# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=459 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 460 --- ## [Multiple multiline patterns](https://discuss.elastic.co/t/multiple-multiline-patterns/127848)
**Author:** [@las](https://discuss.elastic.co/u/las)\ **Replies:** 1\ **Last updated:** [April 12, 2018, 9:25pm UTC](https://discuss.elastic.co/t/multiple-multiline-patterns/127848 "2018-04-12T21:25:27Z")
Is it possible to have multiple multiline patterns within a filebeat.yml? For example, #Set I multiline.pattern multiline.negate multiline.match #Set II multiline.pattern multiline.negate multiline.match multil… --- ## [Can we have multiple input and output section in logstash config file](https://discuss.elastic.co/t/can-we-have-multiple-input-and-output-section-in-logstash-config-file/127778)
**Author:** [@manjur](https://discuss.elastic.co/u/manjur)\ **Replies:** 5\ **Last updated:** [April 12, 2018, 4:18pm UTC](https://discuss.elastic.co/t/can-we-have-multiple-input-and-output-section-in-logstash-config-file/127778 "2018-04-12T16:18:05Z")
can we have multiple input and output section in logstash config file. So that we can deal with multiple indexes in same run. --- ## [Send FileBeat Logs to Specific Type and Index in Elastic Search](https://discuss.elastic.co/t/send-filebeat-logs-to-specific-type-and-index-in-elastic-search/127838)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 5\ **Last updated:** [April 12, 2018, 2:49pm UTC](https://discuss.elastic.co/t/send-filebeat-logs-to-specific-type-and-index-in-elastic-search/127838 "2018-04-12T14:49:59Z")
How can we configure FileBeat to send logs to specific Index and Type defined in Elastic Search, We have created a Mapping Inside an Index and have defined analyzers on the Mapping. But we cannot seem to configure FileB… --- ## [How to see the logs are shipped from filebeat to logstash](https://discuss.elastic.co/t/how-to-see-the-logs-are-shipped-from-filebeat-to-logstash/127792)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 9\ **Last updated:** [April 12, 2018, 2:01pm UTC](https://discuss.elastic.co/t/how-to-see-the-logs-are-shipped-from-filebeat-to-logstash/127792 "2018-04-12T14:01:37Z")
Hi All, I am using filebeat for the first time. How can i make sure that the actual logs are shipped to logstash from filebeat? How can i monitor that? i can see filebeat is running without any issues. I have enabled … --- ## [Auditbeat // File intergrity // Windows / GetFileAttributes: Access is denied](https://discuss.elastic.co/t/auditbeat-file-intergrity-windows-getfileattributes-access-is-denied/127804)
**Author:** [@0xFFFFFF](https://discuss.elastic.co/u/0xFFFFFF)\ **Replies:** 5\ **Last updated:** [April 12, 2018, 1:49pm UTC](https://discuss.elastic.co/t/auditbeat-file-intergrity-windows-getfileattributes-access-is-denied/127804 "2018-04-12T13:49:56Z")
Hi, Could you help me to solve an issue I faced, when turning on the recursive mode (to true), the auditbeat does not report any event. after further investigation i released the the issue is related to the auditbeat … --- ## [Hardware specification for FIlebeat](https://discuss.elastic.co/t/hardware-specification-for-filebeat/127596)
**Author:** [@Debashis](https://discuss.elastic.co/u/Debashis)\ **Replies:** 3\ **Last updated:** [April 12, 2018, 1:35pm UTC](https://discuss.elastic.co/t/hardware-specification-for-filebeat/127596 "2018-04-12T13:35:52Z")
Hi Guys, Can anyone help me out to find out any specific recommended hardware specification for Filebeat. --- ## [Metricbeat not registered error](https://discuss.elastic.co/t/metricbeat-not-registered-error/127788)
**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 12:36pm UTC](https://discuss.elastic.co/t/metricbeat-not-registered-error/127788 "2018-04-12T12:36:29Z")
2018/04/12 10:13:21.755608 beat.go:346: CRIT Exiting: 11 errors: metricset 'system/process\_summary' is not registered, metricset not found; metricset 'system/uptime' is not registered, metricset not found; host parsing f… --- ## [Filebeat-6.2.3： timestamp issue with output.kafka](https://discuss.elastic.co/t/filebeat-6-2-3-timestamp-issue-with-output-kafka/127800)
