# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=456 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 457 --- ## [Is Filebeat 6.2.3/6.2.4 compatible with Kafka 1.1.0?](https://discuss.elastic.co/t/is-filebeat-6-2-3-6-2-4-compatible-with-kafka-1-1-0/128948)
**Author:** [@Bernie\_Hsiung](https://discuss.elastic.co/u/Bernie_Hsiung)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 9:56am UTC](https://discuss.elastic.co/t/is-filebeat-6-2-3-6-2-4-compatible-with-kafka-1-1-0/128948 "2018-04-24T09:56:44Z")
The current Sarama website says that it supports from Kafka 0.11 to Kafka 1.1.0, but it's not clear to me what version of Sarama is bundled into the latest available version of Filebeat. --- ## [Execute a script after harvesting](https://discuss.elastic.co/t/execute-a-script-after-harvesting/128955)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 1\ **Last updated:** [April 24, 2018, 9:43am UTC](https://discuss.elastic.co/t/execute-a-script-after-harvesting/128955 "2018-04-24T09:43:11Z")
Is it possible to trigger scripts after an event has occurred? It would be nice to run a script to delete a file, for example, if close\_eof is executed. My point is to delete old logs after they have been harvested. --- ## [Winlogbeat indices works but not see in Kibana](https://discuss.elastic.co/t/winlogbeat-indices-works-but-not-see-in-kibana/128968)
**Author:** [@lcguy](https://discuss.elastic.co/u/lcguy)\ **Replies:** 8\ **Last updated:** [April 24, 2018, 8:32am UTC](https://discuss.elastic.co/t/winlogbeat-indices-works-but-not-see-in-kibana/128968 "2018-04-24T08:32:18Z")
Hi, I have ELK stack working well with Logstash. Input is Syslog. Just trying out winlogbeat in from Windows server to CentOS (ELK) server not works. Checking indices, I can see all but, unable to view in Kibana. Nee… --- ## [Auditbeat sending path through has hex](https://discuss.elastic.co/t/auditbeat-sending-path-through-has-hex/128353)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 16\ **Last updated:** [April 24, 2018, 7:43am UTC](https://discuss.elastic.co/t/auditbeat-sending-path-through-has-hex/128353 "2018-04-24T07:43:39Z")
Having a painful problem. Using auditbeat to monitor a directory. It would be nice if it gave the full path to whatever was happening rather than the relative path (unless there is a setting for ensuring the full path al… --- ## [Test-netconnection to ELK-Server is failing on port 5044 from target machines](https://discuss.elastic.co/t/test-netconnection-to-elk-server-is-failing-on-port-5044-from-target-machines/128426)
**Author:** [@codeguru](https://discuss.elastic.co/u/codeguru)\ **Replies:** 7\ **Last updated:** [April 23, 2018, 7:26pm UTC](https://discuss.elastic.co/t/test-netconnection-to-elk-server-is-failing-on-port-5044-from-target-machines/128426 "2018-04-23T19:26:52Z")
Hi Everyone, I have installed winlog beat and metric beat agents on 10 machines. The script I generated did not perform a test-connection to the ELK server I realized it later on so I ran this on the 10 machines individu… --- ## [Forward logs from .dat file](https://discuss.elastic.co/t/forward-logs-from-dat-file/129076)
**Author:** [@Nikhil\_Jaiswal](https://discuss.elastic.co/u/Nikhil_Jaiswal)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 5:40pm UTC](https://discuss.elastic.co/t/forward-logs-from-dat-file/129076 "2018-04-23T17:40:34Z")
HI all, Is there any way to forward the logs from .dat file to logstash using filebeat ? --- ## [Copying file contents to another file using filebeat](https://discuss.elastic.co/t/copying-file-contents-to-another-file-using-filebeat/129126)
**Author:** [@Yusuff\_Sodiq](https://discuss.elastic.co/u/Yusuff_Sodiq)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 5:15pm UTC](https://discuss.elastic.co/t/copying-file-contents-to-another-file-using-filebeat/129126 "2018-04-23T17:15:01Z")
I would like to use the filebeat module to pull the contents of a file in one server to a file in another server. I need help on how to do this if it is possible. --- ## [Configure my service for filebeat output](https://discuss.elastic.co/t/configure-my-service-for-filebeat-output/129090)
