# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=458 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 459 --- ## [What is the behaviour if loadbalance=false is not configured](https://discuss.elastic.co/t/what-is-the-behaviour-if-loadbalance-false-is-not-configured/128175)
**Author:** [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 11:19am UTC](https://discuss.elastic.co/t/what-is-the-behaviour-if-loadbalance-false-is-not-configured/128175 "2018-04-16T11:19:38Z")
Hi, we have not configured load balance as false in filebeat.yml as the default value for this is false. But we have configured two hosts in filebeat.yml. observation: the logs are distributed on both the nodes and w… --- ## [High load cpu with filebeat windows](https://discuss.elastic.co/t/high-load-cpu-with-filebeat-windows/128168)
**Author:** [@zeenon](https://discuss.elastic.co/u/zeenon)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 10:56am UTC](https://discuss.elastic.co/t/high-load-cpu-with-filebeat-windows/128168 "2018-04-16T10:56:02Z")
We are currently using filebeat on a lot of servers, Linux Red Hat 7.2 or Windows 2008 server. We have no issues with linux servers and we have a very low CPU consuption. We have some troubles with filebeat 5.5.2 on W… --- ## [Unable to get metrics for single process in metricbeat 6.2.2](https://discuss.elastic.co/t/unable-to-get-metrics-for-single-process-in-metricbeat-6-2-2/125611)
**Author:** [@krishsai04](https://discuss.elastic.co/u/krishsai04)\ **Replies:** 5\ **Last updated:** [April 16, 2018, 9:26am UTC](https://discuss.elastic.co/t/unable-to-get-metrics-for-single-process-in-metricbeat-6-2-2/125611 "2018-04-16T09:26:21Z")
Hi, I am unable to get metrics for single process (custom c# console application) in metricbeat 6.2.2. I have configured metricbeat.yml properly,Can anyone tell me whats going wrong in below configuration. metricbeat.c… --- ## [How to start filebeat so that it stops after reading a file](https://discuss.elastic.co/t/how-to-start-filebeat-so-that-it-stops-after-reading-a-file/128110)
**Author:** [@terminaattori](https://discuss.elastic.co/u/terminaattori)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:47am UTC](https://discuss.elastic.co/t/how-to-start-filebeat-so-that-it-stops-after-reading-a-file/128110 "2018-04-16T08:47:10Z")
Hey! I am currently trying to parse my old logfiles to elasticsearch. I have a bash script for this and everything would be running fine without the fact that after I have run a file through filebeat to logstash, the fi… --- ## [Packing all beats installer](https://discuss.elastic.co/t/packing-all-beats-installer/128041)
**Author:** [@br14nb0](https://discuss.elastic.co/u/br14nb0)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:44am UTC](https://discuss.elastic.co/t/packing-all-beats-installer/128041 "2018-04-16T08:44:33Z")
Hello guys, can I install and deploy beats into remote servers without install manual directly on them ? In a distributed system, I just want to dynamic install beats. --- ## [Why filebeat hug GOLANG and give up Java?](https://discuss.elastic.co/t/why-filebeat-hug-golang-and-give-up-java/127888)
**Author:** [@jackyshen](https://discuss.elastic.co/u/jackyshen)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 1:53am UTC](https://discuss.elastic.co/t/why-filebeat-hug-golang-and-give-up-java/127888 "2018-04-16T01:53:18Z")
We know that the logstash-forwarder ,the predecessor of filebeat , has two versions, one is Java and another is GOLANG , however currently the filebeat just has one GOLANG version, may I know the reasons why filebeat … --- ## [Where do I place Grok Filter for IIS on logstash](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051)
**Author:** [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Replies:** 1\ **Last updated:** [April 14, 2018, 5:46pm UTC](https://discuss.elastic.co/t/where-do-i-place-grok-filter-for-iis-on-logstash/128051 "2018-04-14T17:46:48Z")
Hi, I have a elk stack installed on windows server and I am trying to input grok filter for IIS. Where do I put that? Is it on the logstash config file? When I place it on there, I lose connection from filebeats. input… --- ## [Filter and tag windows event logs on logstash](https://discuss.elastic.co/t/filter-and-tag-windows-event-logs-on-logstash/128052)
