# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=455 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 456 --- ## [Filebeat is not starting when running the config file](https://discuss.elastic.co/t/filebeat-is-not-starting-when-running-the-config-file/129826)
**Author:** [@Akash\_Tanwar](https://discuss.elastic.co/u/Akash_Tanwar)\ **Replies:** 1\ **Last updated:** [April 27, 2018, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-starting-when-running-the-config-file/129826 "2018-04-27T12:46:21Z")
Hi, I am very new to ELK and trying to run filebeat for logstash out but my config file of filebeat is not working. Can some one please help me out on this? filebeat config: filebeat.prospectors: input\_type: log pat… --- ## [Stack deployment is not working](https://discuss.elastic.co/t/stack-deployment-is-not-working/129794)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 1\ **Last updated:** [April 27, 2018, 11:31am UTC](https://discuss.elastic.co/t/stack-deployment-is-not-working/129794 "2018-04-27T11:31:43Z")
Hi Guys, I am running my containers in swarm mode. From the Master node I want to do stack deploy filebeat container to all the worker nodes. I want to collect the logs from the other nodes. Any other idea using filebe… --- ## [Use filepath instead of inode](https://discuss.elastic.co/t/use-filepath-instead-of-inode/129711)
**Author:** [@spacepacket](https://discuss.elastic.co/u/spacepacket)\ **Replies:** 1\ **Last updated:** [April 27, 2018, 10:36am UTC](https://discuss.elastic.co/t/use-filepath-instead-of-inode/129711 "2018-04-27T10:36:41Z")
I have followed many threads about Filebeat having problems with inode re-use. Many of them end without a solution. We are using Filebeat, and having inode re-use issues as well, even when the filenames are unique. When … --- ## [Best practice to ship logs from docker containers](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 5\ **Last updated:** [April 27, 2018, 9:24am UTC](https://discuss.elastic.co/t/best-practice-to-ship-logs-from-docker-containers/129615 "2018-04-27T09:24:18Z")
Hi there, Shortly I changed some applications to docker containers. Also running some components of elastic stack in docker now (logstash, kibana). So in general docker containers are logging to stdout, which I can see… --- ## [Support for JSON arrays in Metricbeat HTTP Module](https://discuss.elastic.co/t/support-for-json-arrays-in-metricbeat-http-module/129659)
**Author:** [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Replies:** 3\ **Last updated:** [April 26, 2018, 9:19pm UTC](https://discuss.elastic.co/t/support-for-json-arrays-in-metricbeat-http-module/129659 "2018-04-26T21:19:22Z")
Continuing the discussion from Configuring multiple paths in http module: In the old discussion I explained my usecase, which is gathering metrics from IBM Liberty. Yesterday I downloaded a 6.3 Snapshot to test the new… --- ## [No Modules Available on FreeBSD pkg](https://discuss.elastic.co/t/no-modules-available-on-freebsd-pkg/129712)
**Author:** [@tg1234](https://discuss.elastic.co/u/tg1234)\ **Replies:** 1\ **Last updated:** [April 26, 2018, 9:17pm UTC](https://discuss.elastic.co/t/no-modules-available-on-freebsd-pkg/129712 "2018-04-26T21:17:52Z")
Hi have just installed beats-6.2.3 using FreeBSD ports. I'd like to use the nginx module but I can't find it, or anywhere to download it from. Should it have been created as part of the build process or are the module… --- ## [Beat devguide typo](https://discuss.elastic.co/t/beat-devguide-typo/129676)
**Author:** [@ripleymj](https://discuss.elastic.co/u/ripleymj)\ **Replies:** 4\ **Last updated:** [April 26, 2018, 8:03pm UTC](https://discuss.elastic.co/t/beat-devguide-typo/129676 "2018-04-26T20:03:49Z")
I was attempting to follow the New Beat guide, and think there's a small typo. On https://www.elastic.co/guide/en/beats/devguide/current/newbeat-getting-ready.html it says to clone to ${GOPATH}/src/elastic/beats. When y… --- ## [When does Filebeat lose data?](https://discuss.elastic.co/t/when-does-filebeat-lose-data/129486)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 4\ **Last updated:** [April 26, 2018, 3:23pm UTC](https://discuss.elastic.co/t/when-does-filebeat-lose-data/129486 "2018-04-26T15:23:31Z")
