# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=453 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 454 --- ## [Nested JSON](https://discuss.elastic.co/t/nested-json/130314)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 4\ **Last updated:** [May 8, 2018, 9:14am UTC](https://discuss.elastic.co/t/nested-json/130314 "2018-05-08T09:14:42Z")
Filebeat 6.2 I am using filebeat to pick up a file from osquery. The file contains windows events from WEL. Sample data: { "\_index": "win\_osquery-2018.05.02", "\_type": "doc", "\_id": "5xRGImMBm7muvmysFsee", "\_… --- ## [Java multiline with add\_docker\_metadata](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860)
**Author:** [@mimmus](https://discuss.elastic.co/u/mimmus)\ **Replies:** 4\ **Last updated:** [May 8, 2018, 8:45am UTC](https://discuss.elastic.co/t/java-multiline-with-add-docker-metadata/130860 "2018-05-08T08:45:55Z")
We are using this: and now we are trying to configure multiline to fetch Java stacktrace as a single message but any attempt fails. We are pretty sure that patterns used to identify multiline are OK. Is it possible… --- ## [Winlogbeat test config got both error and Config OK](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885)
**Author:** [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Replies:** 3\ **Last updated:** [May 8, 2018, 8:26am UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885 "2018-05-08T08:26:23Z")
I'm installing Winlogbeat on a windows server 2016 DC. When I run winlogbeat test config, it gave both error and Config OK. Is it OK or Error then. winlogbeat.yml file as below winlogbeat.event\_logs: name: Application … --- ## [NGINX harvester finds and loads log files, but no publish output](https://discuss.elastic.co/t/nginx-harvester-finds-and-loads-log-files-but-no-publish-output/130657)
**Author:** [@Steven\_K](https://discuss.elastic.co/u/Steven_K)\ **Replies:** 4\ **Last updated:** [May 8, 2018, 7:55am UTC](https://discuss.elastic.co/t/nginx-harvester-finds-and-loads-log-files-but-no-publish-output/130657 "2018-05-08T07:55:30Z")
I've scoured the internet for the next step, but I'm just stumped. I am unable to get my NGINX logs back to the elastic cloud hosted Kibana instance, I am running Ubuntu and the deb install of Filebeat - No docker, all i… --- ## [Filebeat not parsing json in messages](https://discuss.elastic.co/t/filebeat-not-parsing-json-in-messages/130230)
**Author:** [@utsav2307](https://discuss.elastic.co/u/utsav2307)\ **Replies:** 9\ **Last updated:** [May 8, 2018, 7:33am UTC](https://discuss.elastic.co/t/filebeat-not-parsing-json-in-messages/130230 "2018-05-08T07:33:44Z")
I have deployed filebeat as a daemonset in Kubernetes for collecting logs and below is my filebeat configuration: - type: log paths: - /var/lib/docker/containers/\*/\*.log multiline.pattern: "^\[\[:s… --- ## [How to know my filebeat is collecting the running container logs or not](https://discuss.elastic.co/t/how-to-know-my-filebeat-is-collecting-the-running-container-logs-or-not/129840)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 3\ **Last updated:** [May 7, 2018, 8:18pm UTC](https://discuss.elastic.co/t/how-to-know-my-filebeat-is-collecting-the-running-container-logs-or-not/129840 "2018-05-07T20:18:43Z")
Hi guys, can u tell me my filebeat is collecting the running container logs? here is my filebeat output Attaching to customfilebeat\_filebeat\_1 filebeat\_1 | Initializing Filebeat... filebeat\_1 | 2018/04/27 13:56:59.… --- ## [Metric beat: Kubernetes module runtime error: invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/metric-beat-kubernetes-module-runtime-error-invalid-memory-address-or-nil-pointer-dereference/130813)
**Author:** [@raovaibhav](https://discuss.elastic.co/u/raovaibhav)\ **Replies:** 1\ **Last updated:** [May 7, 2018, 6:22pm UTC](https://discuss.elastic.co/t/metric-beat-kubernetes-module-runtime-error-invalid-memory-address-or-nil-pointer-dereference/130813 "2018-05-07T18:22:45Z")
I am trying to use the kubernetes metricbeat module inorder to monitor pod status with Elastic search and Kibana. However when I run metric beat as docker, I get the below error. Component Image version: docker.elast… --- ## [Why filebeat write disk with fast speed](https://discuss.elastic.co/t/why-filebeat-write-disk-with-fast-speed/130859)
