# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=451 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 452 --- ## [Winlogbeat Nginx Proxy to Logstash - Connection Reset](https://discuss.elastic.co/t/winlogbeat-nginx-proxy-to-logstash-connection-reset/131967)
**Author:** [@douglas](https://discuss.elastic.co/u/douglas)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 2:46pm UTC](https://discuss.elastic.co/t/winlogbeat-nginx-proxy-to-logstash-connection-reset/131967 "2018-05-16T14:46:44Z")
Hello, I have the following setup: \[Nginx Port 80\] Forwards to \[Logstash Port 5044\] Directly connects and speaks with \[Elasticsearch Port 9200\] This works with Metricbeat fine, all requests and conversations happe… --- ## [Filebeat memory leak suddenly after all the files consumed](https://discuss.elastic.co/t/filebeat-memory-leak-suddenly-after-all-the-files-consumed/131831)
**Author:** [@guanghaofan](https://discuss.elastic.co/u/guanghaofan)\ **Replies:** 4\ **Last updated:** [May 16, 2018, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-memory-leak-suddenly-after-all-the-files-consumed/131831 "2018-05-16T13:56:10Z")
I use filebeat to ship data to elasticsearch, there are over 100 files to consume. my setting for harvesters are as below. close the harvester immediately after the EOF, and harvester\_limit is 2. it works fine but the … --- ## [Having issues setting up MetricBeat with cloud](https://discuss.elastic.co/t/having-issues-setting-up-metricbeat-with-cloud/132114)
**Author:** [@stunthamster](https://discuss.elastic.co/u/stunthamster)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 1:00pm UTC](https://discuss.elastic.co/t/having-issues-setting-up-metricbeat-with-cloud/132114 "2018-05-16T13:00:18Z")
Hi Folks; I'm trying to deploy Metricbeats onto a Windows host - this will then talk to our ElasticCloud account. Right now my elastic.yml looks like this: metricbeat.config.modules: path: ${path.config}/modules.d/\*.… --- ## [KUBERNETES Log Reading using File Beat](https://discuss.elastic.co/t/kubernetes-log-reading-using-file-beat/131951)
**Author:** [@Venkatesh\_Radhakrish](https://discuss.elastic.co/u/Venkatesh_Radhakrish)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 12:24pm UTC](https://discuss.elastic.co/t/kubernetes-log-reading-using-file-beat/131951 "2018-05-16T12:24:13Z")
Hi - I am using following configuration in filebeat to read docker container logs. kubernetes is used for docker clustering. filebeat.autodiscover: providers: - type: kubernetes templates: - condition: equals: kub… --- ## [Metricbeat Modules In Beta](https://discuss.elastic.co/t/metricbeat-modules-in-beta/131965)
**Author:** [@gurdipe](https://discuss.elastic.co/u/gurdipe)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 12:14pm UTC](https://discuss.elastic.co/t/metricbeat-modules-in-beta/131965 "2018-05-16T12:14:27Z")
Hi We are using Metricbeat version 6.2.4 and looking at the documentation (https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-modules.html) it says that a number of the modules Ceph, Couhbase etc are in … --- ## ["docker" or "log" input/prospector for Docker JSON logs?](https://discuss.elastic.co/t/docker-or-log-input-prospector-for-docker-json-logs/131339)
**Author:** [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)\ **Replies:** 5\ **Last updated:** [May 16, 2018, 12:12pm UTC](https://discuss.elastic.co/t/docker-or-log-input-prospector-for-docker-json-logs/131339 "2018-05-16T12:12:29Z")
We currently use the "logs" prospector to collect JSON logs that Docker outputs. I just recently noticed there is now a native "docker" input \[1\]. What are the benefits of using this over the "logs" prospector? \[1\] ht… --- ## [Sample Dashboards](https://discuss.elastic.co/t/sample-dashboards/131893)
**Author:** [@Invictus](https://discuss.elastic.co/u/Invictus)\ **Replies:** 2\ **Last updated:** [May 16, 2018, 11:00am UTC](https://discuss.elastic.co/t/sample-dashboards/131893 "2018-05-16T11:00:04Z")
Hi members, I was playing around with the sample dashboards that come with the Beats. So I set up the metricbeat dashboard for Docker which was pretty good, after some additions. I also load the filebeat dashboards, b… --- ## [Filebeat, Ingest and ES index name pattern](https://discuss.elastic.co/t/filebeat-ingest-and-es-index-name-pattern/132060)