Filebeat 5.6, feeding to Logstash. I'm beginning to suspect that there are scenarios in which lines written to log files do not end up being passed to Logstash, so I'm wanting to check what's expected please. (1) Start … --- ## [Jq: error (at \:1): Cannot index string with string “Labels”](https://discuss.elastic.co/t/jq-error-at-stdin-1-cannot-index-string-with-string-labels/129655)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 1\ **Last updated:** [April 26, 2018, 12:45pm UTC](https://discuss.elastic.co/t/jq-error-at-stdin-1-cannot-index-string-with-string-labels/129655 "2018-04-26T12:45:10Z")
Hi guys, while collecting the running containers, i am getting this error getRunningContainers() { curl --no-buffer -s -XGET --unix-socket /tmp/docker.sock http:/containers/json | jq -r '.\[\] | select(.Labels\["filebea… --- ## [Passing Apache logs file to Kafka](https://discuss.elastic.co/t/passing-apache-logs-file-to-kafka/129342)
**Author:** [@kaplun](https://discuss.elastic.co/u/kaplun)\ **Replies:** 2\ **Last updated:** [April 26, 2018, 11:42am UTC](https://discuss.elastic.co/t/passing-apache-logs-file-to-kafka/129342 "2018-04-26T11:42:02Z")
Hello, I have this somehow simple yet tricky workflow I am trying to setup with just Filebeat and Kafka. In particular, I am trying to pipe Apache logs to Kafka via Filebeat but I would like to partition data on Kafka … --- ## [Service Metricset: System Call Level Is Not Correct](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476)
**Author:** [@jordan.cockles](https://discuss.elastic.co/u/jordan.cockles)\ **Replies:** 2\ **Last updated:** [April 26, 2018, 9:53am UTC](https://discuss.elastic.co/t/service-metricset-system-call-level-is-not-correct/129476 "2018-04-26T09:53:34Z")
I am in the process of setting up MetricBeat on a Windows 2003 Server. So far, the normal checks are in place on Kibana that monitor CPU, Memory and Disk Space. However, I am facing an issue when I come to monitor the … --- ## [Cannot locate import\_dashboards](https://discuss.elastic.co/t/cannot-locate-import-dashboards/129348)
**Author:** [@glastic](https://discuss.elastic.co/u/glastic)\ **Replies:** 1\ **Last updated:** [April 26, 2018, 9:43am UTC](https://discuss.elastic.co/t/cannot-locate-import-dashboards/129348 "2018-04-26T09:43:26Z")
Where is this script? How do I get it? I'm running 5.3.3. Thank you. --- ## [Filebeat 6.2.3: Unable to create runner due to error: Can only start a prospector when all related states are finished: {Id: Finished:false Fileinfo:0xc420196b60 Source:/var/log/nginx/access.log](https://discuss.elastic.co/t/filebeat-6-2-3-unable-to-create-runner-due-to-error-can-only-start-a-prospector-when-all-related-states-are-finished-id-finished-false-fileinfo-0xc420196b60-source-var-log-nginx-access-log/129455)
**Author:** [@nacesprin](https://discuss.elastic.co/u/nacesprin)\ **Replies:** 4\ **Last updated:** [April 26, 2018, 7:32am UTC](https://discuss.elastic.co/t/filebeat-6-2-3-unable-to-create-runner-due-to-error-can-only-start-a-prospector-when-all-related-states-are-finished-id-finished-false-fileinfo-0xc420196b60-source-var-log-nginx-access-log/129455 "2018-04-26T07:32:36Z")
Filebeat 6.2.3 Error on /var/log/filebeat/filebeat Unable to create runner due to error: Can only start a prospector when all related states are finished: {Id: Finished:false Fileinfo:0xc420196b60 Source:/var/log/nginx… --- ## [Does filebeat ever delete file contents?](https://discuss.elastic.co/t/does-filebeat-ever-delete-file-contents/129500)
**Author:** [@ilcoron](https://discuss.elastic.co/u/ilcoron)\ **Replies:** 2\ **Last updated:** [April 26, 2018, 6:20am UTC](https://discuss.elastic.co/t/does-filebeat-ever-delete-file-contents/129500 "2018-04-26T06:20:58Z")
Hello everybody! I have log messages in logstash that I cannot find on the centos server running filebeat (via graylog sidecar). Just to be 100% sure: Is there any possibility that filebeat is able to delete lines in l… --- ## [Custom Output stops receiving batches after errors](https://discuss.elastic.co/t/custom-output-stops-receiving-batches-after-errors/128235)
**Author:** [@Justin\_Seely](https://discuss.elastic.co/u/Justin_Seely)\ **Replies:** 9\ **Last updated:** [April 26, 2018, 3:08am UTC](https://discuss.elastic.co/t/custom-output-stops-receiving-batches-after-errors/128235 "2018-04-26T03:08:38Z")
Hi all, I have a custom output (writing to Azure Event Hubs) and when I introduce network failures, causing the output to return errors, it stops receiving batches from Beats. Beats still appears to be running and recei… --- ## [Kafka metricbeat module -- correct way to access sarama metrics](https://discuss.elastic.co/t/kafka-metricbeat-module-correct-way-to-access-sarama-metrics/128893)
