# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=462 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 463 --- ## [Elasticsearch Error: java.lang.IllegalArgumentException](https://discuss.elastic.co/t/elasticsearch-error-java-lang-illegalargumentexception/126265)
**Author:** [@vopsec](https://discuss.elastic.co/u/vopsec)\ **Replies:** 6\ **Last updated:** [March 30, 2018, 10:41pm UTC](https://discuss.elastic.co/t/elasticsearch-error-java-lang-illegalargumentexception/126265 "2018-03-30T22:41:33Z")
Hi, Several days ago, my filebeat agent started hiccuping with the following error: 2018-03-30T14:02:55.027-0400 DEBUG \[elasticsearch\] elasticsearch/client.go:507 Bulk item insert failed (i=0, status=500 ): {"… --- ## [Filebeat skipping events after after restarting to harvest](https://discuss.elastic.co/t/filebeat-skipping-events-after-after-restarting-to-harvest/124661)
**Author:** [@Bkt](https://discuss.elastic.co/u/Bkt)\ **Replies:** 4\ **Last updated:** [March 30, 2018, 7:59pm UTC](https://discuss.elastic.co/t/filebeat-skipping-events-after-after-restarting-to-harvest/124661 "2018-03-30T19:59:47Z")
Hello, I am investigating missing events scenario. The setup is as follows Linux box running filebeat/ logstash/ elasticsearch and a program which generates the logs. Its on a local drive (maybe we can rule out network… --- ## [ERR failed to initialize elasticsearch plugin as output: missing condition](https://discuss.elastic.co/t/err-failed-to-initialize-elasticsearch-plugin-as-output-missing-condition/126162)
**Author:** [@sunny1](https://discuss.elastic.co/u/sunny1)\ **Replies:** 25\ **Last updated:** [March 30, 2018, 7:30pm UTC](https://discuss.elastic.co/t/err-failed-to-initialize-elasticsearch-plugin-as-output-missing-condition/126162 "2018-03-30T19:30:03Z")
Hello can some please help me get the condition set correctly. I want to create multiple index based on source file. So i used document\_type to identify the different input file. When i try to specify condition i get err… --- ## [Delete Indicies older than - Unable to read client configuration](https://discuss.elastic.co/t/delete-indicies-older-than-unable-to-read-client-configuration/126249)
**Author:** [@gchampion](https://discuss.elastic.co/u/gchampion)\ **Replies:** 4\ **Last updated:** [March 30, 2018, 6:27pm UTC](https://discuss.elastic.co/t/delete-indicies-older-than-unable-to-read-client-configuration/126249 "2018-03-30T18:27:15Z")
Have the below config / action file. Always worked until recent updates. Now if I do a dry run i get "Unable to read configuration file. Running as root. Funny thing is, if I create an error like a missing ":" it will st… --- ## [Jenkins build fails on (at least) Amazon Linux](https://discuss.elastic.co/t/jenkins-build-fails-on-at-least-amazon-linux/126126)
**Author:** [@pillarsdotnet](https://discuss.elastic.co/u/pillarsdotnet)\ **Replies:** 3\ **Last updated:** [March 30, 2018, 6:21pm UTC](https://discuss.elastic.co/t/jenkins-build-fails-on-at-least-amazon-linux/126126 "2018-03-30T18:21:34Z")
On (at least) Amazon Linux, the virtualenv tool configures python with the following sys.path directories: '' '${PYTHON\_ENV}/local/lib64/python2.7/site-packages' '${PYTHON\_ENV}/local/lib/python2.7/site-packages' '${PYT… --- ## [Using a regex in the custom field of Filebeat](https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252)
**Author:** [@gvdm90](https://discuss.elastic.co/u/gvdm90)\ **Replies:** 5\ **Last updated:** [March 30, 2018, 4:04pm UTC](https://discuss.elastic.co/t/using-a-regex-in-the-custom-field-of-filebeat/126252 "2018-03-30T16:04:22Z")
Here I can read that when configuring a prospect I can add a custom field to the data, which later I can use for filtering. So for example I can write - type: log paths: - /my/path/app1.csv fields: app\_name… --- ## [Filebeat doing wrong jsonification](https://discuss.elastic.co/t/filebeat-doing-wrong-jsonification/126233)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [March 30, 2018, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-doing-wrong-jsonification/126233 "2018-03-30T13:41:15Z")
I'm using filebeat to send logs from Nginx to ES. Strangely enough, I found this document in my ES. { "@timestamp": "2018-03-30T12:28:52.396Z", "source": "/var/log/nginx/access\_upstream.log", "offset": 3118… --- ## [Filter Json on specific key](https://discuss.elastic.co/t/filter-json-on-specific-key/126222)
