# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=463 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 464 --- ## [Osquery snapshot](https://discuss.elastic.co/t/osquery-snapshot/124180)
**Author:** [@Jin\_Qian](https://discuss.elastic.co/u/Jin_Qian)\ **Replies:** 2\ **Last updated:** [March 27, 2018, 3:01am UTC](https://discuss.elastic.co/t/osquery-snapshot/124180 "2018-03-27T03:01:12Z")
Hi, I am using filebeat to collect osquery snapshot log /var/log/osquery/osqueryd.snapshots.log. Do I need to add above path to paths setting? Currently it only contains /var/log/osquery/osqueryd.results.log --- ## [Exclude Zabbix entry from being indexed](https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 1:28pm UTC](https://discuss.elastic.co/t/exclude-zabbix-entry-from-being-indexed/125614 "2018-03-26T13:28:38Z")
Hello, Here is the prospector section of my filebeat.yml file #=========================== Filebeat prospectors ============================= filebeat.prospectors: - type: log paths: - /var/log/\*/\*.… --- ## [Registry is Never Cleaned](https://discuss.elastic.co/t/registry-is-never-cleaned/125646)
**Author:** [@frioux](https://discuss.elastic.co/u/frioux)\ **Replies:** 5\ **Last updated:** [March 26, 2018, 5:54pm UTC](https://discuss.elastic.co/t/registry-is-never-cleaned/125646 "2018-03-26T17:54:32Z")
Filebeat 6.2.2, Ubuntu 14.04 So we have a couple of servers that are basically never shipping logs. I think the problem is that they at one point had so many logs that their registry is so big that they have trouble ev… --- ## [Mysql-Module Grok-Parsing Error](https://discuss.elastic.co/t/mysql-module-grok-parsing-error/125561)
**Author:** [@strowi](https://discuss.elastic.co/u/strowi)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 5:07pm UTC](https://discuss.elastic.co/t/mysql-module-grok-parsing-error/125561 "2018-03-26T17:07:10Z")
Hi, trying to get percona slow-logs into es with the mysql-module. But it seems there is some pattern mismatch? Version: 6.2.3 Operating System: Ubuntu 16.04.3 LTS Steps to Reproduce: filebeat.prospectors: filebeat.… --- ## [Monitoring the hardware](https://discuss.elastic.co/t/monitoring-the-hardware/125551)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 3:09pm UTC](https://discuss.elastic.co/t/monitoring-the-hardware/125551 "2018-03-26T15:09:32Z")
Wanted to know whether the following events were captured in system logs of UNIX and Windows servers so that filebeat can be used to identify them. Disk failure Memory failure Power failure Or is there any better way… --- ## [Metrics related to the Message Queue](https://discuss.elastic.co/t/metrics-related-to-the-message-queue/125550)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 2:58pm UTC](https://discuss.elastic.co/t/metrics-related-to-the-message-queue/125550 "2018-03-26T14:58:18Z")
I am looking for the following information for Kafka, RabbitMQ, Redis from the metricset of metricbeat from the respective modules. Went through the latest documentation and not able find the below information. Wanted to… --- ## [Heartbeat on Amazon Linux just stops after 5mins](https://discuss.elastic.co/t/heartbeat-on-amazon-linux-just-stops-after-5mins/122595)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 6\ **Last updated:** [March 26, 2018, 2:53pm UTC](https://discuss.elastic.co/t/heartbeat-on-amazon-linux-just-stops-after-5mins/122595 "2018-03-26T14:53:31Z")
Hi, I'm running some AWS EC2 instances running Amazon Linux. I have configured heartbeat on there to check 2 ports and 3 web instances. Heartbeat runs and works normally then in about 5 minutes or a little longer it j… --- ## [Environment variables not replaced in external configuration file](https://discuss.elastic.co/t/environment-variables-not-replaced-in-external-configuration-file/124690)
**Author:** [@oetzi](https://discuss.elastic.co/u/oetzi)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 2:05pm UTC](https://discuss.elastic.co/t/environment-variables-not-replaced-in-external-configuration-file/124690 "2018-03-26T14:05:13Z")
I face the problem that environment variables in external config files are not replaced. The external config files are imported to the filebeat.yml file via the filebeat.config.prospectors option. My external config fil… --- ## [Filebeat service not starting on reboot after OS upgrade](https://discuss.elastic.co/t/filebeat-service-not-starting-on-reboot-after-os-upgrade/125376)