**Author:** [@Filipe\_Oliveira](https://discuss.elastic.co/u/Filipe_Oliveira)\ **Replies:** 5\ **Last updated:** [April 25, 2018, 5:33pm UTC](https://discuss.elastic.co/t/kafka-metricbeat-module-correct-way-to-access-sarama-metrics/128893 "2018-04-25T17:33:03Z")
Hi there, I wanted to confirm the manner we access metrics via the sarama library and go-metrics. Considering as an example the Broker related metrics we should have two types of metrics ( meter and histogram ). Coul… --- ## [Filebeat not sending logs to logstash](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash/127372)
**Author:** [@sandeepnarla22322](https://discuss.elastic.co/u/sandeepnarla22322)\ **Replies:** 7\ **Last updated:** [April 25, 2018, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-logstash/127372 "2018-04-25T15:55:51Z")
elk.home: /tmp/ELK filebeat.prospectors: input\_type: log paths: ${elk.home}/LogStashOutputFormatted/SES\_VG1/\*.csv fields: log\_type: sesvg1 input\_type: log paths: ${elk.home}/LogStashOutputFormatted/SES\_VG2… --- ## [Running beats service logs are overwritten](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019)
**Author:** [@localghost](https://discuss.elastic.co/u/localghost)\ **Replies:** 3\ **Last updated:** [April 25, 2018, 2:48pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019 "2018-04-25T14:48:08Z")
I have a running metricbeat service with logging configured to default destination - /var/log/metricbeat/metricbeat. The issue is that when I run some beats command like metricbeat modules list metricbeat's log file gets… --- ## [Creat git submodules for the various beats](https://discuss.elastic.co/t/creat-git-submodules-for-the-various-beats/128769)
**Author:** [@amomchilov](https://discuss.elastic.co/u/amomchilov)\ **Replies:** 7\ **Last updated:** [April 25, 2018, 11:02am UTC](https://discuss.elastic.co/t/creat-git-submodules-for-the-various-beats/128769 "2018-04-25T11:02:01Z")
I wish to import Filebeat into an in-house package manager, but I don't want to pull in all the beats. Would it be possible to isolate each beat into its own git sub-module, all under the umbrella of the beat repository? … --- ## [Filebeat file-god stopped and No modules or prospectors enabled and configuration reloading disabled](https://discuss.elastic.co/t/filebeat-file-god-stopped-and-no-modules-or-prospectors-enabled-and-configuration-reloading-disabled/129145)
**Author:** [@caoimhe](https://discuss.elastic.co/u/caoimhe)\ **Replies:** 6\ **Last updated:** [April 25, 2018, 9:08am UTC](https://discuss.elastic.co/t/filebeat-file-god-stopped-and-no-modules-or-prospectors-enabled-and-configuration-reloading-disabled/129145 "2018-04-25T09:08:26Z")
Service featbeat start exits with message "Exiting: No modules or prospectors enabled and configuration reloading disabled. What files do you want me to watch?" Service filebeat status returns filebeat-god has stopped. … --- ## [Filebeat 6.2 error: write: connection reset by peer](https://discuss.elastic.co/t/filebeat-6-2-error-write-connection-reset-by-peer/129418)
**Author:** [@molly](https://discuss.elastic.co/u/molly)\ **Replies:** 1\ **Last updated:** [April 25, 2018, 8:25am UTC](https://discuss.elastic.co/t/filebeat-6-2-error-write-connection-reset-by-peer/129418 "2018-04-25T08:25:32Z")
2018-04-26T14:52:04.978+0800 ERROR logstash/async.go:235 Failed to publish events caused by: write tcp 192.168.40.132:55375-\>192.168.40.129:5044: write: connection reset by peer 2018-04-26T14:52:05.994+0800 ERROR pipeli… --- ## [Metricbeat CPU Visualization missing](https://discuss.elastic.co/t/metricbeat-cpu-visualization-missing/127466)
**Author:** [@t03r1cht](https://discuss.elastic.co/u/t03r1cht)\ **Replies:** 13\ **Last updated:** [April 25, 2018, 8:14am UTC](https://discuss.elastic.co/t/metricbeat-cpu-visualization-missing/127466 "2018-04-25T08:14:00Z")
I'm trying to setup Metricbeat, unfortunately not much data is being visualized. \[Screenshot\_44\] I am mostly interested in the CPU usage. I am using the example configuration presented at Step 2: Configure Metricbeat. … --- ## [Where does nginx.stubstatus.current get its data from?](https://discuss.elastic.co/t/where-does-nginx-stubstatus-current-get-its-data-from/129258)
