# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=464 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 465 --- ## [Dropping log lines on log rotation](https://discuss.elastic.co/t/dropping-log-lines-on-log-rotation/125036)
**Author:** [@DDEFISHER](https://discuss.elastic.co/u/DDEFISHER)\ **Replies:** 14\ **Last updated:** [March 23, 2018, 4:14pm UTC](https://discuss.elastic.co/t/dropping-log-lines-on-log-rotation/125036 "2018-03-23T16:14:22Z")
File beat version: 5.6.3 os: centos Occasionally log data will be missing that appears to come after a log rotate. If we have two files "old\_log" and "new\_log" all log lines from "old\_log" will be present but the firs… --- ## [Multiple patterns in Multiline pattern not working](https://discuss.elastic.co/t/multiple-patterns-in-multiline-pattern-not-working/125244)
**Author:** [@Adyantha\_T\_S](https://discuss.elastic.co/u/Adyantha_T_S)\ **Replies:** 3\ **Last updated:** [March 23, 2018, 2:50pm UTC](https://discuss.elastic.co/t/multiple-patterns-in-multiline-pattern-not-working/125244 "2018-03-23T14:50:09Z")
I am trying to capture specific lines using filebeat, but I'm unable to apply multiple patterns and get those lines into a single message. Data: zzz Thu Mar 22 17:49:46 UTC 2018 MemTotal: 24688032 kB MemFree: … --- ## [Custom beat based on metric doesn't run in the background when started via inet.d](https://discuss.elastic.co/t/custom-beat-based-on-metric-doesnt-run-in-the-background-when-started-via-inet-d/123215)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 11\ **Last updated:** [March 23, 2018, 2:41pm UTC](https://discuss.elastic.co/t/custom-beat-based-on-metric-doesnt-run-in-the-background-when-started-via-inet-d/123215 "2018-03-23T14:41:30Z")
Hi all When I package my beat based on metricbeat like this and I install this beat on debian 7 (wheezy) the beat starts and works like expected but it refuses to run in the background when started via inet.d. If I inst… --- ## [Parsing Json within a Json in Filebeat](https://discuss.elastic.co/t/parsing-json-within-a-json-in-filebeat/125360)
**Author:** [@sheen2x](https://discuss.elastic.co/u/sheen2x)\ **Replies:** 0\ **Last updated:** [March 23, 2018, 11:44am UTC](https://discuss.elastic.co/t/parsing-json-within-a-json-in-filebeat/125360 "2018-03-23T11:44:25Z")
Hi Elastic Support, I'm using Filebeat 6.2.2 and we have a json log that looks like this: {"Name":"John","Locations":\["USA"\],"Enabled":true,"Notes":"{"children":2,"details":\[{"birthday":"1999-01-01t01:00:00.00000-04:00… --- ## [Filebeat on Windows - SSL Certificates](https://discuss.elastic.co/t/filebeat-on-windows-ssl-certificates/125333)
**Author:** [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\ **Replies:** 0\ **Last updated:** [March 23, 2018, 9:12am UTC](https://discuss.elastic.co/t/filebeat-on-windows-ssl-certificates/125333 "2018-03-23T09:12:15Z")
Logstash is installed on Centos 7 and ssl is set to true in my logstash.conf file. Filebeat agents on other Centos machines are harvesting the logs and pushing to Logstash. However I've an issue with my filebeat on my Wi… --- ## [Monitoring Filebeat with the new Stats api in 6.0+](https://discuss.elastic.co/t/monitoring-filebeat-with-the-new-stats-api-in-6-0/125328)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 0\ **Last updated:** [March 23, 2018, 8:34am UTC](https://discuss.elastic.co/t/monitoring-filebeat-with-the-new-stats-api-in-6-0/125328 "2018-03-23T08:34:29Z")
Hi, I was wondering how I would go about monitoring filebeat. I need to send an email out when logs have stopped shipping. These are my findings so far: I think the retry counted in refreshed every 90 seconds. If fil… --- ## [Logstash cant receive log from filebeat](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117)
**Author:** [@zxq209](https://discuss.elastic.co/u/zxq209)\ **Replies:** 3\ **Last updated:** [March 23, 2018, 3:03am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117 "2018-03-23T03:03:13Z")
I'm using filebeat-6.2.3 ,logstash-6.2.2 filebeat config： filebeat.prospectors: - type: log paths: - /path/to/file/log/\*.log output.logstash: # The Logstash hosts hosts: \["192.168.15.41:5044"\] enabled: tr… --- ## [Filebeat holds on to a file descriptor too long](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long/125294)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 1\ **Last updated:** [March 23, 2018, 3:12am UTC](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long/125294 "2018-03-23T03:12:23Z")