**Author:** [@juhlig](https://discuss.elastic.co/u/juhlig)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 11:04am UTC](https://discuss.elastic.co/t/filebeat-service-not-starting-on-reboot-after-os-upgrade/125376 "2018-03-26T11:04:01Z")
Hi, we were running filebeat 5.6.8 on an Ubuntu 14.04 machine until recently. After a release upgrade to Ubuntu 16.04 via do-release-upgrade, the filebeat service is not starting on system startup any longer. service f… --- ## [Can't start the filebeat for windows](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217)
**Author:** [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Replies:** 13\ **Last updated:** [March 26, 2018, 10:41am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217 "2018-03-26T10:41:42Z")
I am just new to elastic. my elasticsearch is up and kibana is up too. however, I can't start my Filebeat to load the log into elastic. I can't start the filebeat services. When I run this C:\\Program Files\\filebeat\>.\\f… --- ## [HAProxy module | Metricbeat Reference](https://discuss.elastic.co/t/haproxy-module-metricbeat-reference/125408)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 10:13am UTC](https://discuss.elastic.co/t/haproxy-module-metricbeat-reference/125408 "2018-03-26T10:13:06Z")
I'm trying to follow HAProxy module | Metricbeat Reference and even though I re-ran: metricbeat setup -e in Kibana, I don't see HAProxy dashboard nor visualization. Please advise. --- ## [Nginx can't get metrix](https://discuss.elastic.co/t/nginx-cant-get-metrix/121611)
**Author:** [@Andre\_Vert](https://discuss.elastic.co/u/Andre_Vert)\ **Replies:** 6\ **Last updated:** [March 26, 2018, 9:48am UTC](https://discuss.elastic.co/t/nginx-cant-get-metrix/121611 "2018-03-26T09:48:00Z")
Hi, it's me again... I'm running a virtual machine, that is reachable under 192.168.10.10 with an nginx server. config for the status page: location ~ ^/(status|ping)$ { stub\_status on; allow all; … --- ## [Filebeat connection to remote kibana](https://discuss.elastic.co/t/filebeat-connection-to-remote-kibana/124515)
**Author:** [@Prajakta\_Sonawane](https://discuss.elastic.co/u/Prajakta_Sonawane)\ **Replies:** 5\ **Last updated:** [March 26, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-connection-to-remote-kibana/124515 "2018-03-26T09:13:33Z")
How do I connect FIlebeat to remote kibana? in my filebeat.yml file, I gave the ip address on which kibana is working setup.kibana: IPv6 addresses should always be defined as: https://\[2001:db8::1\]:5601 host: "ip\_add… --- ## [Filebeat splits message after 16k](https://discuss.elastic.co/t/filebeat-splits-message-after-16k/123718)
**Author:** [@paltryeffort](https://discuss.elastic.co/u/paltryeffort)\ **Replies:** 9\ **Last updated:** [March 26, 2018, 9:01am UTC](https://discuss.elastic.co/t/filebeat-splits-message-after-16k/123718 "2018-03-26T09:01:20Z")
\# filebeat 6.2.2 filebeat.prospectors: - paths: \[ "/var/lib/docker/containers/\*/\*-json.log" \] harvester\_buffer\_size: 65536 json.message\_key: log json.keys\_under\_root: true json.add\_error\_key: true fields\_unde… --- ## [Loadbalance question](https://discuss.elastic.co/t/loadbalance-question/125396)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 7:48am UTC](https://discuss.elastic.co/t/loadbalance-question/125396 "2018-03-26T07:48:55Z")
i've read that loadbalance: false will try another host if the selected one becomes unresponsive. loadbalance If set to true and multiple Logstash hosts are configured, the output plugin load balances published event… --- ## [Embedding a custom beat in my application](https://discuss.elastic.co/t/embedding-a-custom-beat-in-my-application/124362)