**Author:** [@Silas\_Hansen](https://discuss.elastic.co/u/Silas_Hansen)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 5:46am UTC](https://discuss.elastic.co/t/where-does-nginx-stubstatus-current-get-its-data-from/129258 "2018-04-25T05:46:49Z")
Looking at: http://nginx.org/en/docs/http/ngx\_http\_stub\_status\_module.html it says nothing about any metric in the stubstatus called "current", as listed here as "nginx.stubstatus.current": https://www.elastic.co/guid… --- ## [Filter logs](https://discuss.elastic.co/t/filter-logs/129296)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 2\ **Last updated:** [April 25, 2018, 3:39am UTC](https://discuss.elastic.co/t/filter-logs/129296 "2018-04-25T03:39:52Z")
HI, Iam using filebeat as logshipper with Elk , example of my logs are shown below how to filter logs so that i need to receive only logs which contains REQUEST XML. \[image\] Thanks GR. --- ## [Filebeat to Logstash - Error parsing csv](https://discuss.elastic.co/t/filebeat-to-logstash-error-parsing-csv/127665)
**Author:** [@spacepacket](https://discuss.elastic.co/u/spacepacket)\ **Replies:** 4\ **Last updated:** [April 24, 2018, 10:25pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-error-parsing-csv/127665 "2018-04-24T22:25:13Z")
I have recently added Filebeat to our ELK stack to read logs and send the data to Logstash. Every so often, Logstash prints the following an "Error parsing csv" error. The result is that we get corrupt data in the databa… --- ## [Metricbeat output stops appearing in Kibana after a few minutes](https://discuss.elastic.co/t/metricbeat-output-stops-appearing-in-kibana-after-a-few-minutes/129309)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 4:00pm UTC](https://discuss.elastic.co/t/metricbeat-output-stops-appearing-in-kibana-after-a-few-minutes/129309 "2018-04-24T16:00:07Z")
I've had Metricbeat -\> Elasticsearch -\> Kibana working fine on a number of deployments for some time. I'm now building a complete new stack, and what I'm seeing is that Metricbeat output looks normal until Metricbeat has… --- ## [How to uninstall old metric beat version in linux](https://discuss.elastic.co/t/how-to-uninstall-old-metric-beat-version-in-linux/129317)
**Author:** [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 3:21pm UTC](https://discuss.elastic.co/t/how-to-uninstall-old-metric-beat-version-in-linux/129317 "2018-04-24T15:21:48Z")
Hi team I was using metric beat 5, and want to upgrade to metric beat 6, so how to uninstall the old version os: linux Thanks in advance --- ## [Metricbeat not able to display cpu status](https://discuss.elastic.co/t/metricbeat-not-able-to-display-cpu-status/128715)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 10\ **Last updated:** [April 24, 2018, 11:47am UTC](https://discuss.elastic.co/t/metricbeat-not-able-to-display-cpu-status/128715 "2018-04-24T11:47:26Z")
Hello Team, I'm using metricbeats but I'm not able to see the CPU status in kibana dashboards. Please let me know where I went wrong \[image\] You can see in the image. all the cpu stats are set to 0. this is my system… --- ## [Multiple config file logstash pipelines](https://discuss.elastic.co/t/multiple-config-file-logstash-pipelines/129091)
**Author:** [@kingmario](https://discuss.elastic.co/u/kingmario)\ **Replies:** 2\ **Last updated:** [April 24, 2018, 11:50am UTC](https://discuss.elastic.co/t/multiple-config-file-logstash-pipelines/129091 "2018-04-24T11:50:12Z")
Hey, I am setting up ELK with filebeats. I created some pipelines (apache, ssh..) in logstash. In my webserver, I setting up filebeat. I have multiple config file that I moved in a created directory in "/etc/filebeat/c… --- ## [Metricbeat - Sparsity - Best Practices](https://discuss.elastic.co/t/metricbeat-sparsity-best-practices/129219)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 5\ **Last updated:** [April 24, 2018, 11:11am UTC](https://discuss.elastic.co/t/metricbeat-sparsity-best-practices/129219 "2018-04-24T11:11:42Z")
Hi All, I have a question related to storing of the metrics of various applications monitored by metribeat in the same metricbeat index. For example if I am monitoring system, apache, ngnix, mogodb using metric beat. F… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=454) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=456)