# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=454 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 455 --- ## [Auditbeat Connection reset by peer](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206)
**Author:** [@giuliano](https://discuss.elastic.co/u/giuliano)\ **Replies:** 1\ **Last updated:** [May 2, 2018, 2:23pm UTC](https://discuss.elastic.co/t/auditbeat-connection-reset-by-peer/130206 "2018-05-02T14:23:41Z")
Hi all, I use ELK 6.2.3 version with beat plugin 5.0.10. I'm trying to setup the auditbeat 6.2.4 on remote Linux Machine but from the audit log I have these errors: 2018-05-02T09:43:03.884+0200 ERROR logstash/asy… --- ## [The error message "output.go:92: ERR Failed to publish events: temporary bulk send failure"](https://discuss.elastic.co/t/the-error-message-output-go-92-err-failed-to-publish-events-temporary-bulk-send-failure/130239)
**Author:** [@anson\_ch](https://discuss.elastic.co/u/anson_ch)\ **Replies:** 1\ **Last updated:** [May 2, 2018, 1:31pm UTC](https://discuss.elastic.co/t/the-error-message-output-go-92-err-failed-to-publish-events-temporary-bulk-send-failure/130239 "2018-05-02T13:31:58Z")
I have some problem, the error log is being outputted by filebeat endlessly. please see the following detail message. 2018-05-02T09:27:21.879178437Z 2018/05/02 09:27:21.879028 output.go:92: ERR Failed to publish events… --- ## [Filebeat sends garbled messages to kafka](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-to-kafka/129277)
**Author:** [@wangyanzhao](https://discuss.elastic.co/u/wangyanzhao)\ **Replies:** 5\ **Last updated:** [May 2, 2018, 10:01am UTC](https://discuss.elastic.co/t/filebeat-sends-garbled-messages-to-kafka/129277 "2018-05-02T10:01:52Z")
use filebeat-6.1.2 to collect logs to kafka, but part of logs in kafka are Garbled. filebeat.yml path.data: ${FILEBEAT\_HOME}/data path.logs: ${FILEBEAT\_HOME}/logs filebeat.config.prospectors: enabled: true path: … --- ## [Multiple redis instances](https://discuss.elastic.co/t/multiple-redis-instances/130208)
**Author:** [@astropanic](https://discuss.elastic.co/u/astropanic)\ **Replies:** 1\ **Last updated:** [May 2, 2018, 8:53am UTC](https://discuss.elastic.co/t/multiple-redis-instances/130208 "2018-05-02T08:53:29Z")
Can I monitor multiple redis instances on a single host with a single metricbeat setup? Or should I run multiple instances of metricbeat with one config for each redis instance? --- ## [Filebeat not sending logs](https://discuss.elastic.co/t/filebeat-not-sending-logs/130063)
**Author:** [@FIRST\_Souharit](https://discuss.elastic.co/u/FIRST_Souharit)\ **Replies:** 4\ **Last updated:** [May 2, 2018, 3:28am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs/130063 "2018-05-02T03:28:25Z")
Hello, I just started ELK and I sucked in English. I have installed ELK + filebeat + winlogbeat on Ubuntu Vm as suggested, but filebeat does not send log firewall to kibana. Can not create index pattern logstash and fil… --- ## [Beats 6.2 dynamic templates using fields.yml](https://discuss.elastic.co/t/beats-6-2-dynamic-templates-using-fields-yml/129986)
**Author:** [@sheen2x](https://discuss.elastic.co/u/sheen2x)\ **Replies:** 2\ **Last updated:** [April 30, 2018, 10:24am UTC](https://discuss.elastic.co/t/beats-6-2-dynamic-templates-using-fields-yml/129986 "2018-04-30T10:24:40Z")
Hello, Is there a way to set dynamic templates using fields.yml? Is there a change for dynamic templates in 6.2? Before on Beats 5.5 both text and keyword are assigned when there's a string. I want to set the default … --- ## [Module create Logstash filter?](https://discuss.elastic.co/t/module-create-logstash-filter/130079)
**Author:** [@cweiss](https://discuss.elastic.co/u/cweiss)\ **Replies:** 3\ **Last updated:** [May 1, 2018, 6:35pm UTC](https://discuss.elastic.co/t/module-create-logstash-filter/130079 "2018-05-01T18:35:28Z")
We would like to use Modules to instantiate logging for our services. IE - We deploy a service and it deploys an associated Filebeat module that has it's own specific log paths and creates the needed Kibana dashboards. S… --- ## [Filebeat syslog fields are missing in Kibana](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923)
