# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=460 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 461 --- ## [IIS Module for Filebeat](https://discuss.elastic.co/t/iis-module-for-filebeat/127224)
**Author:** [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\ **Replies:** 5\ **Last updated:** [April 9, 2018, 11:32am UTC](https://discuss.elastic.co/t/iis-module-for-filebeat/127224 "2018-04-09T11:32:24Z")
In which version of filebeat I can find IIS Module? This Document Showed IIS Module in 6.X version i am using 6.2.3 version now but there is no IIS Module in it https://www.elastic.co/guide/en/beats/filebeat/master/fil… --- ## [Filebeat, file truncated on glusterFS](https://discuss.elastic.co/t/filebeat-file-truncated-on-glusterfs/126710)
**Author:** [@swingbit](https://discuss.elastic.co/u/swingbit)\ **Replies:** 8\ **Last updated:** [April 9, 2018, 11:06am UTC](https://discuss.elastic.co/t/filebeat-file-truncated-on-glusterfs/126710 "2018-04-09T11:06:13Z")
An httpd log file is being stored on a glusterFS partition, never rotated, and read by filebeat (6.2.3). I should also mention that filebeat runs in a docker container, which maps the log file as a volume. This same co… --- ## [Can filebeat send logs over https to logstash?](https://discuss.elastic.co/t/can-filebeat-send-logs-over-https-to-logstash/127258)
**Author:** [@narendra\_reddy](https://discuss.elastic.co/u/narendra_reddy)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 10:20am UTC](https://discuss.elastic.co/t/can-filebeat-send-logs-over-https-to-logstash/127258 "2018-04-09T10:20:59Z")
Hi Team, Can filebeat send logs to logstash over https? the https option is there only for shipping logs to elasticsearch but not to logstash, is there a plan to include https output feature to logstash in future? Than… --- ## [Failed to start filebeat. (debian)](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202)
**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\ **Replies:** 2\ **Last updated:** [April 9, 2018, 9:58am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202 "2018-04-09T09:58:41Z")
I am using ELK as separate containers: $ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 3a3b9a48… --- ## [Error with the key](https://discuss.elastic.co/t/error-with-the-key/127267)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 3\ **Last updated:** [April 9, 2018, 9:49am UTC](https://discuss.elastic.co/t/error-with-the-key/127267 "2018-04-09T09:49:42Z")
I want install filebeat on my server but when I write this command wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - I got this error : gpg: no valid OpenPGP data found. How resolve it… --- ## [Need help for the correct multline pattern](https://discuss.elastic.co/t/need-help-for-the-correct-multline-pattern/127246)
**Author:** [@Vipra3003](https://discuss.elastic.co/u/Vipra3003)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 9:37am UTC](https://discuss.elastic.co/t/need-help-for-the-correct-multline-pattern/127246 "2018-04-09T09:37:12Z")
Hi I have to write multiline pattern in the filebeat.yml for the below logs for a tomcat server Please suggest what would be the correct pattern 2018-02-24 09:11:25,757 localhost-startStop-2 INFO \[c.a.jira.startu… --- ## [Filebeat Sending Whole File Repeatedly](https://discuss.elastic.co/t/filebeat-sending-whole-file-repeatedly/127002)
**Author:** [@derekcal](https://discuss.elastic.co/u/derekcal)\ **Replies:** 5\ **Last updated:** [April 9, 2018, 7:38am UTC](https://discuss.elastic.co/t/filebeat-sending-whole-file-repeatedly/127002 "2018-04-09T07:38:30Z")
Hello everyone, so I have configure filebeat to send a its own configurations to kafka, the issue is that filebeat keeps shipping the configs every 10s even though there are no changes to these files. Is there any way to… --- ## [Use filebeat to send different logs in different server](https://discuss.elastic.co/t/use-filebeat-to-send-different-logs-in-different-server/127103)