**Author:** [@wolecharles\_job](https://discuss.elastic.co/u/wolecharles_job)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 4:23pm UTC](https://discuss.elastic.co/t/configure-my-service-for-filebeat-output/129090 "2018-04-23T16:23:08Z")
Hi Everyone, Pls can i configure the file beat to send its output data to the service i created --- ## [Deleted filebeat log, now it doesn't log anymore](https://discuss.elastic.co/t/deleted-filebeat-log-now-it-doesnt-log-anymore/129046)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 4:15pm UTC](https://discuss.elastic.co/t/deleted-filebeat-log-now-it-doesnt-log-anymore/129046 "2018-04-23T16:15:13Z")
Hi there, I installed Filebeat on a Mac (version 6.2.2), and it was logging to logs/filebeat. I deleted that file, and now nothing brings it back. I even tried to recreate the file manually to no avail. I tried to add l… --- ## [A beat to count lines in a file?](https://discuss.elastic.co/t/a-beat-to-count-lines-in-a-file/129060)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 4:14pm UTC](https://discuss.elastic.co/t/a-beat-to-count-lines-in-a-file/129060 "2018-04-23T16:14:29Z")
Does this functionality exist today ? If not, would the best solution be to write a metricbeat module ? Thanks, --- ## [Since update 6, Filebeat didn't send anything to logstash](https://discuss.elastic.co/t/since-update-6-filebeat-didnt-send-anything-to-logstash/128806)
**Author:** [@muella](https://discuss.elastic.co/u/muella)\ **Replies:** 4\ **Last updated:** [April 23, 2018, 1:27pm UTC](https://discuss.elastic.co/t/since-update-6-filebeat-didnt-send-anything-to-logstash/128806 "2018-04-23T13:27:48Z")
Hi there, I recently updated Elastic Search, Kibana and Logstash to version 6.2.4. Since then everything went fine. But when I also updated Filebeat to 6.2.4, no more input was received by it. Then I went back to Fileb… --- ## [Filebeat conditional output logstash](https://discuss.elastic.co/t/filebeat-conditional-output-logstash/128756)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 9:38am UTC](https://discuss.elastic.co/t/filebeat-conditional-output-logstash/128756 "2018-04-23T09:38:43Z")
Filebeat 6.2 I am using filebeat to pick up two files and send them to two different logstash endpoints. My config looks like: --- filebeat.prospectors: - type: log enabled: true paths: - path/to/log1.log m… --- ## [Filebeat implementation questions](https://discuss.elastic.co/t/filebeat-implementation-questions/128258)
**Author:** [@shoshin](https://discuss.elastic.co/u/shoshin)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 8:58am UTC](https://discuss.elastic.co/t/filebeat-implementation-questions/128258 "2018-04-23T08:58:17Z")
Hello every one, I've been using Filebeat for the past month and half, and it's working like a charm. I've just some questions about some Filebeat (v 6.x) implementation details : In the FAQ, it's said that it's not r… --- ## [Difficulties with external configs in FileBeat](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 8:13am UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863 "2018-04-23T08:13:11Z")
I have a working filebeat (6.2.2) configuration but am missing the ability to change the config (during development) and have filebeat pick up the changes without being restarted. As I understand it, this is only possibl… --- ## [Nginx k8s metrics](https://discuss.elastic.co/t/nginx-k8s-metrics/128690)
**Author:** [@aokhotnikov](https://discuss.elastic.co/u/aokhotnikov)\ **Replies:** 6\ **Last updated:** [April 22, 2018, 6:40am UTC](https://discuss.elastic.co/t/nginx-k8s-metrics/128690 "2018-04-22T06:40:53Z")
Hi Is there some option to configure metricbeat for collecting nginx-ingress metrics/stats installed on k8s. AFAIK nginx module just parses stub\_status response. Nginx can ship metrics in prometheus format or in json. E… --- ## [Limiting the amount of data being sent](https://discuss.elastic.co/t/limiting-the-amount-of-data-being-sent/128904)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 2\ **Last updated:** [April 21, 2018, 6:43am UTC](https://discuss.elastic.co/t/limiting-the-amount-of-data-being-sent/128904 "2018-04-21T06:43:18Z")