**Author:** [@pkaeding](https://discuss.elastic.co/u/pkaeding)\ **Replies:** 6\ **Last updated:** [March 26, 2018, 7:22am UTC](https://discuss.elastic.co/t/embedding-a-custom-beat-in-my-application/124362 "2018-03-26T07:22:03Z")
I am exploring publishing metrics from my application to ES, and it looks like libbeat might be a good way to do this. However, I'm having trouble seeing how to instantiate a github.com/elastic/beats/libbeat/beat.Beat t… --- ## [Module and multiline](https://discuss.elastic.co/t/module-and-multiline/125340)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 2\ **Last updated:** [March 26, 2018, 7:01am UTC](https://discuss.elastic.co/t/module-and-multiline/125340 "2018-03-26T07:01:46Z")
I have a question. Is it possible to add the options of multiline in the filebeat module ? I have this config at the moment - module: system # Syslog syslog: enabled: true --- ## [Some about elasticsearch](https://discuss.elastic.co/t/some-about-elasticsearch/125523)
**Author:** [@fengxiaoH](https://discuss.elastic.co/u/fengxiaoH)\ **Replies:** 1\ **Last updated:** [March 26, 2018, 2:11am UTC](https://discuss.elastic.co/t/some-about-elasticsearch/125523 "2018-03-26T02:11:24Z")
First，my filebeat configuration was : input\_type: log paths: - /data/logstash/1.txt document\_type: test\_ip\* scan\_frequency: 5s It can see data on kibana. Then i change the filebeat configuration was（i change the … --- ## [Windows Event Log to Syslog server](https://discuss.elastic.co/t/windows-event-log-to-syslog-server/124665)
**Author:** [@mun](https://discuss.elastic.co/u/mun)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 1:26am UTC](https://discuss.elastic.co/t/windows-event-log-to-syslog-server/124665 "2018-03-26T01:26:10Z")
Hi, Is it possible to send windows event log to syslog server using winlogbeat? Thank You. --- ## [Cannot package beats on RHEL 7.4 with packer](https://discuss.elastic.co/t/cannot-package-beats-on-rhel-7-4-with-packer/125522)
**Author:** [@kitkat](https://discuss.elastic.co/u/kitkat)\ **Replies:** 0\ **Last updated:** [March 26, 2018, 12:21am UTC](https://discuss.elastic.co/t/cannot-package-beats-on-rhel-7-4-with-packer/125522 "2018-03-26T00:21:42Z")
RHEL 7.4 and CentOS 7 both failing using beats packer from https://github.com/elastic/beats/tree/master/dev-tools/packer I'm kicking this off with make filebeat/rpm, but I've tested it against all beats with the same re… --- ## [Multiline match pattern but don't send it](https://discuss.elastic.co/t/multiline-match-pattern-but-dont-send-it/125258)
**Author:** [@JimP](https://discuss.elastic.co/u/JimP)\ **Replies:** 2\ **Last updated:** [March 24, 2018, 1:02pm UTC](https://discuss.elastic.co/t/multiline-match-pattern-but-dont-send-it/125258 "2018-03-24T13:02:23Z")
Windows filebeat 6.2.3 My multiline pattern works great, and want to know if I can also filter out sending those patterns? multiline.pattern: '^\[-\]{6,}\[ \]Event Log Start Here\[ \]\[-\]{6,}' multiline.negate: true mu… --- ## [Apache2 module format](https://discuss.elastic.co/t/apache2-module-format/125265)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 2\ **Last updated:** [March 24, 2018, 8:02am UTC](https://discuss.elastic.co/t/apache2-module-format/125265 "2018-03-24T08:02:27Z")
We'd like to use the apache2 module but our log format seems to be off with Litespeed. apache error log format we have: "message": "2018-03-22 16:44:21.409983 \[INFO\] \[APVH\_xxxxx\_Suphp56:\] PID: 23503, add child process … --- ## [Filebeat & NGINX Logs](https://discuss.elastic.co/t/filebeat-nginx-logs/124381)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 3\ **Last updated:** [March 24, 2018, 6:56am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381 "2018-03-24T06:56:00Z")
Hi. I have enabled the filebeat modules enable nginx (and restarted it). I'm hitting the nginx engine (and generating some logs in /var/log/nginx/access.log & error.log but I am not seeing anything in Elasticsearch. Do I… --- ## [Metricbeat system hostfs will stuck the pod from terminating](https://discuss.elastic.co/t/metricbeat-system-hostfs-will-stuck-the-pod-from-terminating/125343)