**Author:** [@Brian\_Chung](https://discuss.elastic.co/u/Brian_Chung)\ **Replies:** 2\ **Last updated:** [April 12, 2018, 11:35am UTC](https://discuss.elastic.co/t/filebeat-6-2-3-timestamp-issue-with-output-kafka/127800 "2018-04-12T11:35:08Z")
filebeat version: filebeat-6.2.3 kafka version: 0.10.2.1 filebeat.yml as follows: filebeat.prospectors: type: log enabled: ture paths: /opt/filebeat/test.log fields: log\_topic: test tag: bdu output.kafka: … --- ## [Problem caused by change of fieldtype after upgrade of filebeat](https://discuss.elastic.co/t/problem-caused-by-change-of-fieldtype-after-upgrade-of-filebeat/126049)
**Author:** [@virapp](https://discuss.elastic.co/u/virapp)\ **Replies:** 3\ **Last updated:** [April 12, 2018, 10:20am UTC](https://discuss.elastic.co/t/problem-caused-by-change-of-fieldtype-after-upgrade-of-filebeat/126049 "2018-04-12T10:20:15Z")
Hi! We recently updated our filebeat-shippers from 5.2 to 6.2 and one of our dev teams noticed that our Grok filters in our logstash indexers weren't applied to their logs. Efter some troubleshooting we noticed that th… --- ## [How to transform data from sql server to elastic search through beats?](https://discuss.elastic.co/t/how-to-transform-data-from-sql-server-to-elastic-search-through-beats/127487)
**Author:** [@manjur](https://discuss.elastic.co/u/manjur)\ **Replies:** 6\ **Last updated:** [April 12, 2018, 9:15am UTC](https://discuss.elastic.co/t/how-to-transform-data-from-sql-server-to-elastic-search-through-beats/127487 "2018-04-12T09:15:50Z")
Hi, I need to transform data from sql server to elastic search. I did it through Logstash. Which beat i should use to transform data from sql server without using logstash --- ## [Filebeat Cant connect: ERROR x509: cannot validate certificate for x.xx.xx.xxx because it doesn't contain any IP SANs](https://discuss.elastic.co/t/filebeat-cant-connect-error-x509-cannot-validate-certificate-for-x-xx-xx-xxx-because-it-doesnt-contain-any-ip-sans/127089)
**Author:** [@Peeyush\_Gupta](https://discuss.elastic.co/u/Peeyush_Gupta)\ **Replies:** 11\ **Last updated:** [April 12, 2018, 8:21am UTC](https://discuss.elastic.co/t/filebeat-cant-connect-error-x509-cannot-validate-certificate-for-x-xx-xx-xxx-because-it-doesnt-contain-any-ip-sans/127089 "2018-04-12T08:21:11Z")
Hi, I have been trying to connect filebeat to a cluster that has http encryption done, when I try to connect, I get this error: elasticsearch: https://xx.xx.xx.xx:9200... parse url... OK connection... parse hos… --- ## [Non-zero metrics in the last 30s- Filebeat](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223)
**Author:** [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 4:36pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223 "2018-04-11T16:36:08Z")
I am trying to pass my IIS logs to logstach using Filebeat and My logs are not showing in kibna . When I checked By Filebeat Log Below is the message it showing |2018-04-08T18:13:14.324Z|INFO|\[monitoring\]|log/log.go:1… --- ## [Metricbeat + Windows perfmon counters sent in separate JSONs in disagreement with docs](https://discuss.elastic.co/t/metricbeat-windows-perfmon-counters-sent-in-separate-jsons-in-disagreement-with-docs/127632)
**Author:** [@Itamar\_Syn\_Hershko](https://discuss.elastic.co/u/Itamar_Syn_Hershko)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 3:29pm UTC](https://discuss.elastic.co/t/metricbeat-windows-perfmon-counters-sent-in-separate-jsons-in-disagreement-with-docs/127632 "2018-04-11T15:29:12Z")
Hi, The issue is well explained in a ticket from Aug 17: https://github.com/elastic/beats/issues/4944. This is in disagreement with the docs (https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricse… --- ## [Missing EOL character - Can't read line](https://discuss.elastic.co/t/missing-eol-character-cant-read-line/127609)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 3\ **Last updated:** [April 11, 2018, 3:05pm UTC](https://discuss.elastic.co/t/missing-eol-character-cant-read-line/127609 "2018-04-11T15:05:32Z")
I am trying to capture magento's Report logs. Magento report are generated into a single file every time so you can have multiple reports at multiple files. I am harvesting them by using the path: /path/to/magento/rep… --- ## [Auditbeat - Drop events](https://discuss.elastic.co/t/auditbeat-drop-events/127585)
