuelk](https://discuss.elastic.co/u/manuelk)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 7:51am UTC](https://discuss.elastic.co/t/filebeat-aggregate-loadbalance/132260 "2018-05-23T07:51:11Z")
Hello, we try to do some simple kind of fail over for Logstash so we setup a second instance and now we activated the loadbalance on filebeat. We also have some pipelines where we´re using aggregate and relying on previ… --- ## [Metricbeat - system.process.cpu.total.ticks Help](https://discuss.elastic.co/t/metricbeat-system-process-cpu-total-ticks-help/132389)
**Author:** [@suman\_tripuraneni](https://discuss.elastic.co/u/suman_tripuraneni)\ **Replies:** 3\ **Last updated:** [May 22, 2018, 4:25pm UTC](https://discuss.elastic.co/t/metricbeat-system-process-cpu-total-ticks-help/132389 "2018-05-22T16:25:20Z")
Hi, I am working on the metricbeat to gather the sys & process info. The particular field -"system.process.cpu.total.ticks" , I am interested in this as, I need to create report by CPU time spent by the process. I trie… --- ## [Filebeats in kubernetes - how to export specific log file in a pod to logstash?](https://discuss.elastic.co/t/filebeats-in-kubernetes-how-to-export-specific-log-file-in-a-pod-to-logstash/132827)
**Author:** [@sivakr](https://discuss.elastic.co/u/sivakr)\ **Replies:** 1\ **Last updated:** [May 22, 2018, 3:05pm UTC](https://discuss.elastic.co/t/filebeats-in-kubernetes-how-to-export-specific-log-file-in-a-pod-to-logstash/132827 "2018-05-22T15:05:58Z")
I have few pods with label app1 I want to send some log files of those specific pods with custom tags to logstash. Ex: /tmp/\*.log of all pods with label: app1 should be sent to logstash with tag envoy-access-log I hav… --- ## [Oddness with decode\_json\_fields and json.keys\_under\_root](https://discuss.elastic.co/t/oddness-with-decode-json-fields-and-json-keys-under-root/132825)
**Author:** [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)\ **Replies:** 1\ **Last updated:** [May 22, 2018, 2:36pm UTC](https://discuss.elastic.co/t/oddness-with-decode-json-fields-and-json-keys-under-root/132825 "2018-05-22T14:36:57Z")
Given the following configuration: filebeat.prospectors: - type: docker containers.ids: - ea97d09738e4bdf7b41cb926ab1276110ed3ce93f73f005d4f5da540ef0928c1 processors: - add\_docker\_metadata: ~ - decode\_json\_f… --- ## [Beats fields.yml and multi-fields](https://discuss.elastic.co/t/beats-fields-yml-and-multi-fields/132277)
**Author:** [@Sirk\_Johannsen](https://discuss.elastic.co/u/Sirk_Johannsen)\ **Replies:** 5\ **Last updated:** [May 22, 2018, 1:28pm UTC](https://discuss.elastic.co/t/beats-fields-yml-and-multi-fields/132277 "2018-05-22T13:28:39Z")
Hello, I really appreciate the great work on the beats. But the documentation for the new fields.yml is just awful or plainly missing :wink: Can someone explain to me how to achieve multi-field mapping as described he… --- ## [How to drop some fields with mysql module using filebeat](https://discuss.elastic.co/t/how-to-drop-some-fields-with-mysql-module-using-filebeat/131861)
**Author:** [@pcleon](https://discuss.elastic.co/u/pcleon)\ **Replies:** 6\ **Last updated:** [May 22, 2018, 12:30pm UTC](https://discuss.elastic.co/t/how-to-drop-some-fields-with-mysql-module-using-filebeat/131861 "2018-05-22T12:30:43Z")
i want to drop some fields in filebeat.yml when load mysql module, just like mysql.slowlog.id, but it doesn't affect when i use processors: - include\_fields: fields: \["mysql.slow"\] - drop\_fields: fields: \["mysq… --- ## [Hide\_keywords does not seem to be working](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 2\ **Last updated:** [May 22, 2018, 11:37am UTC](https://discuss.elastic.co/t/hide-keywords-does-not-seem-to-be-working/132595 "2018-05-22T11:37:58Z")
Packetbeat 6.2.4 packetbeat.yml http settings: type: http ports: \[80, 8080, 8000, 5000, 8002\] hide\_keywords: \["pass", "password", "passwd", "pwd"\] send\_headers: \["from", "host", "code", "link", "server", "x-pingbac… --- ## [File beat cant present my application log](https://discuss.elastic.co/t/file-beat-cant-present-my-application-log/132251)
**Author:** [@Dimas\_Djs](https://discuss.elastic.co/u/Dimas_Djs)\ **Replies:** 4\ **Last updated:** [May 18, 2018, 3:35am UTC](https://discuss.elastic.co/t/file-beat-cant-present-my-application-log/132251 "2018-05-18T03:35:17Z")
Hallo everyone, i just enabled filebeat.prospector from filebeat.yml to add my application path log, so filebeat can crawl from my application log, and be prensented in kibana. But when i have finished add my application… --- ## [Unknown state \<73\> for process with pid 22006](https://discuss.elastic.co/t/unknown-state-73-for-process-with-pid-22006/132604)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 3\ **Last updated:** [May 22, 2018, 11:01am UTC](https://discuss.elastic.co/t/unknown-state-73-for-process-with-pid-22006/132604 "2018-05-22T11:01:07Z")
This relates to https://github.com/elastic/beats/issues/6305 from what I can see. Running 6.2.4 with the docker and system modules enabled. From the verbose log to console; |2018-05-21T06:44:53.832+1000|INFO|template/l… --- ## [No connection from Filebeat to Logstash](https://discuss.elastic.co/t/no-connection-from-filebeat-to-logstash/132739)
**Author:** [@kyuubi](https://discuss.elastic.co/u/kyuubi)\ **Replies:** 1\ **Last updated:** [May 22, 2018, 8:55am UTC](https://discuss.elastic.co/t/no-connection-from-filebeat-to-logstash/132739 "2018-05-22T08:55:00Z")
SOLUTION FOUND In my 01-beats-input.conf in /etc/logstash/conf.d I did write localhost instead of the IP followed by the port 9200 [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=448) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=450)