**Author:** [@eddie4](https://discuss.elastic.co/u/eddie4)\ **Replies:** 1\ **Last updated:** [March 30, 2018, 12:41pm UTC](https://discuss.elastic.co/t/filter-json-on-specific-key/126222 "2018-03-30T12:41:07Z")
Hello, Am attempting to filter which lines of logs are being send to the backend. I have read up on the following documentation however i didn't find my answer. https://www.elastic.co/guide/en/beats/filebeat/current/fi… --- ## [Enabling modules when resource does not exist](https://discuss.elastic.co/t/enabling-modules-when-resource-does-not-exist/126105)
**Author:** [@zinefer](https://discuss.elastic.co/u/zinefer)\ **Replies:** 2\ **Last updated:** [March 29, 2018, 3:14pm UTC](https://discuss.elastic.co/t/enabling-modules-when-resource-does-not-exist/126105 "2018-03-29T15:14:22Z")
Is there any issue with, for example, enabling an nginx module on a machine with no nginx? Will the other modules/prospectors continue to work? Thanks --- ## [Disable modules in Metricbeat.yml](https://discuss.elastic.co/t/disable-modules-in-metricbeat-yml/126047)
**Author:** [@pvderivco](https://discuss.elastic.co/u/pvderivco)\ **Replies:** 5\ **Last updated:** [March 29, 2018, 2:43pm UTC](https://discuss.elastic.co/t/disable-modules-in-metricbeat-yml/126047 "2018-03-29T14:43:42Z")
I am pretty new to Elastic and Beats, hence looking for some quick help! I am trying to disable some default modules like (system, aerospike etc) in metricbeat.yml using the following configuration, but this is not havi… --- ## [How to configure filebeats on docker](https://discuss.elastic.co/t/how-to-configure-filebeats-on-docker/125553)
**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Replies:** 3\ **Last updated:** [March 29, 2018, 9:59am UTC](https://discuss.elastic.co/t/how-to-configure-filebeats-on-docker/125553 "2018-03-29T09:59:23Z")
I want to use Filebeats as my input plugin with my logstash configuration file so is there any descriptive method which I should follow to achieve. I have downloaded the image of filebeats version 5.6.8 on my VM But ai… --- ## [Filebeat to collect the logs from kubernetes cluster running on AWS](https://discuss.elastic.co/t/filebeat-to-collect-the-logs-from-kubernetes-cluster-running-on-aws/126025)
**Author:** [@TMR](https://discuss.elastic.co/u/TMR)\ **Replies:** 2\ **Last updated:** [March 29, 2018, 9:28am UTC](https://discuss.elastic.co/t/filebeat-to-collect-the-logs-from-kubernetes-cluster-running-on-aws/126025 "2018-03-29T09:28:11Z")
Hi there, My elasticsearch and kibana instance are running on on-prem and the k8s cluster where i would like to collect the logs from is running on AWS. I cannot have filebeat running inside the kubernetes cluster as p… --- ## [Configuring multiple paths in http module](https://discuss.elastic.co/t/configuring-multiple-paths-in-http-module/121564)
**Author:** [@diavel](https://discuss.elastic.co/u/diavel)\ **Replies:** 7\ **Last updated:** [March 29, 2018, 5:12am UTC](https://discuss.elastic.co/t/configuring-multiple-paths-in-http-module/121564 "2018-03-29T05:12:12Z")
I am trying to use http module to collect jmx metrics instead of the jolokia module because of the lack of wild card in the queries. I am having trouble configuring multiple paths. - module: http metricsets: \["jso… --- ## [Metricbeat rabbitmq module issues](https://discuss.elastic.co/t/metricbeat-rabbitmq-module-issues/125751)
**Author:** [@adrian.aneci](https://discuss.elastic.co/u/adrian.aneci)\ **Replies:** 3\ **Last updated:** [March 29, 2018, 5:09am UTC](https://discuss.elastic.co/t/metricbeat-rabbitmq-module-issues/125751 "2018-03-29T05:09:50Z")
Hi team, I've noticed some errors in metricbeat logs after activatig rabbitmq module. I'm using 6.2.3 metricbeat inside a docker container. The rabbitmq version against which I'm testing the module is 3.7.4. 2018-03… --- ## [Packetbeat can send to elasticsearch but not logstash?](https://discuss.elastic.co/t/packetbeat-can-send-to-elasticsearch-but-not-logstash/125997)
**Author:** [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)\ **Replies:** 2\ **Last updated:** [March 29, 2018, 12:14am UTC](https://discuss.elastic.co/t/packetbeat-can-send-to-elasticsearch-but-not-logstash/125997 "2018-03-29T00:14:37Z")
I have an existing 6.2 stack with 2 logstash pipelines sending to elasticsearch - Winlogbeat and Syslog. I'm trying to add a third pipeline for packetbeat and I can successfully index the output when sent to elasticsear… --- ## [Parsing Json Logs](https://discuss.elastic.co/t/parsing-json-logs/125837)