Hello, there, We finally upgrade filebeat from 5 to 6.1.3, however, the same problem still persists. (sorry I could not reply to the original thread since it is more than a month old. We observed the same issue today… --- ## [Metricbeat yaml drop\_event.when.regexp.mount\_point filter not working as expected not working as expected](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275)
**Author:** [@naveengauba](https://discuss.elastic.co/u/naveengauba)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 11:57pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275 "2018-03-22T23:57:42Z")
Hi there I am using metricbeat to monitor storage for a specific mount\_point on Linux machine. In order to get to data for that mount\_point I am using the drop\_event.when.regexp.mount\_point filter in the metricbeat.yaml… --- ## [Filebeat causes duplicate entries / clearing up](https://discuss.elastic.co/t/filebeat-causes-duplicate-entries-clearing-up/125274)
**Author:** [@bolivia](https://discuss.elastic.co/u/bolivia)\ **Replies:** 0\ **Last updated:** [March 22, 2018, 9:49pm UTC](https://discuss.elastic.co/t/filebeat-causes-duplicate-entries-clearing-up/125274 "2018-03-22T21:49:17Z")
Good evening, I have a problem with the data in the ELK sent to me by Filebeat. I now have loads of duplicate entries. After configuring bulk\_max\_size to 1024, creating duplicate entries has stopped, but I'd like to cl… --- ## [Filebeat template with authentication](https://discuss.elastic.co/t/filebeat-template-with-authentication/124989)
**Author:** [@tommy.walker](https://discuss.elastic.co/u/tommy.walker)\ **Replies:** 2\ **Last updated:** [March 22, 2018, 8:57pm UTC](https://discuss.elastic.co/t/filebeat-template-with-authentication/124989 "2018-03-22T20:57:39Z")
I have just stood up separate elastic, logstash and kibana servers. All running 6.2. I have filebeats 6.2 running on windows 2016 server running iis v10. I have the iis logs successfully sending to logstash and i can s… --- ## [Winlogbeat getting x509: certificate signed by unknown authority while setting up Kibana](https://discuss.elastic.co/t/winlogbeat-getting-x509-certificate-signed-by-unknown-authority-while-setting-up-kibana/125006)
**Author:** [@elasticprof](https://discuss.elastic.co/u/elasticprof)\ **Replies:** 18\ **Last updated:** [March 22, 2018, 8:15pm UTC](https://discuss.elastic.co/t/winlogbeat-getting-x509-certificate-signed-by-unknown-authority-while-setting-up-kibana/125006 "2018-03-22T20:15:51Z")
I am getting x509: certificate signed by unknown authority error while trying to setup Kibana PS C:\\winlogbeat\> .\\winlogbeat.exe setup --dashboards Logstash Beats configuration file input { stdin {} beats { … --- ## [Hostname to display in Dashboard](https://discuss.elastic.co/t/hostname-to-display-in-dashboard/125232)
**Author:** [@Didier1](https://discuss.elastic.co/u/Didier1)\ **Replies:** 2\ **Last updated:** [March 22, 2018, 7:44pm UTC](https://discuss.elastic.co/t/hostname-to-display-in-dashboard/125232 "2018-03-22T19:44:52Z")
Hi, Hoping it's the right board to ask this one. Would it be possible to have the beat.hostname field displayrd in the \[Metricbeat System\] Host overview dashboard body and not only in the lucene query input box ? Indee… --- ## [Monitor kafka lag](https://discuss.elastic.co/t/monitor-kafka-lag/124106)
**Author:** [@Richard\_Neely](https://discuss.elastic.co/u/Richard_Neely)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 6:06pm UTC](https://discuss.elastic.co/t/monitor-kafka-lag/124106 "2018-03-22T18:06:58Z")
I'm looking to calculate lag for kafka which seems like it is kafka.partition.offset.newest - kafka.consumergroup.offset. Those fields are in different documents though across the consumergroup and partition metricset. I… --- ## [Filtering by Event source](https://discuss.elastic.co/t/filtering-by-event-source/125073)
