# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=452 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 453 --- ## [System logs with ISO8601 timestamps](https://discuss.elastic.co/t/system-logs-with-iso8601-timestamps/131094)
**Author:** [@Dave\_H](https://discuss.elastic.co/u/Dave_H)\ **Replies:** 6\ **Last updated:** [May 12, 2018, 3:31am UTC](https://discuss.elastic.co/t/system-logs-with-iso8601-timestamps/131094 "2018-05-12T03:31:36Z")
when using ISO8601 timestamps with filebeat, I am getting this error: Provided Grok expressions do not match field value: \[2018-05-08T22:50:15.322108-05:00 webhost sshd\[24868\]: Failed password for root from XX.7.26.60 p… --- ## [Best practice for Logging with Filebeat](https://discuss.elastic.co/t/best-practice-for-logging-with-filebeat/131479)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 4\ **Last updated:** [May 11, 2018, 2:10pm UTC](https://discuss.elastic.co/t/best-practice-for-logging-with-filebeat/131479 "2018-05-11T14:10:55Z")
Hi all, I am right now planning a completely new monitoring and logging environment. One part of this belongs to the beats, especially filebeat. I kindly want to know, what the best practices are here right now (ELK 6.… --- ## [For Apache Tomcat Performance Monitoring](https://discuss.elastic.co/t/for-apache-tomcat-performance-monitoring/130473)
**Author:** [@S\_Patel](https://discuss.elastic.co/u/S_Patel)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 1:28pm UTC](https://discuss.elastic.co/t/for-apache-tomcat-performance-monitoring/130473 "2018-05-11T13:28:24Z")
Is there any beats available for Apache Tomcat ? Or Is there any other way for it? Please guide me for it. I need to monitor like, currently running java threads, etc... --- ## [Filebeat.autodiscover for docker container logs](https://discuss.elastic.co/t/filebeat-autodiscover-for-docker-container-logs/131459)
**Author:** [@Venkatesh\_Radhakrish](https://discuss.elastic.co/u/Venkatesh_Radhakrish)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 11:00am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-for-docker-container-logs/131459 "2018-05-11T11:00:41Z")
Hi - How to configure file beat yml to read logs of all docker containers? Below is the configuration i am using now (Working perfectly fine) which i feel is not clean way of coding. filebeat.autodiscover: List of ena… --- ## [Filebeat.yml include\_lines and decode\_json can't work together](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385)
**Author:** [@Qing](https://discuss.elastic.co/u/Qing)\ **Replies:** 3\ **Last updated:** [May 11, 2018, 8:18am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131385 "2018-05-11T08:18:34Z")
Hi Can anyone help me ? I meet problem, error info: Exiting: Error in initing prospector: When using the JSON decoder and line filtering together, you need to specify a message\_key value accessing 'filebeat.prospector… --- ## [Index pattern missing indices error](https://discuss.elastic.co/t/index-pattern-missing-indices-error/131136)
**Author:** [@nik9](https://discuss.elastic.co/u/nik9)\ **Replies:** 3\ **Last updated:** [May 11, 2018, 8:02am UTC](https://discuss.elastic.co/t/index-pattern-missing-indices-error/131136 "2018-05-11T08:02:53Z")
Hi to all, I am trying to install ELK stack on my qa environment. But after successful installation of Elasticsearch, Kibana, Logstash. And filebeat on client. I am facing the below error on kiaban. No matching indice… --- ## [Filebeat include\_lines and decode\_json can't work](https://discuss.elastic.co/t/filebeat-include-lines-and-decode-json-cant-work/131383)
**Author:** [@Qing](https://discuss.elastic.co/u/Qing)\ **Replies:** 2\ **Last updated:** [May 11, 2018, 7:44am UTC](https://discuss.elastic.co/t/filebeat-include-lines-and-decode-json-cant-work/131383 "2018-05-11T07:44:53Z")
Hi I meet problem: "Exiting: Error in initing prospector: When using the JSON decoder and line filtering together, you need to specify a message\_key value accessing 'filebeat.prospectors.0' (source:'filebeat.yml') Exi… --- ## [Filebeat.yml include\_lines and decode\_json can't work together](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131388)