**Author:** [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Replies:** 0\ **Last updated:** [April 14, 2018, 4:22pm UTC](https://discuss.elastic.co/t/filter-and-tag-windows-event-logs-on-logstash/128052 "2018-04-14T16:22:22Z")
Hi, We are trying to send out all event logs from windows servers to ELK server and filter + tag on logstash. How would we filter that on logstash? We are trying to tag every possible threat or alert. For example if it'… --- ## [Packetbeat postgresql](https://discuss.elastic.co/t/packetbeat-postgresql/127577)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 2\ **Last updated:** [April 14, 2018, 1:03pm UTC](https://discuss.elastic.co/t/packetbeat-postgresql/127577 "2018-04-14T13:03:41Z")
Hallo, I experience some funny errors when dealing with packetbeat and the postgresql module. First of all, I can see Data being send to Elasticsearch and I can view them in Kibana. Secondly, I think it is more a bug … --- ## [Autodiscover - docker - catch all others](https://discuss.elastic.co/t/autodiscover-docker-catch-all-others/127868)
**Author:** [@setiseta](https://discuss.elastic.co/u/setiseta)\ **Replies:** 5\ **Last updated:** [April 14, 2018, 10:00am UTC](https://discuss.elastic.co/t/autodiscover-docker-catch-all-others/127868 "2018-04-14T10:00:38Z")
Hello, I want to setup autodiscover of type docker, do some special configs for some images and at the end I want to catch all other containers to log as is. But i haven't found how to configure the 'catch all others'. … --- ## [PacketBeat not loading dashboards to kibana](https://discuss.elastic.co/t/packetbeat-not-loading-dashboards-to-kibana/127661)
**Author:** [@imparker](https://discuss.elastic.co/u/imparker)\ **Replies:** 9\ **Last updated:** [April 13, 2018, 8:51pm UTC](https://discuss.elastic.co/t/packetbeat-not-loading-dashboards-to-kibana/127661 "2018-04-13T20:51:04Z")
I have packetbeat running on a windows server that's sending logs to an ubuntu 16 server. I'm receiving logs without issue, but the dashboards from the beats install either not being loaded or I simply can't open them, … --- ## [WinPcaP](https://discuss.elastic.co/t/winpcap/128015)
**Author:** [@codeguru](https://discuss.elastic.co/u/codeguru)\ **Replies:** 0\ **Last updated:** [April 13, 2018, 5:26pm UTC](https://discuss.elastic.co/t/winpcap/128015 "2018-04-13T17:26:32Z")
I want to install Packetbeat on couple of machines in my environment. I am trying to automate the process and creating scripts which installs winpcap on all remote machines silently. I had some issues achieving this, wha… --- ## [ArchLinux package: Missing commons beat fields like @timestamp in template](https://discuss.elastic.co/t/archlinux-package-missing-commons-beat-fields-like-timestamp-in-template/127893)
**Author:** [@Jonatan\_Cloutier](https://discuss.elastic.co/u/Jonatan_Cloutier)\ **Replies:** 2\ **Last updated:** [April 13, 2018, 4:37pm UTC](https://discuss.elastic.co/t/archlinux-package-missing-commons-beat-fields-like-timestamp-in-template/127893 "2018-04-13T16:37:47Z")
Hi, I did setup a new elasticSearch with kibana and some beats, but I get an error when trying to create a indexPattern: "The indices which match this index pattern don't contain any time fields." As most discussion I f… --- ## [Should Beats modules overwrite Kibana dashboards?](https://discuss.elastic.co/t/should-beats-modules-overwrite-kibana-dashboards/127984)
**Author:** [@Loek](https://discuss.elastic.co/u/Loek)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 4:23pm UTC](https://discuss.elastic.co/t/should-beats-modules-overwrite-kibana-dashboards/127984 "2018-04-13T16:23:21Z")
Following up on add note about overwriting dashboards by loekvangool · Pull Request #6828 · elastic/beats · GitHub. It seems that Beats now overwrites dashboards (https://github.com/elastic/beats/blob/9e2838d9ecaf4d9c3e… --- ## [Logs transfer thru Filebeat to Logstash](https://discuss.elastic.co/t/logs-transfer-thru-filebeat-to-logstash/127978)