**Author:** [@elasticprof](https://discuss.elastic.co/u/elasticprof)\ **Replies:** 4\ **Last updated:** [March 22, 2018, 6:01pm UTC](https://discuss.elastic.co/t/filtering-by-event-source/125073 "2018-03-22T18:01:51Z")
Hi How can i filter by EventSource, the events are sent from one of our custom applications and i wanted to log only those messages but not all messages for "Application" for example i want to send the messages only fr… --- ## [Filebeat 6.2.3 index is empty](https://discuss.elastic.co/t/filebeat-6-2-3-index-is-empty/125070)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 13\ **Last updated:** [March 22, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-6-2-3-index-is-empty/125070 "2018-03-22T16:57:04Z")
Since upgrading to 6.2.3 the filebeat index is empty. Any idea where to start looking? Filebeat debug output: 2018-03-21T16:11:28.994-0400 DEBUG \[publish\] pipeline/processor.go:275 Publish event: { "@… --- ## [How to change the default type "doc" for fileBeat index when ingest data to ES by ingest?](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786)
**Author:** [@jackyshen](https://discuss.elastic.co/u/jackyshen)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 4:33pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-type-doc-for-filebeat-index-when-ingest-data-to-es-by-ingest/124786 "2018-03-22T16:33:12Z")
I set the prospectors to ingest Nginx log to ES by fileBeat 5.5.0, and I found the type is "\_type": "doc". I want to change the type name doc to other name, how to do it ? \*\*My config :\*\* filebeat.prospectors: - ty… --- ## [Beat agents installation on multiple servers / hosts](https://discuss.elastic.co/t/beat-agents-installation-on-multiple-servers-hosts/124847)
**Author:** [@codeguru](https://discuss.elastic.co/u/codeguru)\ **Replies:** 1\ **Last updated:** [March 22, 2018, 2:10pm UTC](https://discuss.elastic.co/t/beat-agents-installation-on-multiple-servers-hosts/124847 "2018-03-22T14:10:58Z")
I have installed beat agents on single machine and I want to get them installed (winlogbeat, metricbeat and filebeat) on 5 more machines in my environment. I don't want to login to each and every machine and install them… --- ## [Filbeat process fails after SAN controller restart](https://discuss.elastic.co/t/filbeat-process-fails-after-san-controller-restart/124970)
**Author:** [@playfair039](https://discuss.elastic.co/u/playfair039)\ **Replies:** 1\ **Last updated:** [March 22, 2018, 1:59pm UTC](https://discuss.elastic.co/t/filbeat-process-fails-after-san-controller-restart/124970 "2018-03-22T13:59:47Z")
I've had a few issues with filebeat in my reference environment where after restarting the SAN controller as part of tests, the filebeat process stops and fails to restart - fixed by restarting after removing the registr… --- ## [Field.yml](https://discuss.elastic.co/t/field-yml/121539)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 17\ **Last updated:** [March 22, 2018, 1:31pm UTC](https://discuss.elastic.co/t/field-yml/121539 "2018-03-22T13:31:49Z")
I've installed Filebeat on my mac with Homebrew; in the config folder i don't find the Field.yml . Could you helm me ? --- ## [Mapper\_parsing\_exception in filebeat logs suddenly](https://discuss.elastic.co/t/mapper-parsing-exception-in-filebeat-logs-suddenly/124277)
**Author:** [@Kamal\_Raj](https://discuss.elastic.co/u/Kamal_Raj)\ **Replies:** 12\ **Last updated:** [March 22, 2018, 1:25pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-in-filebeat-logs-suddenly/124277 "2018-03-22T13:25:34Z")
Suddenly from midnight yesterday, stopped seeing logs in Kibana, and Filebeat logs has the following. Didnot do any change. Please help 2018-03-16T14:43:56+05:30 WARN Can not index event (status=400): {"type":"mapper\_pa… --- ## [Dropping Events in Kubernetes](https://discuss.elastic.co/t/dropping-events-in-kubernetes/125195)
**Author:** [@strowi](https://discuss.elastic.co/u/strowi)\ **Replies:** 0\ **Last updated:** [March 22, 2018, 1:19pm UTC](https://discuss.elastic.co/t/dropping-events-in-kubernetes/125195 "2018-03-22T13:19:29Z")
Hi all, i am having a hard time getting filebeat to filter events from kubernetes. I have the processor (beat 6.2.3) setup like this: - type: docker containers.ids: - "\*" processors: - ad… --- ## [Load Kibana dashboard for MySQL](https://discuss.elastic.co/t/load-kibana-dashboard-for-mysql/125152)