**Author:** [@Qing](https://discuss.elastic.co/u/Qing)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 7:07am UTC](https://discuss.elastic.co/t/filebeat-yml-include-lines-and-decode-json-cant-work-together/131388 "2018-05-11T07:07:18Z")
Hi: Can anyone help me ? I meet problem using filebeat, error message: Exiting: Error in initing prospector: When using the JSON decoder and line filtering together, you need to specify a message\_key value accessing '… --- ## [Filebeat-6.2.4 no send finish in time](https://discuss.elastic.co/t/filebeat-6-2-4-no-send-finish-in-time/131404)
**Author:** [@charliecen](https://discuss.elastic.co/u/charliecen)\ **Replies:** 1\ **Last updated:** [May 11, 2018, 6:25am UTC](https://discuss.elastic.co/t/filebeat-6-2-4-no-send-finish-in-time/131404 "2018-05-11T06:25:03Z")
Problem description： More than 2000 files are generated per hour in the multi-level directory， I only need to log in an hour, so I'm configuration ignore\_older: 1 h, but after an hour, which is 1 hour before the file is … --- ## [Kibana Dashboards: The request for this panel failed](https://discuss.elastic.co/t/kibana-dashboards-the-request-for-this-panel-failed/130838)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 4\ **Last updated:** [May 10, 2018, 4:23pm UTC](https://discuss.elastic.co/t/kibana-dashboards-the-request-for-this-panel-failed/130838 "2018-05-10T16:23:18Z")
Elastic Stack 6.2.4. I get this error while loading metricbeat dashboards: \[image\] \[image\] --- ## [Filebeat 6.2.4 not processing JSON log and not submitting to Logstsash](https://discuss.elastic.co/t/filebeat-6-2-4-not-processing-json-log-and-not-submitting-to-logstsash/130715)
**Author:** [@pbala2018](https://discuss.elastic.co/u/pbala2018)\ **Replies:** 2\ **Last updated:** [May 10, 2018, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-6-2-4-not-processing-json-log-and-not-submitting-to-logstsash/130715 "2018-05-10T14:00:22Z")
Hi, I am trying to process a simple JSON file into Logstash but i see the logstash which is listening at port 5045 is not receiving any data from filebeat. Here is my filebeat and logstash config #====================… --- ## [Filebeat high cpu load on Win 2012 R2](https://discuss.elastic.co/t/filebeat-high-cpu-load-on-win-2012-r2/130972)
**Author:** [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Replies:** 3\ **Last updated:** [May 10, 2018, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-load-on-win-2012-r2/130972 "2018-05-10T13:40:31Z")
Hi, I'm getting 30 percent load from Filebeat's process alone. The logs folder has about 1500 files as large as 4MB each. I tried adding the following the YML config: harvester\_limit: 1 close\_inactive: 1m scan\_freq… --- ## [Can we modify the way Metricbeat Claculates the System metric fighures](https://discuss.elastic.co/t/can-we-modify-the-way-metricbeat-claculates-the-system-metric-fighures/130951)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 5\ **Last updated:** [May 10, 2018, 1:32pm UTC](https://discuss.elastic.co/t/can-we-modify-the-way-metricbeat-claculates-the-system-metric-fighures/130951 "2018-05-10T13:32:09Z")
Hi, I have configured MB on linux machine to read system metric. However figures are different that the commands? When I say free -m on command line, t gives different figures than that of metricbeat. How to validate… --- ## [Using filebeat to trigger a python code](https://discuss.elastic.co/t/using-filebeat-to-trigger-a-python-code/131107)
**Author:** [@ashay.dhavale](https://discuss.elastic.co/u/ashay.dhavale)\ **Replies:** 4\ **Last updated:** [May 10, 2018, 12:37pm UTC](https://discuss.elastic.co/t/using-filebeat-to-trigger-a-python-code/131107 "2018-05-10T12:37:15Z")
Hi Can i use filebeat to monitor a directory and trigger a python code as soon as a new file is received in that directory? What changes do i need and where. --- ## [Winlogbeat does not send logs to Logstash](https://discuss.elastic.co/t/winlogbeat-does-not-send-logs-to-logstash/131128)