**Author:** [@adg](https://discuss.elastic.co/u/adg)\ **Replies:** 3\ **Last updated:** [April 9, 2018, 7:32am UTC](https://discuss.elastic.co/t/use-filebeat-to-send-different-logs-in-different-server/127103 "2018-04-09T07:32:03Z")
in one of my server having filebeat configure currently it send server.log ,localhost.log and localhost-access.log logs to centralized log server via /etc/filebeat/filebeat.yml output: logstash : \[ceterlizedIP:port\] … --- ## [Filebeat giving "mapper\_parsing\_exception error](https://discuss.elastic.co/t/filebeat-giving-mapper-parsing-exception-error/127110)
**Author:** [@Ashish\_Modi](https://discuss.elastic.co/u/Ashish_Modi)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 7:30am UTC](https://discuss.elastic.co/t/filebeat-giving-mapper-parsing-exception-error/127110 "2018-04-09T07:30:18Z")
We have filebeat on our linux box which periodically sends logs to elastic search and from there kibana is used to display them. In the scenario our application generates two types of logs: Type 1 - {"data": "some strin… --- ## [Metricbeat Elasticsearch module fields](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-fields/127108)
**Author:** [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 7:26am UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-fields/127108 "2018-04-09T07:26:21Z")
I want to ask about Metricbeat Elasticsearch module fields: elasticsearch.node.stats.jvm.gc.collectors.young.collection.ms - As I understood, it's accumulative metric. Am I right? elasticsearch.node.stats.jvm.gc.collec… --- ## [How to enable symlinks?](https://discuss.elastic.co/t/how-to-enable-symlinks/126852)
**Author:** [@ayrodrig](https://discuss.elastic.co/u/ayrodrig)\ **Replies:** 7\ **Last updated:** [April 9, 2018, 6:21am UTC](https://discuss.elastic.co/t/how-to-enable-symlinks/126852 "2018-04-09T06:21:35Z")
Hi there! I'm pretty much interested in enabling the symlinks option for the reason already stated at the documentation https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#\_literal… --- ## [Metric beat unable to start when Index changed](https://discuss.elastic.co/t/metric-beat-unable-to-start-when-index-changed/127161)
**Author:** [@ganeshmuralidhar](https://discuss.elastic.co/u/ganeshmuralidhar)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 5:16am UTC](https://discuss.elastic.co/t/metric-beat-unable-to-start-when-index-changed/127161 "2018-04-09T05:16:51Z")
Hi, I am trying to start metric beat on a server with the below config for Elastic Search Output \[image\] And I am seeing an error while starting metric beat with below message "Exiting: setup.template.name and setup.t… --- ## [Filebeat 6.2.3: Keystores](https://discuss.elastic.co/t/filebeat-6-2-3-keystores/127189)
**Author:** [@vinceh](https://discuss.elastic.co/u/vinceh)\ **Replies:** 1\ **Last updated:** [April 8, 2018, 7:24pm UTC](https://discuss.elastic.co/t/filebeat-6-2-3-keystores/127189 "2018-04-08T19:24:02Z")
Hi there, Wondering how I instruct filebeat to read from a specific keystore. I've generated the keystore and templated filebeat.yml as per: https://www.elastic.co/guide/en/beats/filebeat/current/keystore.html I cann… --- ## [How to differentiate between two kubernetes clusters with metricbeats](https://discuss.elastic.co/t/how-to-differentiate-between-two-kubernetes-clusters-with-metricbeats/125985)
**Author:** [@David\_Michael\_Gang](https://discuss.elastic.co/u/David_Michael_Gang)\ **Replies:** 4\ **Last updated:** [April 8, 2018, 2:36pm UTC](https://discuss.elastic.co/t/how-to-differentiate-between-two-kubernetes-clusters-with-metricbeats/125985 "2018-04-08T14:36:50Z")
Hi all, The instructions to install metricbeats on kubernetes are here . Let's say i have two clusters A and B, Is there a way to differentiate between both cklusters so that two different dashboards are made? What i… --- ## [Filebeat - Syslog module no auth.logs in Elastic](https://discuss.elastic.co/t/filebeat-syslog-module-no-auth-logs-in-elastic/125428)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 14\ **Last updated:** [April 8, 2018, 10:28am UTC](https://discuss.elastic.co/t/filebeat-syslog-module-no-auth-logs-in-elastic/125428 "2018-04-08T10:28:28Z")
HI, Just enabled the filebeat module - syslog on my Ubuntu 16.0.4 box. I'm getting syslog output into Elastic but not the auth.log files. I enabled debug from in the filebeat.yml file and can see the following so I'm a… --- ## [Kafka establishes tls1.2 with openssl, but not filebeat](https://discuss.elastic.co/t/kafka-establishes-tls1-2-with-openssl-but-not-filebeat/126824)