**Author:** [@b21f7f5cb95dbc8034ef](https://discuss.elastic.co/u/b21f7f5cb95dbc8034ef)\ **Replies:** 3\ **Last updated:** [May 7, 2018, 4:07pm UTC](https://discuss.elastic.co/t/why-filebeat-write-disk-with-fast-speed/130859 "2018-05-07T16:07:15Z")
Hi, my filebeat affect my system performance I collect log with filebeat version 6.2.2,and my filebeat.yml below: name: general filebeat.prospectors: - type: log paths: - /logs/log\_ include\_lines: \['\[^A\]\*ANALYZ… --- ## [Getting aggregated view of 100% CPU across all dashboard views for windows server](https://discuss.elastic.co/t/getting-aggregated-view-of-100-cpu-across-all-dashboard-views-for-windows-server/128857)
**Author:** [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Replies:** 4\ **Last updated:** [May 7, 2018, 9:22am UTC](https://discuss.elastic.co/t/getting-aggregated-view-of-100-cpu-across-all-dashboard-views-for-windows-server/128857 "2018-05-07T09:22:59Z")
Hi, We have been trying to achieve a breakdown of the active CPU% distributed between all the active process. Here's an example: If we have 8CPU, we see the total will be 800% and the active process consumption goes abo… --- ## [File --\> kibana](https://discuss.elastic.co/t/file-kibana/130465)
**Author:** [@MrNerd](https://discuss.elastic.co/u/MrNerd)\ **Replies:** 5\ **Last updated:** [May 7, 2018, 7:27am UTC](https://discuss.elastic.co/t/file-kibana/130465 "2018-05-07T07:27:00Z")
It is possible to create multiple index with filebeat and send them deirectly to kibana, if it's possible how? --- ## [NGINX-Filebeat-ELK-Docker-Swarm Help](https://discuss.elastic.co/t/nginx-filebeat-elk-docker-swarm-help/130512)
**Author:** [@JockDaRock](https://discuss.elastic.co/u/JockDaRock)\ **Replies:** 1\ **Last updated:** [May 6, 2018, 6:51pm UTC](https://discuss.elastic.co/t/nginx-filebeat-elk-docker-swarm-help/130512 "2018-05-06T18:51:29Z")
Hello, I am looking to deploy docker swarm services for filebeat and the ELK stack to process NGINX gateway access logs. The architecture would be nginx, filebeat, elasticsearch, kibana, and logstash as seperate service… --- ## [Issue with APM monitoring for docker containers](https://discuss.elastic.co/t/issue-with-apm-monitoring-for-docker-containers/130110)
**Author:** [@calshankar](https://discuss.elastic.co/u/calshankar)\ **Replies:** 4\ **Last updated:** [May 3, 2018, 6:50am UTC](https://discuss.elastic.co/t/issue-with-apm-monitoring-for-docker-containers/130110 "2018-05-03T06:50:41Z")
I was able to successfully setup the EFK stack for docker container on a single host but i'm unable to get the agent from the app to communicate with the APM. I looked into the documentation & added the npm module & init… --- ## [Filebeat harvesting to logstash is not fast enough](https://discuss.elastic.co/t/filebeat-harvesting-to-logstash-is-not-fast-enough/130388)
**Author:** [@Tomer\_Lev1](https://discuss.elastic.co/u/Tomer_Lev1)\ **Replies:** 2\ **Last updated:** [May 6, 2018, 8:46am UTC](https://discuss.elastic.co/t/filebeat-harvesting-to-logstash-is-not-fast-enough/130388 "2018-05-06T08:46:53Z")
Hi All, when harvesting logs from my machines to logstash using filebeat I noticed logs are not delivered fast enough, especially when using TRACE logs and adding more machine (filebeats). My stack is something like ~40… --- ## [Add pod-uid support for add\_kubernetes\_metadata matchers](https://discuss.elastic.co/t/add-pod-uid-support-for-add-kubernetes-metadata-matchers/130665)
**Author:** [@mariomechoulam](https://discuss.elastic.co/u/mariomechoulam)\ **Replies:** 1\ **Last updated:** [May 4, 2018, 9:53pm UTC](https://discuss.elastic.co/t/add-pod-uid-support-for-add-kubernetes-metadata-matchers/130665 "2018-05-04T21:53:43Z")
Hi everyone, I would like to understand if it would be possible to enhance the current add\_kubernetes\_metadata mechanism so that it could fetch the metadata starting from a pod-uid instead. In our current scenario we h… --- ## [Filebeat with new line](https://discuss.elastic.co/t/filebeat-with-new-line/130523)
**Author:** [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\ **Replies:** 3\ **Last updated:** [May 4, 2018, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-with-new-line/130523 "2018-05-04T16:41:01Z")
Hi I have following lines, and I am using filebeat to publish this data to logstash and then trying to extract values. Could you please advise? 2017-09-03 16:01:28,574 85732M0=\>{"DATALIN": { "EVA:": "P", "INTRO": "", … --- ## [Metricbeat module: collect metric only if there is a change](https://discuss.elastic.co/t/metricbeat-module-collect-metric-only-if-there-is-a-change/130608)