**Author:** [@student](https://discuss.elastic.co/u/student)\ **Replies:** 3\ **Last updated:** [May 10, 2018, 7:42am UTC](https://discuss.elastic.co/t/winlogbeat-does-not-send-logs-to-logstash/131128 "2018-05-10T07:42:57Z")
Hi I've recently been trying to make it so Winlogbeat sends it's logs to Logstash but nothing is happening. Then I tried to send logs directly to Elasticsearch and it works. I don't know what the problem is. I've check… --- ## [Filter :Active Directory Event](https://discuss.elastic.co/t/filter-active-directory-event/130796)
**Author:** [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Replies:** 7\ **Last updated:** [May 10, 2018, 9:56am UTC](https://discuss.elastic.co/t/filter-active-directory-event/130796 "2018-05-10T09:56:03Z")
Hello, Please how can I create a filter AD event on winlogbeat ?(security,application,system) I add some event id on each section but it doesn't work. Thank You. what I have written on winlogbeat.yml: Security:463… --- ## [Packetbeat HL7 v2 protocol](https://discuss.elastic.co/t/packetbeat-hl7-v2-protocol/131263)
**Author:** [@stevea78](https://discuss.elastic.co/u/stevea78)\ **Replies:** 0\ **Last updated:** [May 10, 2018, 7:31am UTC](https://discuss.elastic.co/t/packetbeat-hl7-v2-protocol/131263 "2018-05-10T07:31:26Z")
Just letting you know I've started on an HL7 (version 2) protocol for Packetbeat that you can find below. Any questions/suggestions etc are welcome. --- ## [Filebeat parse json](https://discuss.elastic.co/t/filebeat-parse-json/130834)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 7\ **Last updated:** [May 10, 2018, 6:47am UTC](https://discuss.elastic.co/t/filebeat-parse-json/130834 "2018-05-10T06:47:12Z")
Filebeat 6.2.1 I don't think filebeat is seeing my json document inside of an array \[\]. This causes json parse failures. Is there something I should be doing different to process this document? Original document: \[{… --- ## [Filebeat not starting as Daemonset](https://discuss.elastic.co/t/filebeat-not-starting-as-daemonset/130904)
**Author:** [@Victor\_Covalski](https://discuss.elastic.co/u/Victor_Covalski)\ **Replies:** 4\ **Last updated:** [May 9, 2018, 7:23pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-as-daemonset/130904 "2018-05-09T19:23:20Z")
Hi, I'm trying to deploy Filebeat to collect logs from my Kubelets using the provided example. Although, my filebeat container is not starting and I'm getting the following error messages May 7 15:26:22 xxx kubelet: … --- ## [Filebeat ingest pipeline grok pattern](https://discuss.elastic.co/t/filebeat-ingest-pipeline-grok-pattern/131168)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 2\ **Last updated:** [May 9, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipeline-grok-pattern/131168 "2018-05-09T13:47:52Z")
in path location /usr/share/filebeat/module/system/syslog/ingest/pipeline.json following pattern code grok pattern is confusing. why the double slash \\\\ comes for \[%{POSINT:system.syslog.pid}\\\] "… --- ## [Auditbeat default dashboards missing required field](https://discuss.elastic.co/t/auditbeat-default-dashboards-missing-required-field/128891)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 9\ **Last updated:** [May 9, 2018, 10:07am UTC](https://discuss.elastic.co/t/auditbeat-default-dashboards-missing-required-field/128891 "2018-05-09T10:07:23Z")
Running Auditbeat 6.2.4 on Redhat connecting to ELK 6.2.2 on Ubuntu. Auditbeat.yml as follows: # You can find the full configuration reference here: # https://www.elastic.co/guide/en/beats/auditbeat/index.html #======… --- ## [Need to understand metricbeat cpu metrics](https://discuss.elastic.co/t/need-to-understand-metricbeat-cpu-metrics/130823)
**Author:** [@SeemaAccenture](https://discuss.elastic.co/u/SeemaAccenture)\ **Replies:** 2\ **Last updated:** [May 9, 2018, 8:57am UTC](https://discuss.elastic.co/t/need-to-understand-metricbeat-cpu-metrics/130823 "2018-05-09T08:57:59Z")
Hi, I have set metricbeat to for CPU and Memory utilization .After running metricbeat conf through logstash this I am getting below kind of data : "system" =\> { "cpu" =\> { "softirq" =\> { "pct" =\> 0 }, "irq" =\> { … --- ## [Filebeat,ERROR pipeline/output.go:74 Failed to connect: diali/o timeout](https://discuss.elastic.co/t/filebeat-error-pipeline-output-go-74-failed-to-connect-diali-o-timeout/130192)