**Author:** [@atze](https://discuss.elastic.co/u/atze)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 9:03am UTC](https://discuss.elastic.co/t/filebeat-ingest-and-es-index-name-pattern/132060 "2018-05-16T09:03:44Z")
Hi, I've have filebeat setup to ship logs to elasticsearch and the logs are then parsed by a ingest pipeline. Now in filebeat i have a index pattern defined like this: output.elasticsearch: hosts: - localhost:920… --- ## [Filebeat with JSON, set root key](https://discuss.elastic.co/t/filebeat-with-json-set-root-key/131734)
**Author:** [@atze](https://discuss.elastic.co/u/atze)\ **Replies:** 2\ **Last updated:** [May 16, 2018, 8:19am UTC](https://discuss.elastic.co/t/filebeat-with-json-set-root-key/131734 "2018-05-16T08:19:18Z")
Hi, If you parse a JSON with filebeat and send it in elasticsearch, all root keys from the original json document will have the prefix json.\. For example {"status":400} -\> {"json" : { "status" : 400}} Righ… --- ## [Filebeat greater than max file size](https://discuss.elastic.co/t/filebeat-greater-than-max-file-size/129777)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 1\ **Last updated:** [May 16, 2018, 7:02am UTC](https://discuss.elastic.co/t/filebeat-greater-than-max-file-size/129777 "2018-05-16T07:02:43Z")
Hallo, we have an issue with our filebeat on some servers. I've added the configuration and the logs. What can I do to solve this issue? I found nothing with google. filebeat.config.modules: path: ${path.config}/mod… --- ## [Filebeat Mysql Module dashboard - No results found](https://discuss.elastic.co/t/filebeat-mysql-module-dashboard-no-results-found/131749)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 5\ **Last updated:** [May 16, 2018, 6:42am UTC](https://discuss.elastic.co/t/filebeat-mysql-module-dashboard-no-results-found/131749 "2018-05-16T06:42:26Z")
Hi, I installed Filebeat 6.2 and enabled Mysql module to monitor our MariaDB / Mysql server. I configured filebeat.yml and mysql.yml as following: filebeat.yml filebeat.prospectors: - type: log fields.logtype: "Mar… --- ## [LogPathMatcher cannot work correctly because of the os specified char "/"](https://discuss.elastic.co/t/logpathmatcher-cannot-work-correctly-because-of-the-os-specified-char/131409)
**Author:** [@kaku\_li](https://discuss.elastic.co/u/kaku_li)\ **Replies:** 2\ **Last updated:** [May 16, 2018, 1:58am UTC](https://discuss.elastic.co/t/logpathmatcher-cannot-work-correctly-because-of-the-os-specified-char/131409 "2018-05-16T01:58:49Z")
file: https://github.com/elastic/beats/blob/a6e232f633480603d7a7e99773841bdc4fa64a62/filebeat/processor/add\_kubernetes\_metadata/matchers.go line: 42 code: if logPath\[len(logPath)-1:\] != "/" { logPath = logPath + "/"… --- ## [Auditbeat conf.d files](https://discuss.elastic.co/t/auditbeat-conf-d-files/130661)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 8\ **Last updated:** [May 16, 2018, 12:24am UTC](https://discuss.elastic.co/t/auditbeat-conf-d-files/130661 "2018-05-16T00:24:21Z")
Auditbeat isn't loading all config files from conf.d, it appears as if the conf files are stomping over each other according to the auditbeat log where the rule count from file 1 is first added and then later deleted whe… --- ## [Metricbeat doesn't show results](https://discuss.elastic.co/t/metricbeat-doesnt-show-results/131231)
**Author:** [@Fernando\_Ramirez](https://discuss.elastic.co/u/Fernando_Ramirez)\ **Replies:** 2\ **Last updated:** [May 15, 2018, 4:32pm UTC](https://discuss.elastic.co/t/metricbeat-doesnt-show-results/131231 "2018-05-15T16:32:40Z")
Hi everybody: I need your help , please I have the follow configuration in my server: JDK 8.0 Kibana 5.6 Elasticsearch 5.6 Logstash 5.6 Metricbeat 5.6 When I try assign as default index management doesn't appaer … --- ## [Filebeat didn't parse log file](https://discuss.elastic.co/t/filebeat-didnt-parse-log-file/127062)