**Author:** [@annk](https://discuss.elastic.co/u/annk)\ **Replies:** 1\ **Last updated:** [May 4, 2018, 1:37pm UTC](https://discuss.elastic.co/t/metricbeat-module-collect-metric-only-if-there-is-a-change/130608 "2018-05-04T13:37:20Z")
Hi , I am new to beats , I was wondering if there are any options in metricbeat modules which I can turn on to collect metrics only if there is a change during the interval ? are there any way I can avoid repetitions l… --- ## [Dev environment - testsuite failing on filebeat](https://discuss.elastic.co/t/dev-environment-testsuite-failing-on-filebeat/130265)
**Author:** [@mariomechoulam](https://discuss.elastic.co/u/mariomechoulam)\ **Replies:** 9\ **Last updated:** [May 4, 2018, 7:50am UTC](https://discuss.elastic.co/t/dev-environment-testsuite-failing-on-filebeat/130265 "2018-05-04T07:50:38Z")
Hello everyone! I would love to contribute to Beats, but I am having a hard time setting up the dev environment and validating the tests before starting any work. This would be my first Go project, apologies if somethin… --- ## [Metricsets are executed more than the period specified in config](https://discuss.elastic.co/t/metricsets-are-executed-more-than-the-period-specified-in-config/129337)
**Author:** [@Hussain\_Kothari](https://discuss.elastic.co/u/Hussain_Kothari)\ **Replies:** 13\ **Last updated:** [May 4, 2018, 7:33am UTC](https://discuss.elastic.co/t/metricsets-are-executed-more-than-the-period-specified-in-config/129337 "2018-05-04T07:33:23Z")
We are seeing a significant spike in data for Metrics. See the index size for today (only 8 hours in) and yesterday versus the largest other index on the box from last Thursday. \[image\] This is the monitoring for the m… --- ## [Change the time interval of mysql module's status metricset](https://discuss.elastic.co/t/change-the-time-interval-of-mysql-modules-status-metricset/130406)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 1\ **Last updated:** [May 3, 2018, 12:06pm UTC](https://discuss.elastic.co/t/change-the-time-interval-of-mysql-modules-status-metricset/130406 "2018-05-03T12:06:42Z")
Hi, How can I change the time interval in which the status metricset runs the 'show status' query Is there any such option in mysql.yml config file? What is the default time interval of mysql's status metricset? Than… --- ## [Tail once - route output based on filter](https://discuss.elastic.co/t/tail-once-route-output-based-on-filter/130243)
**Author:** [@Tomer\_Yakir](https://discuss.elastic.co/u/Tomer_Yakir)\ **Replies:** 3\ **Last updated:** [May 3, 2018, 11:58am UTC](https://discuss.elastic.co/t/tail-once-route-output-based-on-filter/130243 "2018-05-03T11:58:03Z")
Hi, I have the following use case: Using Filebeat to tail a single log file. Based on the type of log entry detected I need to route the data to a different custom processor. For example: Lines that start with A wou… --- ## [Registry HTTP Endpoint?](https://discuss.elastic.co/t/registry-http-endpoint/128602)
**Author:** [@frioux](https://discuss.elastic.co/u/frioux)\ **Replies:** 13\ **Last updated:** [May 3, 2018, 11:30am UTC](https://discuss.elastic.co/t/registry-http-endpoint/128602 "2018-05-03T11:30:58Z")
We have some fairly involved monitoring built on top of reading the registry and then inspecting the files at the offset. It's pretty great, but it means that we could be up to registry\_flush behind. This isn't a huge … --- ## [White space breaks multi line nagate behavior](https://discuss.elastic.co/t/white-space-breaks-multi-line-nagate-behavior/130198)
**Author:** [@madurad](https://discuss.elastic.co/u/madurad)\ **Replies:** 12\ **Last updated:** [May 2, 2018, 3:28pm UTC](https://discuss.elastic.co/t/white-space-breaks-multi-line-nagate-behavior/130198 "2018-05-02T15:28:11Z")
Hi, I'm trying to send Error stack to ELK server using filebeat installed in one of my server. Following is the sample log entry. \[log-output\] And following is the multiline.patter I have configured, multiline.patter… --- ## [Filebeat BeatUUID repeat](https://discuss.elastic.co/t/filebeat-beatuuid-repeat/130395)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 1\ **Last updated:** [May 3, 2018, 8:54am UTC](https://discuss.elastic.co/t/filebeat-beatuuid-repeat/130395 "2018-05-03T08:54:56Z")