**Author:** [@elastic\_bees](https://discuss.elastic.co/u/elastic_bees)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 2:27pm UTC](https://discuss.elastic.co/t/auditbeat-drop-events/127585 "2018-04-11T14:27:07Z")
Hi there, I'm looking to drop all successful events collected with Auditbeat: At the end of my yaml file I've put this: processors: - drop\_event: when: auditd.result: "success" But in Kibana I still can see result… --- ## [I need to install filebeat service with Powershell disabled](https://discuss.elastic.co/t/i-need-to-install-filebeat-service-with-powershell-disabled/127543)
**Author:** [@JimP](https://discuss.elastic.co/u/JimP)\ **Replies:** 2\ **Last updated:** [April 11, 2018, 1:56pm UTC](https://discuss.elastic.co/t/i-need-to-install-filebeat-service-with-powershell-disabled/127543 "2018-04-11T13:56:23Z")
Powershell is disabled by internal InfoSec dept. How else can I install filebeat as a service on Windows 2012 R2 Datacenter, please? I see that when installed with Powershell the service has this. "D:\\filebeat-6.2.3-w… --- ## [Unable to start filebeat.error missing fileld](https://discuss.elastic.co/t/unable-to-start-filebeat-error-missing-fileld/127428)
**Author:** [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Replies:** 12\ **Last updated:** [April 11, 2018, 12:51pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-error-missing-fileld/127428 "2018-04-11T12:51:59Z")
Below is my filebeat.yml file , I am unable to start service getting error filebeat.prospectors: - input\_type: log \*\* paths:\*\* \*\* - /opt/apache-tomcat-7.0.82/logs/\*.log\*\* document\_type: apache-access fields\_und… --- ## [Importing by hand the search / visualization / dashboard of metricbeats in Kibana 5.5.0](https://discuss.elastic.co/t/importing-by-hand-the-search-visualization-dashboard-of-metricbeats-in-kibana-5-5-0/126911)
**Author:** [@DidierB](https://discuss.elastic.co/u/DidierB)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 11:44am UTC](https://discuss.elastic.co/t/importing-by-hand-the-search-visualization-dashboard-of-metricbeats-in-kibana-5-5-0/126911 "2018-04-11T11:44:36Z")
Hello, I am generating a lot of metricbeats that go through some intermediates systems which means the events can reach the Elasticsearch but the import of example dashboard will fail. However, from the metricbeats arc… --- ## [Standard "Filebeat won't send to Logstash" question](https://discuss.elastic.co/t/standard-filebeat-wont-send-to-logstash-question/127165)
**Author:** [@snowy](https://discuss.elastic.co/u/snowy)\ **Replies:** 4\ **Last updated:** [April 11, 2018, 11:08am UTC](https://discuss.elastic.co/t/standard-filebeat-wont-send-to-logstash-question/127165 "2018-04-11T11:08:23Z")
I can't seem to find any hint in my logs that Filebeats is even trying to send the logs. This is version 6.2.3. #=========================== Filebeat prospectors ============================= filebeat.prospectors: # E… --- ## [Vsphere Module error](https://discuss.elastic.co/t/vsphere-module-error/127545)
**Author:** [@dilip](https://discuss.elastic.co/u/dilip)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 7:51am UTC](https://discuss.elastic.co/t/vsphere-module-error/127545 "2018-04-11T07:51:31Z")
Hi, I am getting the below error while running the metricbeat with Vsphere module. 2018/04/10 20:06:36.470992 beat.go:433: INFO Beat UUID: 3287846b-a4e9-49b8-952b-b624ddbf6ba7 2018/04/10 20:06:36.470992 beat.go:192: I… --- ## [Use Elastic APM to measure performance of filebeat](https://discuss.elastic.co/t/use-elastic-apm-to-measure-performance-of-filebeat/127463)
**Author:** [@Omair\_Khalid](https://discuss.elastic.co/u/Omair_Khalid)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 6:48am UTC](https://discuss.elastic.co/t/use-elastic-apm-to-measure-performance-of-filebeat/127463 "2018-04-11T06:48:07Z")
At the moment, is it possible to measure the performance of filebeat running as a service on a client machine through APM agent. I know the APM have been recently introduced by Elastic team as well and availaible for nod… --- ## [Configure Filebeat on Kubenetes](https://discuss.elastic.co/t/configure-filebeat-on-kubenetes/127531)
**Author:** [@Stefano\_Pirrello](https://discuss.elastic.co/u/Stefano_Pirrello)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 7:08pm UTC](https://discuss.elastic.co/t/configure-filebeat-on-kubenetes/127531 "2018-04-10T19:08:31Z")
Hi, I'm trying to follow this guide for setting up Filebeats on our K8s cluster (v1.5.4) and the daemonset starts successfully but we never see logs shipped to Logstash. I checked the logs on one of the filebeats daemo… --- ## [Execute a custom SQL query using mysql metricbeat module](https://discuss.elastic.co/t/execute-a-custom-sql-query-using-mysql-metricbeat-module/125960)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 9\ **Last updated:** [April 10, 2018, 6:21pm UTC](https://discuss.elastic.co/t/execute-a-custom-sql-query-using-mysql-metricbeat-module/125960 "2018-04-10T18:21:03Z")