**Author:** [@yan](https://discuss.elastic.co/u/yan)\ **Replies:** 4\ **Last updated:** [May 1, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923 "2018-05-01T11:50:27Z")
Hi, I am running ELK 6.2.4 (Elasticsearch, Kibana and Filebeat) on Centos 7. I see all the logs from /var/log/messages in Kibana "Discover" window, BUT for some reason the syslog fields are missing in the "available fie… --- ## [Run Packetbeat in Docker swarm mode?](https://discuss.elastic.co/t/run-packetbeat-in-docker-swarm-mode/129937)
**Author:** [@shazChaudhry](https://discuss.elastic.co/u/shazChaudhry)\ **Replies:** 3\ **Last updated:** [May 1, 2018, 10:05am UTC](https://discuss.elastic.co/t/run-packetbeat-in-docker-swarm-mode/129937 "2018-05-01T10:05:42Z")
Network capabilities such as "--cap-add=NET\_ADMIN" are ignored when deploying a stack in swarm mode with a (version 3) Is it possible to start Packetbeat in docker swarm mode? Will be grateful if anyone could share a c… --- ## [Filebeats causing \\t not to be caught in multiline](https://discuss.elastic.co/t/filebeats-causing-t-not-to-be-caught-in-multiline/123692)
**Author:** [@ksnapes](https://discuss.elastic.co/u/ksnapes)\ **Replies:** 9\ **Last updated:** [May 1, 2018, 10:04am UTC](https://discuss.elastic.co/t/filebeats-causing-t-not-to-be-caught-in-multiline/123692 "2018-05-01T10:04:06Z")
Hi, I'm having an issue when sending logs from filebeats to logstash I am trying to capture java stack trace events in tomcat log files. I am using multiline to capture the events that span multiple lines and it is wor… --- ## [Filebeat Dashboard load](https://discuss.elastic.co/t/filebeat-dashboard-load/130089)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 1\ **Last updated:** [May 1, 2018, 6:26am UTC](https://discuss.elastic.co/t/filebeat-dashboard-load/130089 "2018-05-01T06:26:26Z")
Hi, I am trying to get the Filebeat Dashboards loaded , but wont work the usual way. Version ES/Kibana/Filebeat - 5.6.2 Error: error loading /tmp/tmp858474757/beats-dashboards-5.6.2/ filebeat/5.x/dashboard/dfbb49f0-0… --- ## [.990056 logp.go:232:INFO No non-zero metrics in the last 30s](https://discuss.elastic.co/t/990056-logp-go-232-info-no-non-zero-metrics-in-the-last-30s/130004)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 6\ **Last updated:** [May 1, 2018, 6:00am UTC](https://discuss.elastic.co/t/990056-logp-go-232-info-no-non-zero-metrics-in-the-last-30s/130004 "2018-05-01T06:00:44Z")
Hi Guys, i am getting non-zero metrics filebeat\_1 | 2018/04/30 08:54:50.988423 beat.go:177: INFO Setup Beat: filebeat; Version: 5.2.1 filebeat\_1 | 2018/04/30 08:54:50.988521 logstash.go:90: INFO Max Retries set to: … --- ## [Filebeat new timestamp field](https://discuss.elastic.co/t/filebeat-new-timestamp-field/129970)
**Author:** [@Dominik\_Deren](https://discuss.elastic.co/u/Dominik_Deren)\ **Replies:** 2\ **Last updated:** [May 1, 2018, 12:09am UTC](https://discuss.elastic.co/t/filebeat-new-timestamp-field/129970 "2018-05-01T00:09:24Z")
Hey, I'm pushing logs from my application into Elasticsearch using Filebeat agent installed on my app's machine. Logs that my application generates contain a field called timestamp that contains the datetime string defi… --- ## [Filebeat appearing to update some of registry file, not all during 1.x\>5.x upgrade](https://discuss.elastic.co/t/filebeat-appearing-to-update-some-of-registry-file-not-all-during-1-x-5-x-upgrade/128925)
**Author:** [@aidanhl](https://discuss.elastic.co/u/aidanhl)\ **Replies:** 2\ **Last updated:** [April 30, 2018, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-appearing-to-update-some-of-registry-file-not-all-during-1-x-5-x-upgrade/128925 "2018-04-30T22:31:21Z")
Hello, I am in the process of upgrading filebeat 1.0 -\> 5.6.8. On first run of filebeat 5.6.8 the expected behavior is that the registry file will be updated to the new format. This appears to be happening for some of … --- ## [Failed to start filebeat (more than one namespace)](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016)
**Author:** [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Replies:** 6\ **Last updated:** [April 30, 2018, 5:07pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016 "2018-04-30T17:07:56Z")
when i start filebeat and see status of service i have as output ; more than one namespace configured accessing 'output' /etc/filebeat/filebeat.yml how can i resolve this problem ,(i am trying to send bro logs to elasti… --- ## [Filebeat configuration to create different elasticsearch index](https://discuss.elastic.co/t/filebeat-configuration-to-create-different-elasticsearch-index/128607)