Hi, I'm concerned about using Filebeat to gather information from multiple laptops running macOS, as some of them might be connected to cellular networks and it is therefore risky that huge logs might imply extra costs … --- ## [Filebeat behaves different on different macOS versions](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 4\ **Last updated:** [April 20, 2018, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657 "2018-04-20T14:45:47Z")
Hi there, I have installed Filebeat 6.2.2 into different versions of macOS. These versions range from 10.10.5 to 10.13.4. My configuration file is setup to scan both the system logs as well as some json files on a fold… --- ## [Metricbeat does not get \*\_state metrics from kube-state-metrics](https://discuss.elastic.co/t/metricbeat-does-not-get-state-metrics-from-kube-state-metrics/128828)
**Author:** [@ralfeus](https://discuss.elastic.co/u/ralfeus)\ **Replies:** 5\ **Last updated:** [April 20, 2018, 2:10pm UTC](https://discuss.elastic.co/t/metricbeat-does-not-get-state-metrics-from-kube-state-metrics/128828 "2018-04-20T14:10:45Z")
Hi I've deployed Metricbeat to my OpenShift environment along with kube-state-metrics as it's supposed to be used to get pod and container level metrics (such as CPU, RAM, IO etc). In documentation I read the kubernetes … --- ## [What are the system limits to check when Auditbeat stops sending messages](https://discuss.elastic.co/t/what-are-the-system-limits-to-check-when-auditbeat-stops-sending-messages/128815)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 7\ **Last updated:** [April 20, 2018, 1:58pm UTC](https://discuss.elastic.co/t/what-are-the-system-limits-to-check-when-auditbeat-stops-sending-messages/128815 "2018-04-20T13:58:26Z")
Thought I'd better start this as a separate topic. At 1am yesterday morning, the messages from Auditbeat stopped appearing in ELK. No changes were made to either Auditbeat or Logstash filtering. Just stopped dead. I was … --- ## [Multiple prospectors vs multiple config files](https://discuss.elastic.co/t/multiple-prospectors-vs-multiple-config-files/128783)
**Author:** [@las](https://discuss.elastic.co/u/las)\ **Replies:** 1\ **Last updated:** [April 20, 2018, 11:58am UTC](https://discuss.elastic.co/t/multiple-prospectors-vs-multiple-config-files/128783 "2018-04-20T11:58:21Z")
When to choose multiple config files over multiple prospectors? To configure multiple files, in version 6, do we need to use -c command or config\_dir property? --- ## [Kubernetes example not working](https://discuss.elastic.co/t/kubernetes-example-not-working/128861)
**Author:** [@Jonas\_Scherer](https://discuss.elastic.co/u/Jonas_Scherer)\ **Replies:** 1\ **Last updated:** [April 20, 2018, 11:15am UTC](https://discuss.elastic.co/t/kubernetes-example-not-working/128861 "2018-04-20T11:15:23Z")
Hey, if I try the standard Kubernetes example of filebeats, I get this error: Error: failed to prepare subPath for volumeMount "config" of container "filebeat" Does anyone have a solution to this problem? Thank y… --- ## [Filebeat as daemon on macOS](https://discuss.elastic.co/t/filebeat-as-daemon-on-macos/128803)
**Author:** [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\ **Replies:** 2\ **Last updated:** [April 20, 2018, 10:14am UTC](https://discuss.elastic.co/t/filebeat-as-daemon-on-macos/128803 "2018-04-20T10:14:22Z")
Hi, I am running filebeat as a daemon on macOS 10.13.4. I have a plist for that at /Library/LaunchDaemons that keeps filebeat alive. I noticed that, when filebeat stats, this is logged on system.log: (co.elastic.fileb… --- ## [Metricbeat indices default to 5 shards](https://discuss.elastic.co/t/metricbeat-indices-default-to-5-shards/128703)
**Author:** [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Replies:** 3\ **Last updated:** [April 20, 2018, 6:56am UTC](https://discuss.elastic.co/t/metricbeat-indices-default-to-5-shards/128703 "2018-04-20T06:56:53Z")
I'm a little stumped on this one, though I feel like it's something easy that I'm missing. In both cases, updating to 6.2.4 sets the default number of shards in new indices to 5. Even though this: index.number\_of\_shards… --- ## [Centralized Agent Config File](https://discuss.elastic.co/t/centralized-agent-config-file/128252)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 7\ **Last updated:** [April 20, 2018, 2:15am UTC](https://discuss.elastic.co/t/centralized-agent-config-file/128252 "2018-04-20T02:15:47Z")