it is weird ，i run two contanier on diff server . when i see the log i find BeatUUID repeat one log 2018-05-03T07:39:13.980Z INFO \[monitoring\] log/log.go:133 Uptime: 16m47.756701522s 2018-05-03T07:39:13.980Z INFO \[mon… --- ## [Filebeat Harvestor Behavior](https://discuss.elastic.co/t/filebeat-harvestor-behavior/130362)
**Author:** [@PramodHosahalli](https://discuss.elastic.co/u/PramodHosahalli)\ **Replies:** 1\ **Last updated:** [May 3, 2018, 8:07am UTC](https://discuss.elastic.co/t/filebeat-harvestor-behavior/130362 "2018-05-03T08:07:51Z")
Hi, I am trying to read some folder where logs are present through filebeat and inserting data directly to elastic search index. Data order is getting changed since multiple harvestors are sending data parallely. can we… --- ## [Provided Grok expressions do not match field value when the pattern field contains some regular expressions](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-when-the-pattern-field-contains-some-regular-expressions/129198)
**Author:** [@hawk199](https://discuss.elastic.co/u/hawk199)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 3:41am UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-when-the-pattern-field-contains-some-regular-expressions/129198 "2018-05-03T03:41:06Z")
hi,i make an module for my iis log,i use the grok to parse the message,it is wrong when the pattern field contains some regular expressions,but in the grok debugger(xpack plugin) it's ok, here is my ingest/default.json… --- ## [Trying to create a new beat - pip install functools32 error](https://discuss.elastic.co/t/trying-to-create-a-new-beat-pip-install-functools32-error/130170)
**Author:** [@toravir](https://discuss.elastic.co/u/toravir)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 12:26am UTC](https://discuss.elastic.co/t/trying-to-create-a-new-beat-pip-install-functools32-error/130170 "2018-05-03T00:26:25Z")
Hi, I am attempting to create a beat, so i am following the steps listed in : https://www.elastic.co/guide/en/beats/devguide/current/newbeat-generate.html And i get this error in the "make setup" step: Command "pytho… --- ## [Issue with Filebeats Kafka module](https://discuss.elastic.co/t/issue-with-filebeats-kafka-module/129735)
**Author:** [@ryan.dyer](https://discuss.elastic.co/u/ryan.dyer)\ **Replies:** 2\ **Last updated:** [May 2, 2018, 10:06pm UTC](https://discuss.elastic.co/t/issue-with-filebeats-kafka-module/129735 "2018-05-02T22:06:17Z")
I am having an issue with the kafka module where it does not appear to process the lines properly. I have enabled debugging of filebeat and see the following: 2018-03-16T18:36:54Z DBG \[publish\] Publish event: { "@timest… --- ## [Scrap data from Prometeus into Kibana/X.Pack](https://discuss.elastic.co/t/scrap-data-from-prometeus-into-kibana-x-pack/130101)
**Author:** [@Lior\_Assouline](https://discuss.elastic.co/u/Lior_Assouline)\ **Replies:** 3\ **Last updated:** [May 2, 2018, 6:21pm UTC](https://discuss.elastic.co/t/scrap-data-from-prometeus-into-kibana-x-pack/130101 "2018-05-02T18:21:22Z")
Hi, I have an existing Prometheus with many metrics and would like to push them into kibana for some ML analysis. I installed the MetricBeats and added the Prometheus plugin but I only see the metrics of the Prometheus … --- ## [Output to multiple indexes straight from filebeat.yml?](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165)
**Author:** [@vopsec](https://discuss.elastic.co/u/vopsec)\ **Replies:** 2\ **Last updated:** [May 2, 2018, 5:35pm UTC](https://discuss.elastic.co/t/output-to-multiple-indexes-straight-from-filebeat-yml/130165 "2018-05-02T17:35:15Z")
I'm trying to set up filebeat to ingest 2 different types of logs. They're in different locations and they should output to different indexes. This is what I have so far: filebeat.prospectors: - type: log enabled: t… --- ## [Filebeat lock on log file](https://discuss.elastic.co/t/filebeat-lock-on-log-file/130280)
**Author:** [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\ **Replies:** 1\ **Last updated:** [May 2, 2018, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-lock-on-log-file/130280 "2018-05-02T16:14:39Z")
hi, We are planning to implement ELK for aggregating the IIS logs from our web servers. However since this will also involve monitoring live logs, it would be good to know if the filebeat locks the IIS logs files while … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=452) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=454)