# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=461 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 462 --- ## [Filebeat agent seems to die/exit when a log file its watching rotates](https://discuss.elastic.co/t/filebeat-agent-seems-to-die-exit-when-a-log-file-its-watching-rotates/126133)
**Author:** [@cmo23](https://discuss.elastic.co/u/cmo23)\ **Replies:** 7\ **Last updated:** [April 4, 2018, 4:06pm UTC](https://discuss.elastic.co/t/filebeat-agent-seems-to-die-exit-when-a-log-file-its-watching-rotates/126133 "2018-04-04T16:06:37Z")
I'm probably doing something obviously wrong here, in a nutshell is there anything special you need to do to handle log rotation of the logs being shipped by filebeat? i would have thought it'd be smart enough to handle… --- ## [Hearthbeat dashboard](https://discuss.elastic.co/t/hearthbeat-dashboard/126721)
**Author:** [@Ninoslav](https://discuss.elastic.co/u/Ninoslav)\ **Replies:** 5\ **Last updated:** [April 4, 2018, 2:50pm UTC](https://discuss.elastic.co/t/hearthbeat-dashboard/126721 "2018-04-04T14:50:33Z")
Hi gys, In my current setup, i have 2 CPU-s, 8GB RAM, no cluster. I have installed hearthbeat packet, to monitor the system performance of my Elastic stack, but when i try to load dashboard i get an error: The reques… --- ## [Autodiscover doesn't work for Nginx](https://discuss.elastic.co/t/autodiscover-doesnt-work-for-nginx/126735)
**Author:** [@Mugen](https://discuss.elastic.co/u/Mugen)\ **Replies:** 1\ **Last updated:** [April 4, 2018, 2:07pm UTC](https://discuss.elastic.co/t/autodiscover-doesnt-work-for-nginx/126735 "2018-04-04T14:07:52Z")
I am working with a Kubernetes-Cluster and try to get autodsicover (Filebeat 6.2.2) to work. Sadly it doesn't parse nginx logs even tough the field docker.container.image exists and contains the string "nginx" am I doing… --- ## [Description of metrics exposed by /stats endpoint](https://discuss.elastic.co/t/description-of-metrics-exposed-by-stats-endpoint/126205)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 6\ **Last updated:** [April 4, 2018, 12:51pm UTC](https://discuss.elastic.co/t/description-of-metrics-exposed-by-stats-endpoint/126205 "2018-04-04T12:51:48Z")
now that filebeat has a metrics endpoint (https://github.com/elastic/beats/pull/3717) we're trying to set up some rudimentary monitoring of our filebeat agents running on all nodes. Here's an example result that I pulle… --- ## [How do I write a processor plugin by myself?](https://discuss.elastic.co/t/how-do-i-write-a-processor-plugin-by-myself/126719)
**Author:** [@ma\_wen](https://discuss.elastic.co/u/ma_wen)\ **Replies:** 1\ **Last updated:** [April 4, 2018, 10:58am UTC](https://discuss.elastic.co/t/how-do-i-write-a-processor-plugin-by-myself/126719 "2018-04-04T10:58:05Z")
How do I write a processor plugin by myself? --- ## [Beats 6.2.x compatibility with ELK 5.6.x](https://discuss.elastic.co/t/beats-6-2-x-compatibility-with-elk-5-6-x/126062)
**Author:** [@adrian.aneci](https://discuss.elastic.co/u/adrian.aneci)\ **Replies:** 5\ **Last updated:** [April 4, 2018, 9:31am UTC](https://discuss.elastic.co/t/beats-6-2-x-compatibility-with-elk-5-6-x/126062 "2018-04-04T09:31:16Z")
Hi, Are the latest beats (version 6.2.x ) compatible with ELK 5.6.x? Based on the matrix compatibility found at https://www.elastic.co/support/matrix#matrix\_compatibility looks like they are not compatible, but I just … --- ## [Filebeat doesn't work with tail\_files for Multiline pattern files](https://discuss.elastic.co/t/filebeat-doesnt-work-with-tail-files-for-multiline-pattern-files/126674)
**Author:** [@ashurawat](https://discuss.elastic.co/u/ashurawat)\ **Replies:** 1\ **Last updated:** [April 4, 2018, 8:17am UTC](https://discuss.elastic.co/t/filebeat-doesnt-work-with-tail-files-for-multiline-pattern-files/126674 "2018-04-04T08:17:46Z")
I am trying with the option of tail\_files: true but its not even reading the files which are continuously coming to the directory. Its opening the prospector but not able to start harvester for any file. 2018/04/04 05… --- ## [Big differences between tcpdump and packetbeat](https://discuss.elastic.co/t/big-differences-between-tcpdump-and-packetbeat/126082)