**Author:** [@Gert\_Humphris](https://discuss.elastic.co/u/Gert_Humphris)\ **Replies:** 2\ **Last updated:** [March 28, 2018, 8:44pm UTC](https://discuss.elastic.co/t/parsing-json-logs/125837 "2018-03-28T20:44:17Z")
Hi Guys I'm new to Elastic and have been searching lots to try and find an answer. I have a multiline JSON that I'm trying to create a single event for. The Json looks like this: { "SourceInfo": "C:\\\\Modules\\… --- ## [Separate Index Pattern for each Windows Log](https://discuss.elastic.co/t/separate-index-pattern-for-each-windows-log/125757)
**Author:** [@thaneye](https://discuss.elastic.co/u/thaneye)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 5:39pm UTC](https://discuss.elastic.co/t/separate-index-pattern-for-each-windows-log/125757 "2018-03-28T17:39:58Z")
Hi, I am experimenting using Elastic and Winlogbeat to collect System, Application and Security log. How is it possible to create different Index Patterns for each one instead of the one "Winlogbeat-\*" Thanks --- ## [MetricBeat Jolokia configuration](https://discuss.elastic.co/t/metricbeat-jolokia-configuration/125305)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 9\ **Last updated:** [March 28, 2018, 4:32pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-configuration/125305 "2018-03-28T16:32:25Z")
Hi, The following is my conf. ElasticSearch - 6.2.2 Logstash - 6.2.2 Kibana - 6.2.2 Metricbeat - 6.2.2 I am trying to pull the JMX data from my clients using the jolokia module in the metricbeat. I had installed th… --- ## [Filebeat error Failed to publish events](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events/122710)
**Author:** [@849938e6ef0f16f9da83](https://discuss.elastic.co/u/849938e6ef0f16f9da83)\ **Replies:** 6\ **Last updated:** [March 28, 2018, 2:59pm UTC](https://discuss.elastic.co/t/filebeat-error-failed-to-publish-events/122710 "2018-03-28T14:59:10Z")
Filebeat outputs such error ERROR pipeline/output.go:92 Failed to publish events: temporary bulk send failure filebeat version 6.2.2 (amd64), libbeat 6.2.2 The error occurs on log files with long messages (tens lines)… --- ## [Filebeat can't see single line when timestamp is the same](https://discuss.elastic.co/t/filebeat-cant-see-single-line-when-timestamp-is-the-same/125227)
**Author:** [@twan](https://discuss.elastic.co/u/twan)\ **Replies:** 5\ **Last updated:** [March 28, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-cant-see-single-line-when-timestamp-is-the-same/125227 "2018-03-28T14:48:16Z")
Hi people! I've been breaking my head on this problem I have with filebeat. The application log that needs to be send to Logstash logs 2 lines with the same timestamp. I've added an example below (removed IP/Ports): Ma… --- ## [Metricbeat 5.3.0 reporting strange memory value](https://discuss.elastic.co/t/metricbeat-5-3-0-reporting-strange-memory-value/124825)
**Author:** [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Replies:** 5\ **Last updated:** [March 28, 2018, 2:22pm UTC](https://discuss.elastic.co/t/metricbeat-5-3-0-reporting-strange-memory-value/124825 "2018-03-28T14:22:20Z")
beats 5.3.0 on FreeBSD linprocfs has been mounted and this has been working for months. This morning I noticed errors in my elasticsearch log, something like this: "\[2018-03-20T15:53:19,197\]\[DEBUG\]\[o.e.a.b.TransportS… --- ## [How to install filebeat in RHEL 5?](https://discuss.elastic.co/t/how-to-install-filebeat-in-rhel-5/125894)
**Author:** [@muthu\_kumar1](https://discuss.elastic.co/u/muthu_kumar1)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 12:33pm UTC](https://discuss.elastic.co/t/how-to-install-filebeat-in-rhel-5/125894 "2018-03-28T12:33:20Z")
We have one centralised log monitoring server which is RHEL 7. But we have some RHEL 5 server from there we need to pull logs.How to install filebeat in RHEL 5 server? --- ## [Read journald](https://discuss.elastic.co/t/read-journald/125899)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 12:28pm UTC](https://discuss.elastic.co/t/read-journald/125899 "2018-03-28T12:28:13Z")