**Author:** [@oerner](https://discuss.elastic.co/u/oerner)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 1:13pm UTC](https://discuss.elastic.co/t/load-kibana-dashboard-for-mysql/125152 "2018-03-22T13:13:28Z")
Hi, I'm getting a file not found error when trying to load Kibana dashboard. Metricbeat version: 6.2.2 Kibana version . : 5.5.2 Elasticsearch : 5.5.2 Elasticsearch and Kibana are AWS services, Metricbea… --- ## [How to configure metricbeat to monitor JVM memory](https://discuss.elastic.co/t/how-to-configure-metricbeat-to-monitor-jvm-memory/125106)
**Author:** [@muthu\_kumar1](https://discuss.elastic.co/u/muthu_kumar1)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 12:08pm UTC](https://discuss.elastic.co/t/how-to-configure-metricbeat-to-monitor-jvm-memory/125106 "2018-03-22T12:08:45Z")
I Have to monitor my server JVM heap , garbage collections analysis in metricbeat. How to do it? --- ## [Can I specify a logstash destination for filebeat xpack.monitoring?](https://discuss.elastic.co/t/can-i-specify-a-logstash-destination-for-filebeat-xpack-monitoring/125071)
**Author:** [@kaem2111](https://discuss.elastic.co/u/kaem2111)\ **Replies:** 1\ **Last updated:** [March 22, 2018, 11:43am UTC](https://discuss.elastic.co/t/can-i-specify-a-logstash-destination-for-filebeat-xpack-monitoring/125071 "2018-03-22T11:43:36Z")
Hello, according to https://www.elastic.co/guide/en/beats/filebeat/6.2/monitoring.html is there also a possibility to specify a logstash destination for xpack.monitoring instead of elasticsearch. My filebeat-node is … --- ## [Monitor memory of different java process on same via cmdline](https://discuss.elastic.co/t/monitor-memory-of-different-java-process-on-same-via-cmdline/125055)
**Author:** [@rsg](https://discuss.elastic.co/u/rsg)\ **Replies:** 1\ **Last updated:** [March 22, 2018, 11:40am UTC](https://discuss.elastic.co/t/monitor-memory-of-different-java-process-on-same-via-cmdline/125055 "2018-03-22T11:40:59Z")
i am looking for a way to separate javaprocess memory usage via commandline string and currently by default it shows total of all java process. Is there a way to do this via metricbeat? --- ## ["Failed to publish events", "use of closed network connection"](https://discuss.elastic.co/t/failed-to-publish-events-use-of-closed-network-connection/119399)
**Author:** [@Andrew\_Shu](https://discuss.elastic.co/u/Andrew_Shu)\ **Replies:** 12\ **Last updated:** [March 22, 2018, 8:50am UTC](https://discuss.elastic.co/t/failed-to-publish-events-use-of-closed-network-connection/119399 "2018-03-22T08:50:01Z")
I'm trying to get a basic ELK setup, but I've been having difficulties verifying that Filebeat publishes to Logstash. Filebeat reports that it can't publish events because "use of closed network connection". I suspect i… --- ## [Metricbeat in DMZ](https://discuss.elastic.co/t/metricbeat-in-dmz/125021)
**Author:** [@kot\_nn](https://discuss.elastic.co/u/kot_nn)\ **Replies:** 1\ **Last updated:** [March 22, 2018, 5:48am UTC](https://discuss.elastic.co/t/metricbeat-in-dmz/125021 "2018-03-22T05:48:47Z")
Hello there! We have some servers where we want to collect PERFORMANCE logs from with METRICBEAT. Is there any another way besides of opening port from each server to Elastic? I saw some discussions where the suggest… --- ## [Metricbeat in Kubernetes fails to find Elasticsearch host](https://discuss.elastic.co/t/metricbeat-in-kubernetes-fails-to-find-elasticsearch-host/124867)
**Author:** [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\ **Replies:** 2\ **Last updated:** [March 21, 2018, 3:58pm UTC](https://discuss.elastic.co/t/metricbeat-in-kubernetes-fails-to-find-elasticsearch-host/124867 "2018-03-21T15:58:55Z")
metricbeat 6.2.3/elasticsearch 6.2.2/kubernetes 1.9 error: ERROR pipeline/output.go:74 Failed to connect: Get http://elasticsearch:9200: lookup elasticsearch on 148.93.51.11:53: no such host config values: ELASTICSEA… --- ## [Filebeat apache2 no visualization is showing](https://discuss.elastic.co/t/filebeat-apache2-no-visualization-is-showing/124280)
**Author:** [@Pankaj\_Sakhare](https://discuss.elastic.co/u/Pankaj_Sakhare)\ **Replies:** 9\ **Last updated:** [March 21, 2018, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-apache2-no-visualization-is-showing/124280 "2018-03-21T14:50:56Z")
Can any one help me out to get filebeat apache2 visualization . [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=463) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=465)