**Author:** [@Slop](https://discuss.elastic.co/u/Slop)\ **Replies:** 21\ **Last updated:** [May 15, 2018, 1:32pm UTC](https://discuss.elastic.co/t/filebeat-didnt-parse-log-file/127062 "2018-05-15T13:32:16Z")
I've created new log files recently, but I didn't succeed to having them harvest by filebeat. Currently filebeat haverst two tomcat log files. Here's my filebeat.yml : - input\_type: log # Paths that should be crawl… --- ## [Filebeat flooding logstash](https://discuss.elastic.co/t/filebeat-flooding-logstash/131824)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 1\ **Last updated:** [May 15, 2018, 1:18pm UTC](https://discuss.elastic.co/t/filebeat-flooding-logstash/131824 "2018-05-15T13:18:36Z")
Filebeat and logstash 6.2 I have 18k+ devices with filebeat sending to logstash. My logstash is in AWS and is fronted with a classic ELB. I terminate ssl on the ELB and forward to the correct part for logstash. I had a… --- ## [Harvester error](https://discuss.elastic.co/t/harvester-error/131883)
**Author:** [@samoz83](https://discuss.elastic.co/u/samoz83)\ **Replies:** 1\ **Last updated:** [May 15, 2018, 1:09pm UTC](https://discuss.elastic.co/t/harvester-error/131883 "2018-05-15T13:09:44Z")
I keep getting a filebeat error ERROR harvester/registry.go:83 Error running prospector: error receiving slowlog data: dial tcp \[::1\]:6379: getsockopt: connection refused Not sure what's causing it? --- ## [Combining metricbeat and winlogbeat](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 9\ **Last updated:** [May 15, 2018, 11:59am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177 "2018-05-15T11:59:41Z")
Is it possible to save winlogbeat output and metricbeat output to same index in elasticsearch ? if yes, what do i need to do for that ? --- ## [Insert Hostname in Filebeat Logfile](https://discuss.elastic.co/t/insert-hostname-in-filebeat-logfile/131746)
**Author:** [@joltmann](https://discuss.elastic.co/u/joltmann)\ **Replies:** 4\ **Last updated:** [May 15, 2018, 7:44am UTC](https://discuss.elastic.co/t/insert-hostname-in-filebeat-logfile/131746 "2018-05-15T07:44:17Z")
Hi, I have on several Servers filebeat running. All Servers logs the the Loginformation for Filebeat under /var/log/filebeat/filebeat.log. Now I need to transfer the Logs vi nxlog to our Logserver. So I need an informa… --- ## [Syslog type](https://discuss.elastic.co/t/syslog-type/130768)
**Author:** [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Replies:** 8\ **Last updated:** [May 15, 2018, 5:19am UTC](https://discuss.elastic.co/t/syslog-type/130768 "2018-05-15T05:19:48Z")
Hi, From the newest version of filebeat the syslog type has been removed. If I compare the log from logstash as syslog format to the filebeat log format the following things are missing from the log which is obvious be… --- ## [Beat.hostname & beat.name values](https://discuss.elastic.co/t/beat-hostname-beat-name-values/130925)
**Author:** [@ecc256](https://discuss.elastic.co/u/ecc256)\ **Replies:** 6\ **Last updated:** [May 14, 2018, 5:42pm UTC](https://discuss.elastic.co/t/beat-hostname-beat-name-values/130925 "2018-05-14T17:42:23Z")
Elastic search shows events posted by my beat with following values in beat.\* fields: beat.hostname hostname beat.name hostname beat.version 7.0.0-alpha1 I guess, this is due to beat.go code. What would be the easie… --- ## [=\> Timelion: Error: in cell #1: Elasticsearch index not found: metricbeat-\*](https://discuss.elastic.co/t/timelion-error-in-cell-1-elasticsearch-index-not-found-metricbeat/131697)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 2\ **Last updated:** [May 14, 2018, 3:07pm UTC](https://discuss.elastic.co/t/timelion-error-in-cell-1-elasticsearch-index-not-found-metricbeat/131697 "2018-05-14T15:07:35Z")
Hi, I wanted to use Timelion but I have this error : Timelion: Error: in cell #1: Elasticsearch index not found: metricbeat-\* How could I resolve it ? I install metricbeat et did this : metricbeat setup --template -… --- ## [Large number of duplicate events, all grouped in a single timestamp](https://discuss.elastic.co/t/large-number-of-duplicate-events-all-grouped-in-a-single-timestamp/131688)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 2\ **Last updated:** [May 14, 2018, 12:56pm UTC](https://discuss.elastic.co/t/large-number-of-duplicate-events-all-grouped-in-a-single-timestamp/131688 "2018-05-14T12:56:51Z")