I have logs in journald and I would like reading them. I know Filebeat can't read directly them so how to do ? I don't want to use journalbeat. Is there an other option ? --- ## [How to setup an alert for a failing livesness probe in kubernetes](https://discuss.elastic.co/t/how-to-setup-an-alert-for-a-failing-livesness-probe-in-kubernetes/125755)
**Author:** [@David\_Michael\_Gang](https://discuss.elastic.co/u/David_Michael_Gang)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-setup-an-alert-for-a-failing-livesness-probe-in-kubernetes/125755 "2018-03-28T09:38:42Z")
Hi all, I installed metricbeats on kubernetes as explained here and get now a nice dashboard of the kubernetes status. In kubernetes i use liveness probes to see if a pod is down. Now i want to get alerted if liveness… --- ## [Which host did a beat document come from?](https://discuss.elastic.co/t/which-host-did-a-beat-document-come-from/125756)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 1\ **Last updated:** [March 28, 2018, 8:24am UTC](https://discuss.elastic.co/t/which-host-did-a-beat-document-come-from/125756 "2018-03-28T08:24:48Z")
beat.hostname appears to be the output from "hostname", not "hostname -f", which I'm told (I'm not a Linux BOFH) should in a properly configured system be the leaf name, not the FQDN. beat.name defaults to beat.hostname… --- ## [Filebeat not releasing file after it's been deleted](https://discuss.elastic.co/t/filebeat-not-releasing-file-after-its-been-deleted/125672)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 3\ **Last updated:** [March 28, 2018, 6:34am UTC](https://discuss.elastic.co/t/filebeat-not-releasing-file-after-its-been-deleted/125672 "2018-03-28T06:34:26Z")
Hello, I have a set of logs that are being rotated and then removed from a directory, but filebeat still has the harvester opened on said file and it is not letting go of it. In my directory you see the number of logs t… --- ## [Dealing with non standard log formats](https://discuss.elastic.co/t/dealing-with-non-standard-log-formats/125500)
**Author:** [@jon\_uk](https://discuss.elastic.co/u/jon_uk)\ **Replies:** 8\ **Last updated:** [March 27, 2018, 10:46pm UTC](https://discuss.elastic.co/t/dealing-with-non-standard-log-formats/125500 "2018-03-27T22:46:19Z")
I'm trying (really really trying) to make sense of the logs coming from isc-dhcpd, a DHCP server. Depending upon the stage of the DHCP request process, the format of the output is slightly different. i've got three worki… --- ## [ERR Failed to connect: dial tcp ELK\_IP\_ADDRESS:9600: getsockopt: connection refused](https://discuss.elastic.co/t/err-failed-to-connect-dial-tcp-elk-ip-address-9600-getsockopt-connection-refused/124860)
**Author:** [@daytonpa](https://discuss.elastic.co/u/daytonpa)\ **Replies:** 2\ **Last updated:** [March 27, 2018, 1:58pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-dial-tcp-elk-ip-address-9600-getsockopt-connection-refused/124860 "2018-03-27T13:58:03Z")
For some reason, I cannot get Filebeat to send logs to Logstash. I have an ELK stack on an instance in AWS that is meant to collect all logs from our staging and application servers. ELK instance: Elasticsearch -\> 5.6… --- ## [Location to run the filebeat modules command](https://discuss.elastic.co/t/location-to-run-the-filebeat-modules-command/125684)
**Author:** [@Abdur\_Raqeeb1](https://discuss.elastic.co/u/Abdur_Raqeeb1)\ **Replies:** 1\ **Last updated:** [March 27, 2018, 11:43am UTC](https://discuss.elastic.co/t/location-to-run-the-filebeat-modules-command/125684 "2018-03-27T11:43:07Z")
Hi, I have run the belwo command on the path /usr/share/filebeat/bin But it gives me below error. ./filebeat modules list filebeat2018/03/27 01:40:46.833628 beat.go:346: CRIT Exiting: error loading config file: stat … --- ## [Monitoring rook (ceph) with metricbeat](https://discuss.elastic.co/t/monitoring-rook-ceph-with-metricbeat/125632)
**Author:** [@\_flo](https://discuss.elastic.co/u/_flo)\ **Replies:** 2\ **Last updated:** [March 27, 2018, 5:47am UTC](https://discuss.elastic.co/t/monitoring-rook-ceph-with-metricbeat/125632 "2018-03-27T05:47:18Z")
Hi, how can i Monitor http://rook.io with metricbeat? I like to use the ceph module and prebuild Dashboards, but have no idea how i can connect metricbeat and rook. Any hints? regards [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=461) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=463)