**Author:** [@cement](https://discuss.elastic.co/u/cement)\ **Replies:** 5\ **Last updated:** [April 6, 2018, 8:29pm UTC](https://discuss.elastic.co/t/kafka-establishes-tls1-2-with-openssl-but-not-filebeat/126824 "2018-04-06T20:29:10Z")
Filebeat is configured to talk to kafka over tls, but it fails with "INFO kafka/log.go:36 Failed to connect to broker : tls: first record does not look like a TLS handshake" openssl s\_client, using the same key, ca and… --- ## [Using environmnet variables for kafka output](https://discuss.elastic.co/t/using-environmnet-variables-for-kafka-output/127073)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [April 6, 2018, 1:00pm UTC](https://discuss.elastic.co/t/using-environmnet-variables-for-kafka-output/127073 "2018-04-06T13:00:43Z")
Following configuration is not working. output.kafka: enabled: true \*\*hosts: \["${KAFKA\_HOST\_1}", "${KAFKA\_HOST\_2}", "${KAFKA\_HOST\_3}"\]\*\* topic: ${KAFKA\_TOPIC\_NAME} /// Environment variables set as export KAFKA\_… --- ## [Filebeat not sending all the logs](https://discuss.elastic.co/t/filebeat-not-sending-all-the-logs/127046)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [April 6, 2018, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-all-the-logs/127046 "2018-04-06T12:47:08Z")
In quite a strange behavior, Filebeat periodically stops sending logs to ES. We have an arrangement where we have installed Filebeat to tail NGINX logs and it straight to ES (not via Logstash). Here's a graph showing 4… --- ## [MetricBeat - how to define Elasticsearch JVM metrics](https://discuss.elastic.co/t/metricbeat-how-to-define-elasticsearch-jvm-metrics/126756)
**Author:** [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\ **Replies:** 7\ **Last updated:** [April 6, 2018, 11:46am UTC](https://discuss.elastic.co/t/metricbeat-how-to-define-elasticsearch-jvm-metrics/126756 "2018-04-06T11:46:26Z")
Hello to everyone. I want to know how to define Elasticsearch JVM heap usage in percentage and number of garbage collectors per some period of time. I have already configure Elasticsearch module for Metricbeat and saw … --- ## [Winlogbeat Dashboard Problem - Visualize: "field" is a required parameter](https://discuss.elastic.co/t/winlogbeat-dashboard-problem-visualize-field-is-a-required-parameter/126995)
**Author:** [@George\_Jetson](https://discuss.elastic.co/u/George_Jetson)\ **Replies:** 2\ **Last updated:** [April 5, 2018, 9:36pm UTC](https://discuss.elastic.co/t/winlogbeat-dashboard-problem-visualize-field-is-a-required-parameter/126995 "2018-04-05T21:36:25Z")
New ELK 6.2.3 installation on Windows. I installed WLB on a Windows 2012R2 server and specified in the yml to setup dashboard. The index pattern and dashboard are there but I am getting the following error: \[image\] --- ## [Full http path?](https://discuss.elastic.co/t/full-http-path/125648)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 3\ **Last updated:** [April 5, 2018, 6:22pm UTC](https://discuss.elastic.co/t/full-http-path/125648 "2018-04-05T18:22:55Z")
Is it possible to have packetbeat output the full path including the domain name vs just the uri? Example: Display www.example.com/getmethispage/ vs. just showing /getmethispage --- ## [Setting up Filebeats, ELK, with Rails + Docker](https://discuss.elastic.co/t/setting-up-filebeats-elk-with-rails-docker/126262)
**Author:** [@superjose](https://discuss.elastic.co/u/superjose)\ **Replies:** 4\ **Last updated:** [April 5, 2018, 4:19pm UTC](https://discuss.elastic.co/t/setting-up-filebeats-elk-with-rails-docker/126262 "2018-04-05T16:19:46Z")
Hi everybody! Kudos to the @elastic team! It's impressive what this piece of software can do! :smile: I've been going through the docs, and googling through no avail. Hit Stack Overflow, and GitHub. I've studied the rep… --- ## [Can't collect metrics from Jolokia module](https://discuss.elastic.co/t/cant-collect-metrics-from-jolokia-module/126939)