Is it possible to have two config files for each beat. One residing on a network share that hands out the base config to all agents and then a second that is customized for each machine? The config file I am using for … --- ## [Filebeat throwing i/o timeout while sending logs to logstash](https://discuss.elastic.co/t/filebeat-throwing-i-o-timeout-while-sending-logs-to-logstash/128397)
**Author:** [@sauravsuman689](https://discuss.elastic.co/u/sauravsuman689)\ **Replies:** 10\ **Last updated:** [April 20, 2018, 2:12am UTC](https://discuss.elastic.co/t/filebeat-throwing-i-o-timeout-while-sending-logs-to-logstash/128397 "2018-04-20T02:12:44Z")
Hi, When I stated my filebeat in debug mode I am seeing below logs - 2018-04-17T10:42:22.876Z DEBUG \[prospector\] log/prospector.go:499 Harvester for file is still running: /dcos/volume1/carbook-test-nginx/logs/error.lo… --- ## [Elasticsearch not receving Packetbeat after x-pack upgrade](https://discuss.elastic.co/t/elasticsearch-not-receving-packetbeat-after-x-pack-upgrade/128205)
**Author:** [@imparker](https://discuss.elastic.co/u/imparker)\ **Replies:** 6\ **Last updated:** [April 19, 2018, 8:37pm UTC](https://discuss.elastic.co/t/elasticsearch-not-receving-packetbeat-after-x-pack-upgrade/128205 "2018-04-19T20:37:04Z")
I've pointed the elastic search output as follows: output.elasticsearch: hosts: \["Address:9200"\] username: "elastic" password: "The Genereated Password" set xpack monitoring to: xpack.monitoring.enabled: true I'm … --- ## [Error running the "metricbeat test modules" command: not registered, module not found](https://discuss.elastic.co/t/error-running-the-metricbeat-test-modules-command-not-registered-module-not-found/128576)
**Author:** [@aadam](https://discuss.elastic.co/u/aadam)\ **Replies:** 3\ **Last updated:** [April 19, 2018, 7:20pm UTC](https://discuss.elastic.co/t/error-running-the-metricbeat-test-modules-command-not-registered-module-not-found/128576 "2018-04-19T19:20:37Z")
Hi , Let me introduce you guys to my setup. I have a development environment where a created my own modules with my custom metricsets. I can run the binary mode and see that all is working fine with this command: (./met… --- ## [Filebeat include\_lines to match multiple regexes in the same multilines?](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474)
**Author:** [@sinaowolabi](https://discuss.elastic.co/u/sinaowolabi)\ **Replies:** 2\ **Last updated:** [April 19, 2018, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-include-lines-to-match-multiple-regexes-in-the-same-multilines/128474 "2018-04-19T16:36:26Z")
Hi I am trying to use filebeat to read multiple log files, from different applications but I want it to include only lines that have three matches in the lines. For example, lines that have both '\\ssession\_timing\\s' a… --- ## [Metricbeat Dashboard for Elasticsearch](https://discuss.elastic.co/t/metricbeat-dashboard-for-elasticsearch/128671)
**Author:** [@joltmann](https://discuss.elastic.co/u/joltmann)\ **Replies:** 2\ **Last updated:** [April 19, 2018, 12:53pm UTC](https://discuss.elastic.co/t/metricbeat-dashboard-for-elasticsearch/128671 "2018-04-19T12:53:39Z")
Hi, does anybody know if there a default Dashboard for elasticsearch module in metricbeat like redis or rabbitmq. Or should I create my own? Joern --- ## [Unable to start Metricbeat in OpenShift](https://discuss.elastic.co/t/unable-to-start-metricbeat-in-openshift/128533)
**Author:** [@ralfeus](https://discuss.elastic.co/u/ralfeus)\ **Replies:** 6\ **Last updated:** [April 19, 2018, 10:31am UTC](https://discuss.elastic.co/t/unable-to-start-metricbeat-in-openshift/128533 "2018-04-19T10:31:04Z")
Hi. I'm trying to run Metricbeat in OpenShift: oc v3.9.0-alpha.3+78ddc10 kubernetes v1.9.1+a0ce1bc657 features: Basic-Auth GSSAPI Kerberos SPNEGO Server https://openshift-ph.lan.net:8443 kubernetes v1.6.1+5115d708d7 I… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=455) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=457)