**Author:** [@ashurawat](https://discuss.elastic.co/u/ashurawat)\ **Replies:** 2\ **Last updated:** [April 13, 2018, 4:17pm UTC](https://discuss.elastic.co/t/logs-transfer-thru-filebeat-to-logstash/127978 "2018-04-13T16:17:37Z")
Please suggest the best technique to be used while sending the data thru filebeat to logstash Filebeat directly sending the data to logstash Filebeat should send the data to REDIS/KAFKA and then from their logstash is … --- ## [Multiline, Nonconsecutive](https://discuss.elastic.co/t/multiline-nonconsecutive/127973)
**Author:** [@Lazarbeam](https://discuss.elastic.co/u/Lazarbeam)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 4:03pm UTC](https://discuss.elastic.co/t/multiline-nonconsecutive/127973 "2018-04-13T16:03:57Z")
All -- We have logs that look like the following: 8 - {5587} Data1 8 - {5587} Data2 8 - {18573} Data1 8 - {18573} Data2 8 - {18551} Data1 8 - {18551} Data2 8 - {9610} Data1 8 - {18574} Data1 8 - {9610} Data2 8 - {18574… --- ## [FileBeat Service stops every night same time on most of our servers](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964)
**Author:** [@Hussain\_Kothari](https://discuss.elastic.co/u/Hussain_Kothari)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964 "2018-04-13T16:00:23Z")
I have installed Filebeat 5.2.0 on windows 2012 R2 server. The issue I have is the filebeat service stops at a particular time on most of our servers. The Log file does not have any error but just info. I have set the se… --- ## [Handling permissions on logs and certificates with filebeat / logstash](https://discuss.elastic.co/t/handling-permissions-on-logs-and-certificates-with-filebeat-logstash/127826)
**Author:** [@va1entin](https://discuss.elastic.co/u/va1entin)\ **Replies:** 5\ **Last updated:** [April 13, 2018, 3:34pm UTC](https://discuss.elastic.co/t/handling-permissions-on-logs-and-certificates-with-filebeat-logstash/127826 "2018-04-13T15:34:49Z")
Hey folks, I'm currently setting up an Elastic Stack in my company using the official Docker containers. There's one thing I didn't find a satisfying answer to so far. When I run Filebeat in a docker container, I need … --- ## [Read Nested JSON Using FIle Beat](https://discuss.elastic.co/t/read-nested-json-using-file-beat/127883)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 3:20pm UTC](https://discuss.elastic.co/t/read-nested-json-using-file-beat/127883 "2018-04-13T15:20:07Z")
We are having logs in JSON format, but the JSON message can have a nested structure. How can we read nested JSON using File Beat? --- ## [Metricbeat - Number of processes based on patterns](https://discuss.elastic.co/t/metricbeat-number-of-processes-based-on-patterns/127836)
**Author:** [@bayerb](https://discuss.elastic.co/u/bayerb)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 2:35pm UTC](https://discuss.elastic.co/t/metricbeat-number-of-processes-based-on-patterns/127836 "2018-04-13T14:35:49Z")
Hi, in elastic in a document I would like to see the number of processes matching a given regex. For instance if there are 2 processes running with a specific name, than in a document I would like to see a "numberOfInst… --- ## [Can i change my target ip and port dynamically when my proxy server have changed for ip and port?](https://discuss.elastic.co/t/can-i-change-my-target-ip-and-port-dynamically-when-my-proxy-server-have-changed-for-ip-and-port/127758)
**Author:** [@qianying1](https://discuss.elastic.co/u/qianying1)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 2:04pm UTC](https://discuss.elastic.co/t/can-i-change-my-target-ip-and-port-dynamically-when-my-proxy-server-have-changed-for-ip-and-port/127758 "2018-04-13T14:04:33Z")
Help me to solve this problem please , every guru. --- ## [Metricbeat data source](https://discuss.elastic.co/t/metricbeat-data-source/127683)
**Author:** [@Alex\_Mendez](https://discuss.elastic.co/u/Alex_Mendez)\ **Replies:** 1\ **Last updated:** [April 13, 2018, 1:58pm UTC](https://discuss.elastic.co/t/metricbeat-data-source/127683 "2018-04-13T13:58:42Z")
Is there a way to pull metric beat data from a single source for many servers, example syslog, filebeat style? thanks --- ## [How to package metricbeat code](https://discuss.elastic.co/t/how-to-package-metricbeat-code/127597)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 2\ **Last updated:** [April 13, 2018, 1:27pm UTC](https://discuss.elastic.co/t/how-to-package-metricbeat-code/127597 "2018-04-13T13:27:48Z")