**Author:** [@Aner\_Izraeli1](https://discuss.elastic.co/u/Aner_Izraeli1)\ **Replies:** 9\ **Last updated:** [April 4, 2018, 7:24am UTC](https://discuss.elastic.co/t/big-differences-between-tcpdump-and-packetbeat/126082 "2018-04-04T07:24:05Z")
Hello, im sniffing my mirrored traffic with packetbeat and see little amout of data on kibana. to compare - i tcpdumped my traffic, chose a string to grep - 'quattroruote' while running grep on tcpdump pcap file (more… --- ## [Winlogbeats not working with SSL configuration to Logstash](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502)
**Author:** [@patricktula](https://discuss.elastic.co/u/patricktula)\ **Replies:** 17\ **Last updated:** [April 4, 2018, 3:59am UTC](https://discuss.elastic.co/t/winlogbeats-not-working-with-ssl-configuration-to-logstash/126502 "2018-04-04T03:59:55Z")
Hi, I need some assistance with my Winlogbeats SSL configuration. My winlogbeats machine sending logs yml config: winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: Security - name: System … --- ## [Input filter only metricbeat data](https://discuss.elastic.co/t/input-filter-only-metricbeat-data/122865)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 4\ **Last updated:** [April 3, 2018, 2:11pm UTC](https://discuss.elastic.co/t/input-filter-only-metricbeat-data/122865 "2018-04-03T14:11:26Z")
Is there a way to configure input only metricbeat events in the logstash.conf file? Generally, inputs will include all beat events like input { beats { port =\> 5044 } }. But i am looking to input ONLY metricbeat events … --- ## [Using MB Inbound Traffic vis for Netflow](https://discuss.elastic.co/t/using-mb-inbound-traffic-vis-for-netflow/126241)
**Author:** [@DSM](https://discuss.elastic.co/u/DSM)\ **Replies:** 2\ **Last updated:** [April 3, 2018, 2:05pm UTC](https://discuss.elastic.co/t/using-mb-inbound-traffic-vis-for-netflow/126241 "2018-04-03T14:05:51Z")
HI, looking for some help getting over the last hurdle.... I'd like to amend the MB Inbound/Outbound Traffic visualization (the real-time data rate metric) and use it on my netflow data (coming in via ELKs logstash netf… --- ## [Kubernetes and ignore\_outgoing setting](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473)
**Author:** [@lusid](https://discuss.elastic.co/u/lusid)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 1:52pm UTC](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473 "2018-04-03T13:52:31Z")
I'm not sure if this is specific to the Kubernetes environment or not, but it seems I am unable to get ignore\_outgoing to work. I have heard that the server and client\_server fields are important for this purpose, but th… --- ## [Need to install additional plugins along with metricbeat](https://discuss.elastic.co/t/need-to-install-additional-plugins-along-with-metricbeat/126449)
**Author:** [@mouli\_v](https://discuss.elastic.co/u/mouli_v)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 1:45pm UTC](https://discuss.elastic.co/t/need-to-install-additional-plugins-along-with-metricbeat/126449 "2018-04-03T13:45:19Z")
// https://github.com/elastic/beats/issues/6731 I need to install additional plugins. like redis, mongodb along with metricbeat on remote hosts. Can someone help me in fixing it. --- ## [Limit records in windows perfmon](https://discuss.elastic.co/t/limit-records-in-windows-perfmon/126398)
**Author:** [@a.korshunov](https://discuss.elastic.co/u/a.korshunov)\ **Replies:** 2\ **Last updated:** [April 3, 2018, 1:38pm UTC](https://discuss.elastic.co/t/limit-records-in-windows-perfmon/126398 "2018-04-03T13:38:39Z")
Can I get top N records from windows perfmon ordered by value descending? I don't want to store all records. windows.yml: - module: windows metricsets: \["perfmon"\] period: 10s perfmon.counters: - insta… --- ## [How to send only new line data in filebeats](https://discuss.elastic.co/t/how-to-send-only-new-line-data-in-filebeats/126418)
**Author:** [@Kuysuperall](https://discuss.elastic.co/u/Kuysuperall)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 1:38pm UTC](https://discuss.elastic.co/t/how-to-send-only-new-line-data-in-filebeats/126418 "2018-04-03T13:38:21Z")
hi i try to config filebeat like a if in CSV or log file it have new line record it must to send only new line record not all off them data this is my config filebeat.prospectors: - type: log enabled: true paths: … --- ## [Events get combined](https://discuss.elastic.co/t/events-get-combined/126489)