Hi, I want to run a custom SQL query (to get the count of records in a table) using mysql metricbeat module. Is this possible? If this is not possible, then I want to create a custom metricset in mysql metricbeat modul… --- ## [Registry Error Upgrading Beats, Safe to Delete Registry File?](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394)
**Author:** [@aidanhl](https://discuss.elastic.co/u/aidanhl)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 4:43pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394 "2018-04-10T16:43:49Z")
Hello, I am upgrading filebeat from version 1.0.0 to 6.2.3. I have the process just about ready to go against a group of machines, but filebeat 6.2.3 fails to start with the full error: Exiting: Could not start registr… --- ## [Haproxy extra stat fields](https://discuss.elastic.co/t/haproxy-extra-stat-fields/127445)
**Author:** [@eirc](https://discuss.elastic.co/u/eirc)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 2:33pm UTC](https://discuss.elastic.co/t/haproxy-extra-stat-fields/127445 "2018-04-10T14:33:12Z")
There are a lot of extra fields in the haproxy stat output that metricbeat does not track. In fact it seems to only track fields up to the ttime field 61. Fields 62 to 82 are missing. Any plans to add those? Should I op… --- ## [Extract date from message](https://discuss.elastic.co/t/extract-date-from-message/127404)
**Author:** [@las](https://discuss.elastic.co/u/las)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 11:12am UTC](https://discuss.elastic.co/t/extract-date-from-message/127404 "2018-04-10T11:12:50Z")
Can filebeat extract date from log message before sending to outputs like elastic search or kafka? --- ## [Load watch.poll\_file from a url?](https://discuss.elastic.co/t/load-watch-poll-file-from-a-url/127395)
**Author:** [@exwizzard](https://discuss.elastic.co/u/exwizzard)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 10:24am UTC](https://discuss.elastic.co/t/load-watch-poll-file-from-a-url/127395 "2018-04-10T10:24:07Z")
I would like to dynamically add and remove hosts to be pinged via heartbeat, currently using FTP to upload a json file but I was wondering if it could be made to load a json file from a URL? Or if anyone has any better s… --- ## [Topbeats - My first load into Elastic](https://discuss.elastic.co/t/topbeats-my-first-load-into-elastic/127324)
**Author:** [@mark.lawton2](https://discuss.elastic.co/u/mark.lawton2)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 10:21am UTC](https://discuss.elastic.co/t/topbeats-my-first-load-into-elastic/127324 "2018-04-10T10:21:36Z")
Hello, newbie here. I'm just having a play with Elasticsearch, Kibana and Topbeats. All of the above are on the same linux server with default configuration - APART from me changing the elasticsearch and kibana host fro… --- ## [Metricbeat failed to start on linux](https://discuss.elastic.co/t/metricbeat-failed-to-start-on-linux/127410)
**Author:** [@Timotius\_Pamungkas](https://discuss.elastic.co/u/Timotius_Pamungkas)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 5:35am UTC](https://discuss.elastic.co/t/metricbeat-failed-to-start-on-linux/127410 "2018-04-10T05:35:31Z")
I can's start metricbeat service on linux. I'm following the guides on https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-starting.html But when starting metricbeat, it shows following error: $ sudo se… --- ## [File beats in docker. How to access host logs?](https://discuss.elastic.co/t/file-beats-in-docker-how-to-access-host-logs/127313)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [April 9, 2018, 5:34pm UTC](https://discuss.elastic.co/t/file-beats-in-docker-how-to-access-host-logs/127313 "2018-04-09T17:34:54Z")
Hi, I am thinking of running filebeat in a docker container. But I wanna ship logs from the host. What is the best practice? Use a volume to make the host logs accessible from inside of the docker container? Or how? T… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=458) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=460)