Hi, I have checked out the metricbeat code from https://github.com/elastic/beats Now, how can I build the code in my local machine so that I can get the Windows zip file as present in https://www.elastic.co/downloads/b… --- ## [ERROR instance/beat Exiting: Error in initing prospector: No paths were defined for prospector accessing config](https://discuss.elastic.co/t/error-instance-beat-exiting-error-in-initing-prospector-no-paths-were-defined-for-prospector-accessing-config/127553)
**Author:** [@APJ](https://discuss.elastic.co/u/APJ)\ **Replies:** 9\ **Last updated:** [April 13, 2018, 1:25pm UTC](https://discuss.elastic.co/t/error-instance-beat-exiting-error-in-initing-prospector-no-paths-were-defined-for-prospector-accessing-config/127553 "2018-04-13T13:25:57Z")
I am trying to visualize sample data on Kibana using Windows. I followed the link to Security Analytics section to setup Elasticsearch, Kibana and Filebeats. Link to installation (Security Analytics) I have installed El… --- ## [Filebeat doesn't show in kibana monitoring](https://discuss.elastic.co/t/filebeat-doesnt-show-in-kibana-monitoring/127474)
**Author:** [@roketyyang](https://discuss.elastic.co/u/roketyyang)\ **Replies:** 13\ **Last updated:** [April 13, 2018, 11:52am UTC](https://discuss.elastic.co/t/filebeat-doesnt-show-in-kibana-monitoring/127474 "2018-04-13T11:52:48Z")
I have two filebeat running. But I just can see one filebeat instance in kibana monitoring. Both filebeat are sending monitor metric: {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":10,"time":17},"total"… --- ## [Flush pattern](https://discuss.elastic.co/t/flush-pattern/127509)
**Author:** [@las](https://discuss.elastic.co/u/las)\ **Replies:** 3\ **Last updated:** [April 13, 2018, 11:46am UTC](https://discuss.elastic.co/t/flush-pattern/127509 "2018-04-13T11:46:05Z")
I am using flush pattern to extract multiline messages. Filebeat seems to be looking for the 1st occurence of the flush pattern to group the lines. Is there a way to have filebeat look for the last occurence of the flush… --- ## [Error importing Kibana dashboards:](https://discuss.elastic.co/t/error-importing-kibana-dashboards/127897)
**Author:** [@stephenpatten](https://discuss.elastic.co/u/stephenpatten)\ **Replies:** 2\ **Last updated:** [April 13, 2018, 11:35am UTC](https://discuss.elastic.co/t/error-importing-kibana-dashboards/127897 "2018-04-13T11:35:32Z")
Hello, I am getting this error when executing heartbeat from the windows command line: Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: fail to get the Kibana … --- ## [Failed to start filebeat](https://discuss.elastic.co/t/failed-to-start-filebeat/127891)
**Author:** [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)\ **Replies:** 8\ **Last updated:** [April 13, 2018, 9:08am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891 "2018-04-13T09:08:00Z")
im testing to check if my filebeat is running using this script " curl -XGET 'http://localhost:9200/filebeat-\*/\_search?pretty'" and the output was { "took" : 1, "timed\_out" : false, "\_shards" : { "total" : 0, "succ… --- ## [Filebeat Consumes High CPU:](https://discuss.elastic.co/t/filebeat-consumes-high-cpu/127000)
**Author:** [@Kareny](https://discuss.elastic.co/u/Kareny)\ **Replies:** 4\ **Last updated:** [April 13, 2018, 7:03am UTC](https://discuss.elastic.co/t/filebeat-consumes-high-cpu/127000 "2018-04-13T07:03:34Z")
Hi, I'm using filebeat to watch some bro logs. But the filebeat turns out to consume 60% cpu to catch up with new logs with speed of 8k to 10k eps. Here's my filebeat config: filebeat: prospectors: - close\_inactiv… --- ## [\[\[main\]\ **Author:** [@karto](https://discuss.elastic.co/u/karto)\ **Replies:** 16\ **Last updated:** [April 12, 2018, 11:37am UTC](https://discuss.elastic.co/t/main-beats-rejectedexecution-failed-to-submit-a-listener-notification-task-event-loop-shut-down/127608 "2018-04-12T11:37:42Z") Hello all, I'm new to elastic stack and i'm seeking some help. The log shipping worked just fine when i had 2 nodes but the second i'v added a third one i had this error when running the config file help would be much… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=457) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=459)