We use Filebeat to gather a wide type of logs, and we observe a strange behaviour: Kibana shows that all logs are gathered in a single instant, every couple of days. For instance, we have 130'000 events in the Nginx htt… --- ## [Tomcat HTTP requests are not showing by PACKETBEAT](https://discuss.elastic.co/t/tomcat-http-requests-are-not-showing-by-packetbeat/131628)
**Author:** [@sercheo87](https://discuss.elastic.co/u/sercheo87)\ **Replies:** 1\ **Last updated:** [May 14, 2018, 10:52am UTC](https://discuss.elastic.co/t/tomcat-http-requests-are-not-showing-by-packetbeat/131628 "2018-05-14T10:52:20Z")
Not loop traffic http request origined by Tomcat server 8.5.30 only view on destination server. packetbeat.interfaces.device: any packetbeat.flows: timeout: 30s period: 10s packetbeat.protocols.dns: ports: \[53\] in… --- ## [Libbeat syntax error logger.go](https://discuss.elastic.co/t/libbeat-syntax-error-logger-go/131704)
**Author:** [@gourmax](https://discuss.elastic.co/u/gourmax)\ **Replies:** 1\ **Last updated:** [May 14, 2018, 10:38am UTC](https://discuss.elastic.co/t/libbeat-syntax-error-logger-go/131704 "2018-05-14T10:38:45Z")
I'm trying to install a package from beat community but I encounter a syntax error in some file from the github folder of elastic. According to example on the elastic page, I cloned the elastic/beats directory. I try t… --- ## [Problems with bad authentification logs on windows](https://discuss.elastic.co/t/problems-with-bad-authentification-logs-on-windows/131156)
**Author:** [@hash-ill](https://discuss.elastic.co/u/hash-ill)\ **Replies:** 6\ **Last updated:** [May 14, 2018, 10:13am UTC](https://discuss.elastic.co/t/problems-with-bad-authentification-logs-on-windows/131156 "2018-05-14T10:13:35Z")
Hi everybody, I'm new here and i have few questions. First, I install ELK with X-pack and I have some problem: My authentifications fails does not appears on my discover menu in kibana. When I fail authentification, t… --- ## [Multiline Java exceptions are set as non-existent](https://discuss.elastic.co/t/multiline-java-exceptions-are-set-as-non-existent/131686)
**Author:** [@AndresPineros](https://discuss.elastic.co/u/AndresPineros)\ **Replies:** 2\ **Last updated:** [May 14, 2018, 8:58am UTC](https://discuss.elastic.co/t/multiline-java-exceptions-are-set-as-non-existent/131686 "2018-05-14T08:58:57Z")
I'm very new to ELK and I don't understand much of the internals , so I'm not sure if this is actually an issue with Kibana or Filebeat. My setup is Filebeat -\> Elastic -\> Kibana v 6.2.2. Whenever the "log" field of a … --- ## [Metricbeat: Not able to display the data in dashboard](https://discuss.elastic.co/t/metricbeat-not-able-to-display-the-data-in-dashboard/131470)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 3\ **Last updated:** [May 14, 2018, 5:01am UTC](https://discuss.elastic.co/t/metricbeat-not-able-to-display-the-data-in-dashboard/131470 "2018-05-14T05:01:09Z")
Hello Team on the Immediate requirement, I've installed metricbeat. I followed the getting started guide. Everything was fine but I'm not able to visualise the data in the dashboard. you can see below Metricbeat.ym… --- ## [Metricbeat next to filebeat to same elasticsearch](https://discuss.elastic.co/t/metricbeat-next-to-filebeat-to-same-elasticsearch/131514)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 1\ **Last updated:** [May 13, 2018, 11:31am UTC](https://discuss.elastic.co/t/metricbeat-next-to-filebeat-to-same-elasticsearch/131514 "2018-05-13T11:31:43Z")
Hi, At some of my servers I am trying to setup metricbeat alongside filebeat . I configured metricbeat on my kibanaserver and elasticsearchserver to go to elasticsearch directly. However these application servers are be… --- ## [Audit Beat - Log to a file](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597)
**Author:** [@daniel333](https://discuss.elastic.co/u/daniel333)\ **Replies:** 2\ **Last updated:** [May 13, 2018, 4:54am UTC](https://discuss.elastic.co/t/audit-beat-log-to-a-file/131597 "2018-05-13T04:54:42Z")
All, First time working with anything from Elastic and I was starting with Auditbeat. I install the package and the default configuration works. But if I want to log to a file to test the FIM, auditbeats failes to start… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=450) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=452)