**Author:** [@Ferdous\_Shibly](https://discuss.elastic.co/u/Ferdous_Shibly)\ **Replies:** 6\ **Last updated:** [April 30, 2018, 4:08pm UTC](https://discuss.elastic.co/t/filebeat-configuration-to-create-different-elasticsearch-index/128607 "2018-04-30T16:08:58Z")
Hi, We are trying to configure Filebeat to send logs to Elasticsearch. We want to create different index than the default one. Here is the configuration - input\_type: log paths: - /var/log/application1/\*.err … --- ## [1 WEF and 2 separate outputs in winlogbeats](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 2\ **Last updated:** [April 30, 2018, 3:05pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035 "2018-04-30T15:05:32Z")
Is it possible to set up one windows event forwarder with 2 outputs? I have our production WEF running great but in addition to this I want to use the same WEF to set up a test box for @Cyb3rWard0g 's @THE\_HELK and se… --- ## [How can I add a basetime to timestamps?](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059)
**Author:** [@joe\_bermejales](https://discuss.elastic.co/u/joe_bermejales)\ **Replies:** 3\ **Last updated:** [April 30, 2018, 1:17pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-basetime-to-timestamps/129059 "2018-04-30T13:17:38Z")
Hi everyone, we are new in Elastic framwork and we would like to monitor file logs from a robot control, with the following pattern. The problem is that timestamp are relative to a base time, so we would need to process… --- ## [Getting metricbeats default dashboards to work - Windows](https://discuss.elastic.co/t/getting-metricbeats-default-dashboards-to-work-windows/128899)
**Author:** [@L33T](https://discuss.elastic.co/u/L33T)\ **Replies:** 2\ **Last updated:** [April 30, 2018, 10:15am UTC](https://discuss.elastic.co/t/getting-metricbeats-default-dashboards-to-work-windows/128899 "2018-04-30T10:15:56Z")
Hi, I have followed the setup procedures on the elastic site. Installed the agent, configured the config file accodingly for the basic metrics and started the service, i have run .\\metricbeat.exe setup --dashboards on t… --- ## [FileBeat Not Starting in Custom Dockerfile](https://discuss.elastic.co/t/filebeat-not-starting-in-custom-dockerfile/129901)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 1\ **Last updated:** [April 30, 2018, 7:32am UTC](https://discuss.elastic.co/t/filebeat-not-starting-in-custom-dockerfile/129901 "2018-04-30T07:32:07Z")
We are trying to create a custom Dockerfile which will include FileBeat as well. When the container is started FileBeat should start automatically. DockerFile FROM microsoft/aspnetcore:2.0.3 WORKDIR /usr/local/filebea… --- ## [Filebeat Logstash Output Configuration](https://discuss.elastic.co/t/filebeat-logstash-output-configuration/129918)
**Author:** [@anil\_kumar\_Samantula](https://discuss.elastic.co/u/anil_kumar_Samantula)\ **Replies:** 1\ **Last updated:** [April 30, 2018, 7:07am UTC](https://discuss.elastic.co/t/filebeat-logstash-output-configuration/129918 "2018-04-30T07:07:09Z")
Hi , can we give an Url like http://domainname/path instead of IPAddress :Port. In filebeat Logstash output configuration..while giving the URL I'm getting lumberjack protocol error --- ## [Problems processing nginx access log](https://discuss.elastic.co/t/problems-processing-nginx-access-log/129973)
**Author:** [@andrei-dascalu](https://discuss.elastic.co/u/andrei-dascalu)\ **Replies:** 1\ **Last updated:** [April 30, 2018, 6:40am UTC](https://discuss.elastic.co/t/problems-processing-nginx-access-log/129973 "2018-04-30T06:40:45Z")
Hello everyone! I'm new here (and an ES novice) so please bear with me ... I have a setup of ELK using docker (just default images) and I'm sending some logs off an nginx webserver directly to ES using filebeat install… --- ## [Module system doesn't exists! when trying to enable system module](https://discuss.elastic.co/t/module-system-doesnt-exists-when-trying-to-enable-system-module/129744)
**Author:** [@Josh\_McDonald](https://discuss.elastic.co/u/Josh_McDonald)\ **Replies:** 10\ **Last updated:** [April 29, 2018, 10:50pm UTC](https://discuss.elastic.co/t/module-system-doesnt-exists-when-trying-to-enable-system-module/129744 "2018-04-29T22:50:35Z")
I'm trying to get system logs from an Ubuntu VM running the latest version of filebeats (installed via apt-get). When I run sudo ./filebeat modules enable system, I get an error "Module system doesn't exists!". If I run… --- ## [Vsphere module account support](https://discuss.elastic.co/t/vsphere-module-account-support/129819)