**Author:** [@wklken](https://discuss.elastic.co/u/wklken)\ **Replies:** 2\ **Last updated:** [March 24, 2018, 2:36am UTC](https://discuss.elastic.co/t/metricbeat-system-hostfs-will-stuck-the-pod-from-terminating/125343 "2018-03-24T02:36:12Z")
hi: We ran metricbeat as a daemonset in kubernetes. I wonder has this issue been reported before. (I searched and found nothing) And we found a lot of pods stucking in terminating step; We do a dig and it's the metric… --- ## [Error from Beats: Failed to connect: dial tcp 127.0.0.1:5044: getsockopt: connection refused](https://discuss.elastic.co/t/error-from-beats-failed-to-connect-dial-tcp-127-0-0-1-5044-getsockopt-connection-refused/125301)
**Author:** [@Joe\_Law](https://discuss.elastic.co/u/Joe_Law)\ **Replies:** 1\ **Last updated:** [March 23, 2018, 9:51pm UTC](https://discuss.elastic.co/t/error-from-beats-failed-to-connect-dial-tcp-127-0-0-1-5044-getsockopt-connection-refused/125301 "2018-03-23T21:51:11Z")
Hi Guys. Need input from you all to get my setting right. I am running my ELK stack in docker with sebp/elk. And I have another instance with my Laravel App. Everything goess well until I try to configure filebeat in … --- ## [Filebeat osquery module](https://discuss.elastic.co/t/filebeat-osquery-module/125378)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 2\ **Last updated:** [March 23, 2018, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-osquery-module/125378 "2018-03-23T21:49:46Z")
ES - 6.2 LS - 6.2 Filebeat - osquery module OS - Mac 2 questions What is the benefit of running a module instead of just a prospector? Besides the auto index creation and visualizations. If those are not needed … --- ## [Auditd module + file access = some paths are hex-encoded](https://discuss.elastic.co/t/auditd-module-file-access-some-paths-are-hex-encoded/125090)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 5\ **Last updated:** [March 23, 2018, 9:09pm UTC](https://discuss.elastic.co/t/auditd-module-file-access-some-paths-are-hex-encoded/125090 "2018-03-23T21:09:38Z")
We're looking to track all file access on a shared volume, and are running the following config: module: auditd audit\_rules: | -w /share/path\_a -p rwa -w /share/path\_b -p rwa -w /share/path\_c -p rwa This seems to … --- ## [Filebeat Still holding the log files even after i upgrade from 5.1.2 to 5.5.2](https://discuss.elastic.co/t/filebeat-still-holding-the-log-files-even-after-i-upgrade-from-5-1-2-to-5-5-2/125202)
**Author:** [@vinoth](https://discuss.elastic.co/u/vinoth)\ **Replies:** 2\ **Last updated:** [March 23, 2018, 6:23pm UTC](https://discuss.elastic.co/t/filebeat-still-holding-the-log-files-even-after-i-upgrade-from-5-1-2-to-5-5-2/125202 "2018-03-23T18:23:11Z")
Filebeat still holding the log files and not closing it after the logs are rolled out. Which creates the space issue. Previously we had 5.1.2 which had this issue and after we upgrade we thought the issue will be gone bu… --- ## [Can we both enable outputs for Elasticsearch and Logstash?](https://discuss.elastic.co/t/can-we-both-enable-outputs-for-elasticsearch-and-logstash/124805)
**Author:** [@jackyshen](https://discuss.elastic.co/u/jackyshen)\ **Replies:** 4\ **Last updated:** [March 23, 2018, 5:49pm UTC](https://discuss.elastic.co/t/can-we-both-enable-outputs-for-elasticsearch-and-logstash/124805 "2018-03-23T17:49:07Z")
I want to my Logs to output both Elasticsearch and Logstash , can I config like the below? #================================ Outputs ===================================== Configure what outputs to use when sending the … --- ## [Filebeat (v6.2.3) complaining about ES plugins (v6.2.3) missing](https://discuss.elastic.co/t/filebeat-v6-2-3-complaining-about-es-plugins-v6-2-3-missing/125038)
**Author:** [@cmo23](https://discuss.elastic.co/u/cmo23)\ **Replies:** 5\ **Last updated:** [March 23, 2018, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-v6-2-3-complaining-about-es-plugins-v6-2-3-missing/125038 "2018-03-23T17:24:47Z")
2018-03-21T16:45:48.131Z ERROR pipeline/output.go:74 Failed to connect: Connection marked as failed because the onConnect callback failed: Error loading pipeline for fileset nginx/access: This module requires the followi… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=462) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=464)