**Author:** [@Rmond](https://discuss.elastic.co/u/Rmond)\ **Replies:** 2\ **Last updated:** [May 9, 2018, 6:51am UTC](https://discuss.elastic.co/t/filebeat-error-pipeline-output-go-74-failed-to-connect-diali-o-timeout/130192 "2018-05-09T06:51:34Z")
when I use hosts: \["192.168.26.130:5046","172.16.26.170:5046","172.16.26.171:5046"\] on logstash output. neither loadbalance: true or false,the filebeat always connect the first ip,and others raise 2018-05-02T14:34:… --- ## [How to sync custom template with Incoming data from Filebeat?](https://discuss.elastic.co/t/how-to-sync-custom-template-with-incoming-data-from-filebeat/130867)
**Author:** [@sukesh\_nagaraja](https://discuss.elastic.co/u/sukesh_nagaraja)\ **Replies:** 2\ **Last updated:** [May 8, 2018, 9:24pm UTC](https://discuss.elastic.co/t/how-to-sync-custom-template-with-incoming-data-from-filebeat/130867 "2018-05-08T21:24:36Z")
Hi , I am trying to index json data to elasticsearch from Filebeat. the data shipped by filebeat is as follows : {"first name":"abc","last name":"efg","age":26,"city":"newyork","country":"USA","zipcode":"10001"} {"fir… --- ## [Winlogbeat service can not start](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926)
**Author:** [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Replies:** 2\ **Last updated:** [May 8, 2018, 9:15pm UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926 "2018-05-08T21:15:31Z")
Hi there, I'm configuring winlogbeat and trying to start it. The first time I installed winlogbeat service, and started it, it worked fine. Well, after several hours, it couldn't start with errors. I uninstalled the serv… --- ## [MetricBeat statements metricset](https://discuss.elastic.co/t/metricbeat-statements-metricset/131055)
**Author:** [@zinefer](https://discuss.elastic.co/u/zinefer)\ **Replies:** 5\ **Last updated:** [May 8, 2018, 8:43pm UTC](https://discuss.elastic.co/t/metricbeat-statements-metricset/131055 "2018-05-08T20:43:43Z")
Is there any reason there is no metricset that relates to pg\_stat\_statements? I've never done GO but I looked at, for example, the activity metricset and I think I might be able to make one for pg\_stat\_statements. Would… --- ## [How to configure Filebeat to send logs over UDP (to Graylog)?](https://discuss.elastic.co/t/how-to-configure-filebeat-to-send-logs-over-udp-to-graylog/130822)
**Author:** [@spam](https://discuss.elastic.co/u/spam)\ **Replies:** 1\ **Last updated:** [May 8, 2018, 8:08pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-send-logs-over-udp-to-graylog/130822 "2018-05-08T20:08:12Z")
How to configure Filebeat to send logs over UDP (to Graylog)? --- ## [From filebeat.template.json to fields.yml](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 4\ **Last updated:** [May 8, 2018, 11:42am UTC](https://discuss.elastic.co/t/from-filebeat-template-json-to-fields-yml/130791 "2018-05-08T11:42:27Z")
Hi, We're about to upgrade filebeat 5.5.2 to filebeat 6.2.2 But then the default index template were changed from .json file to .yml file My question is, how could I put the below json to yml format for us to be able… --- ## [Beats\_input\_raw\_event](https://discuss.elastic.co/t/beats-input-raw-event/130391)
**Author:** [@nabha](https://discuss.elastic.co/u/nabha)\ **Replies:** 6\ **Last updated:** [May 8, 2018, 10:46am UTC](https://discuss.elastic.co/t/beats-input-raw-event/130391 "2018-05-08T10:46:23Z")
I am trying to fetch a .json file through filebeat to send logs to logstash. But it throws an error as " "tags" =\> \[ \[0\] "beats\_input\_raw\_event" \]" My filebeat.yml has following configuration: filebeat.prospectors: … --- ## [Filebeat harvester dont started on files](https://discuss.elastic.co/t/filebeat-harvester-dont-started-on-files/129771)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 4\ **Last updated:** [April 30, 2018, 4:13am UTC](https://discuss.elastic.co/t/filebeat-harvester-dont-started-on-files/129771 "2018-04-30T04:13:24Z")
version:6.2.3 i run a filebeat container ,but no harvester log filebeat.yml filebeat.config.prospectors: enabled: true path: service/\*.yml reload.enabled: true reload.period: 10s output.logstash: # 输出地址 hos… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=451) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=453)