**Author:** [@Fille](https://discuss.elastic.co/u/Fille)\ **Replies:** 3\ **Last updated:** [April 29, 2018, 11:34am UTC](https://discuss.elastic.co/t/vsphere-module-account-support/129819 "2018-04-29T11:34:33Z")
Hi, Testing out the vsphere module. Just wondering if the vsphere module supports AD, ldap or if the account needs to be a local vsphere account? And if it does how do I specify that 'syntax wise'... Cheers /Filip --- ## [Distinguish Winlogbeat traffic in Logstash](https://discuss.elastic.co/t/distinguish-winlogbeat-traffic-in-logstash/129862)
**Author:** [@giuliano](https://discuss.elastic.co/u/giuliano)\ **Replies:** 1\ **Last updated:** [April 28, 2018, 2:17am UTC](https://discuss.elastic.co/t/distinguish-winlogbeat-traffic-in-logstash/129862 "2018-04-28T02:17:31Z")
HI all.....I use ELK 6.2.3 with Winlogbeat and Auditbeat for Linux. I have 20 Web Server IIS and I want to send all audit logs to Elasticsearch in only one index (for example web-2018.04.26). The Elasticsearch records a… --- ## [ELK stack file beat configuration issue single.go:77: INFO Error publishing events (retrying): EOF](https://discuss.elastic.co/t/elk-stack-file-beat-configuration-issue-single-go-77-info-error-publishing-events-retrying-eof/129493)
**Author:** [@Dazith\_Kj](https://discuss.elastic.co/u/Dazith_Kj)\ **Replies:** 2\ **Last updated:** [April 27, 2018, 4:06pm UTC](https://discuss.elastic.co/t/elk-stack-file-beat-configuration-issue-single-go-77-info-error-publishing-events-retrying-eof/129493 "2018-04-27T16:06:54Z")
I have configured an ELK stack in my local environment by following up the below document (link to the document) As per the documentation and per my understanding I have successfully completed the implementation. Howe… --- ## [Saved "field" parameter is now invalid / Visualize: "field" is a required parameter](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-visualize-field-is-a-required-parameter/129727)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [April 27, 2018, 2:50pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-visualize-field-is-a-required-parameter/129727 "2018-04-27T14:50:23Z")
I followed Configuration Examples | Logstash Reference \[6.2\] | Elastic to configure Apache 2, MySQL, Nginx and System Logs... however, via Kibana, I get following message when trying to access \[Filebeat Apache2\] Access … --- ## [Filebeat monitoring via proxy](https://discuss.elastic.co/t/filebeat-monitoring-via-proxy/129415)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 3\ **Last updated:** [April 27, 2018, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-via-proxy/129415 "2018-04-27T13:44:56Z")
Hi All, I am using filebeat and I want to add xpack monitoring configuration. I do not have direct access to ES so I need to use a proxy. Does some have an example config with use of a proxy server? Also would it be pos… --- ## [Harvester could not be started on new file - access is denied](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-access-is-denied/129695)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 2\ **Last updated:** [April 27, 2018, 1:31pm UTC](https://discuss.elastic.co/t/harvester-could-not-be-started-on-new-file-access-is-denied/129695 "2018-04-27T13:31:41Z")
Version: 6.2.4 Observations: I have filebeat watch application logs that contain sub-directories with more log files in the sub-directories. Filebeat is running under an account that has read permissions to the log pa… --- ## ["ERR Dropping event: key=message: key not found" using "add\_docker\_metadata"](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784)
**Author:** [@mimmus](https://discuss.elastic.co/u/mimmus)\ **Replies:** 4\ **Last updated:** [April 27, 2018, 1:24pm UTC](https://discuss.elastic.co/t/err-dropping-event-key-message-key-not-found-using-add-docker-metadata/129784 "2018-04-27T13:24:29Z")
Hi, trying this: https://www.elastic.co/blog/enrich-docker-logs-with-filebeat (but with Kafka output plugin) I get A LOT of: client.go:108: ERR Dropping event: key=message: key not found error messages. No idea wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=453) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=455)