**Author:** [@las](https://discuss.elastic.co/u/las)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 1:19pm UTC](https://discuss.elastic.co/t/events-get-combined/126489 "2018-04-03T13:19:57Z")
I have multiline pattern as below. multiline.pattern: ^\\\[0-9\]{4}-\[A-Za-z\]{3}-\[0-9\]{2} multiline.negate: true multiline.match: after My logs look like below. 2018-Apr-02 00:10:46 AM \[http-nio-8888-exec-3\] INFO com.exa… --- ## [Dotnet core log - filter timestamp from log entry (filebeat, logstash)](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095)
**Author:** [@Mason\_Batley](https://discuss.elastic.co/u/Mason_Batley)\ **Replies:** 3\ **Last updated:** [April 3, 2018, 1:00pm UTC](https://discuss.elastic.co/t/dotnet-core-log-filter-timestamp-from-log-entry-filebeat-logstash/126095 "2018-04-03T13:00:49Z")
Hi gang, I'm importing logs from a dotnet core app using serilog and the output messages in the log file look like this. I need to work out out to extract the timestamp from the log entry line and use that as the @times… --- ## [Failed to parse timestamp exception, (only) when using a new Elasticsearch index name](https://discuss.elastic.co/t/failed-to-parse-timestamp-exception-only-when-using-a-new-elasticsearch-index-name/126407)
**Author:** [@andrei.costache](https://discuss.elastic.co/u/andrei.costache)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 12:54pm UTC](https://discuss.elastic.co/t/failed-to-parse-timestamp-exception-only-when-using-a-new-elasticsearch-index-name/126407 "2018-04-03T12:54:49Z")
Hi, I am using Elasticsearch, Kibana and Metricbeat 6.1.1. I would like to use a different index name, for Metricbeat, than the default one. But I have problems as shortly follow: When I start Metricbeat, with default… --- ## [Filebeat system modules](https://discuss.elastic.co/t/filebeat-system-modules/125998)
**Author:** [@Bhairavi](https://discuss.elastic.co/u/Bhairavi)\ **Replies:** 17\ **Last updated:** [April 3, 2018, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-system-modules/125998 "2018-04-03T12:53:44Z")
Hi, I am trying to run filebeat system modules and the index filebeat-yyyy.mm.dd is also getting created in elasticsearch index but when configuring index pattern in kibana with filebeat-\* I am not able to view pre-built… --- ## [Filebeat multiline is not working](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242)
**Author:** [@Babul\_Kumar\_Sahoo](https://discuss.elastic.co/u/Babul_Kumar_Sahoo)\ **Replies:** 1\ **Last updated:** [April 3, 2018, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-multiline-is-not-working/126242 "2018-04-03T12:50:26Z")
Hi, I have configure the filebeat to tomcat log and below is my filebeat multiline configuration: multiline.pattern: "^(\\s+|\\t)|(Caused by:)|(Exception:)|(System Error:)" multiline.negate: false multiline.match: afte… --- ## [Custom Metricset Based on Windows WMI](https://discuss.elastic.co/t/custom-metricset-based-on-windows-wmi/125686)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 2\ **Last updated:** [April 2, 2018, 8:40pm UTC](https://discuss.elastic.co/t/custom-metricset-based-on-windows-wmi/125686 "2018-04-02T20:40:45Z")
I'd like to create a custom Metricbeat Metricset based on the Windows WMI. I've looked at the developer guide, and although I'm an experienced C# developer, decided that it's a bit over my head. All I need is a good ref… --- ## [Retriving to read the same file](https://discuss.elastic.co/t/retriving-to-read-the-same-file/126396)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 3\ **Last updated:** [April 2, 2018, 5:25pm UTC](https://discuss.elastic.co/t/retriving-to-read-the-same-file/126396 "2018-04-02T17:25:04Z")
Hi all I'm trying to read the same file in order to do some tests in elasticsearch, but if I don't change the name of the file filebeat ignored my decision. I started the filebeat with the following command sudo fileb… --- ## [Filebeats 6.2.3 system module not sending logs](https://discuss.elastic.co/t/filebeats-6-2-3-system-module-not-sending-logs/125954)