**Author:** [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\ **Replies:** 2\ **Last updated:** [April 5, 2018, 2:32pm UTC](https://discuss.elastic.co/t/cant-collect-metrics-from-jolokia-module/126939 "2018-04-05T14:32:09Z")
Hello to everyone! I downloadedjolokia-jvm-1.5.0-agent.jar and made command java -javaagent:/path/to/jolokia-jvm-\-agent.jar start \[processId\]. And it started. - module: jolokia metricsets: \["jmx"\] enabled:… --- ## [Filebeat ssl kafka](https://discuss.elastic.co/t/filebeat-ssl-kafka/126923)
**Author:** [@ajayrc](https://discuss.elastic.co/u/ajayrc)\ **Replies:** 1\ **Last updated:** [April 5, 2018, 2:35pm UTC](https://discuss.elastic.co/t/filebeat-ssl-kafka/126923 "2018-04-05T14:35:33Z")
How to make file beat to send data to kafka via ssl ? am using the approach told here by anefassa but am getting error pipeline/output.go:74 kafka/client.go:69 Kafka connect fails with: kafka: client has run… --- ## [Filebeat to Kibana Connection Issue](https://discuss.elastic.co/t/filebeat-to-kibana-connection-issue/126943)
**Author:** [@echobb8](https://discuss.elastic.co/u/echobb8)\ **Replies:** 1\ **Last updated:** [April 5, 2018, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-to-kibana-connection-issue/126943 "2018-04-05T14:32:34Z")
Hey all, I have an Ubuntu VM running Elasticsearch and Kibana, and I'm trying to use Filebeat OSQuery module to pass OSQuery data to Elasticsearch. I enabled the OSQuery module on my client macOS system and am trying to… --- ## [Type:flow missing source fields](https://discuss.elastic.co/t/type-flow-missing-source-fields/126752)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 12\ **Last updated:** [April 5, 2018, 2:29pm UTC](https://discuss.elastic.co/t/type-flow-missing-source-fields/126752 "2018-04-05T14:29:15Z")
In research to find a solution for capturing and visualizing all kinds of traffic on a few remote dedicated servers with the lack of firewall syslogs and tried out packetbeats. It does not do the same, i know, but it giv… --- ## [Parsing JSON objects](https://discuss.elastic.co/t/parsing-json-objects/126906)
**Author:** [@Maek\_Twain](https://discuss.elastic.co/u/Maek_Twain)\ **Replies:** 1\ **Last updated:** [April 5, 2018, 2:06pm UTC](https://discuss.elastic.co/t/parsing-json-objects/126906 "2018-04-05T14:06:58Z")
I have a json logs coming from websites like this "{\\"path\\":\\"/visitors/events/\\",\\"value\\":{\\"fingerprint\\":\\"b9fcd389db7f5ca5fad9c767909c481a\\",\\"sessionId\\":\\"d7c41580-6155-1b2c-27f5-65c7e19a7174\\",\\"visitorId\\":\\"8… --- ## [Autodiscover + Docker decoding JSON: EOF](https://discuss.elastic.co/t/autodiscover-docker-decoding-json-eof/126615)
**Author:** [@strowi](https://discuss.elastic.co/u/strowi)\ **Replies:** 1\ **Last updated:** [April 5, 2018, 8:54am UTC](https://discuss.elastic.co/t/autodiscover-docker-decoding-json-eof/126615 "2018-04-05T08:54:38Z")
Hi, i am trying to get some nginx-logs from the container shipped to elasticsearch... but i am getting some json-decoding errors using filebeat 6.2.3. Weird thing is, these errors apper for already running containers. … --- ## [Filebeat not sending data to Elasticsearch or Logstash](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-or-logstash/126794)
**Author:** [@Brandonmcgr](https://discuss.elastic.co/u/Brandonmcgr)\ **Replies:** 2\ **Last updated:** [April 4, 2018, 5:48pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch-or-logstash/126794 "2018-04-04T17:48:41Z")
Hello, Forgive me if this is an issue that is repeated on here. Originally, I had this working with what must be the exact same process. But, since I rebuilt the virtual machines something is no longer working and data … --- ## [Drop event with multi layer conditions not working](https://discuss.elastic.co/t/drop-event-with-multi-layer-conditions-not-working/126644)
**Author:** [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\ **Replies:** 2\ **Last updated:** [April 4, 2018, 5:17pm UTC](https://discuss.elastic.co/t/drop-event-with-multi-layer-conditions-not-working/126644 "2018-04-04T17:17:06Z")
I have following drop event configuration: - drop\_event: when: or: - equals: kubernetes.namespace: "monitoring" - equals: kubernetes.namespace: "kube-public" … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=459) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=461)