**Author:** [@copenlc](https://discuss.elastic.co/u/copenlc)\ **Replies:** 20\ **Last updated:** [April 2, 2018, 2:54pm UTC](https://discuss.elastic.co/t/filebeats-6-2-3-system-module-not-sending-logs/125954 "2018-04-02T14:54:15Z")
Hey guys so I am having issues with the System module for Filebeats 6.2.3 not actually uploading the syslog or message log on either Cent or Debian systems. I am getting data from the icinga module on these systems, so … --- ## [Filebeat include is not working when logs are in both json and non-json format](https://discuss.elastic.co/t/filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/126372)
**Author:** [@Abhishek\_Jadhav](https://discuss.elastic.co/u/Abhishek_Jadhav)\ **Replies:** 3\ **Last updated:** [April 2, 2018, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-include-is-not-working-when-logs-are-in-both-json-and-non-json-format/126372 "2018-04-02T14:44:08Z")
filebeat.yml configuration \< paths: #- /var/log/\*.log - /ap/logs/error\_log include\_lines: \['^{'\] json.keys\_under\_root: true json.add\_error\_key: true json.overwrite\_keys: true tail\_files: true /\> filebeat logs: … --- ## [Support to normalize query params in postgresql module in filebeat](https://discuss.elastic.co/t/support-to-normalize-query-params-in-postgresql-module-in-filebeat/126312)
**Author:** [@Vjay\_Jain](https://discuss.elastic.co/u/Vjay_Jain)\ **Replies:** 1\ **Last updated:** [April 2, 2018, 12:51pm UTC](https://discuss.elastic.co/t/support-to-normalize-query-params-in-postgresql-module-in-filebeat/126312 "2018-04-02T12:51:52Z")
Hi Team, I have a project to send postgresql logs to ELK. i have tried using a setup to parse through postgres logs and send them to elasticsearch until i saw filebeat can now support postgresql logs. now there are co… --- ## [Filebeat -\*](https://discuss.elastic.co/t/filebeat/126338)
**Author:** [@Ibti\_Ssem](https://discuss.elastic.co/u/Ibti_Ssem)\ **Replies:** 1\ **Last updated:** [April 2, 2018, 8:51am UTC](https://discuss.elastic.co/t/filebeat/126338 "2018-04-02T08:51:25Z")
when and why to use FileBeat ! --- ## [How to index ngnix log file?](https://discuss.elastic.co/t/how-to-index-ngnix-log-file/126375)
**Author:** [@nandan\_bigdata](https://discuss.elastic.co/u/nandan_bigdata)\ **Replies:** 3\ **Last updated:** [April 2, 2018, 8:01am UTC](https://discuss.elastic.co/t/how-to-index-ngnix-log-file/126375 "2018-04-02T08:01:42Z")
Hi , I have a 50MB log file from ngix which I want to index into Elasticsearch for better understanding about errors/warning or other information. Please tell me how to do this. Thanks --- ## [Filebeat not sending logs to multiple hosts specified in \[output.elasticsearch:\] section](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-multiple-hosts-specified-in-output-elasticsearch-section/126097)
**Author:** [@AVM](https://discuss.elastic.co/u/AVM)\ **Replies:** 4\ **Last updated:** [March 30, 2018, 5:27am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs-to-multiple-hosts-specified-in-output-elasticsearch-section/126097 "2018-03-30T05:27:13Z")
Hi Team, I have a cluster with 3 nodes. All nodes are master and data eligible nodes. One of them is configured for kibana in kibana.yml (in \[elasticsearch.url\] section). I am using filebeat to send logs directly to ela… --- ## [2nd Winlogbeat not showing up](https://discuss.elastic.co/t/2nd-winlogbeat-not-showing-up/126269)
**Author:** [@rfs42](https://discuss.elastic.co/u/rfs42)\ **Replies:** 2\ **Last updated:** [March 31, 2018, 4:04pm UTC](https://discuss.elastic.co/t/2nd-winlogbeat-not-showing-up/126269 "2018-03-31T16:04:36Z")
I've got 2 winlogbeats configured identically with xpack.monitoring.enabled: true xpack.monitoring.elasticsearch: Both are successfully sending logs to elasticsearch. A quantity of 2 winlogbeats shows up in Monit… --- ## [Filebeat autodiscovery: appenders](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/126009)
**Author:** [@pytimer](https://discuss.elastic.co/u/pytimer)\ **Replies:** 6\ **Last updated:** [March 31, 2018, 5:33am UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/126009 "2018-03-31T05:33:08Z")
Hi, I would like to set up Filebeat configuration with kubernetes autodiscovery provider to collect all namespaces pods logs. I use templates work well , but when i use appenders, filebeat run is wrong. i also use file… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=460) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=462)