# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=466 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 467 --- ## [Cannot search /var/log/messages without '\*' wildcard before string](https://discuss.elastic.co/t/cannot-search-var-log-messages-without-wildcard-before-string/123952)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 7\ **Last updated:** [March 18, 2018, 8:04pm UTC](https://discuss.elastic.co/t/cannot-search-var-log-messages-without-wildcard-before-string/123952 "2018-03-18T20:04:22Z")
Version 6.2.2 System module enabled. When searching in Discover /var/log/messages returns zero results. However, the syslog messages are showing in Discover. If I search for user I get results. If searching for user\* th… --- ## [Packetbeat cannot parse Tomcat's response status line because of reason phrase](https://discuss.elastic.co/t/packetbeat-cannot-parse-tomcats-response-status-line-because-of-reason-phrase/124223)
**Author:** [@cero-t](https://discuss.elastic.co/u/cero-t)\ **Replies:** 4\ **Last updated:** [March 17, 2018, 9:14am UTC](https://discuss.elastic.co/t/packetbeat-cannot-parse-tomcats-response-status-line-because-of-reason-phrase/124223 "2018-03-17T09:14:34Z")
I tried to use Packetbeat 6.2.2 to capture packets of Tomcat request / response but failed to capture with this error. http/http\_parser.go(156) Failed to understand HTTP response status: 200 Tomcat (\> 8.5) returns only… --- ## [Metricbeat Perfmon is creating to many single events](https://discuss.elastic.co/t/metricbeat-perfmon-is-creating-to-many-single-events/114827)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 6\ **Last updated:** [March 16, 2018, 9:57pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-is-creating-to-many-single-events/114827 "2018-03-16T21:57:33Z")
Hi Everyone, im using the 6.0.0-Alpha2 until now and want to switch to 6.0.1, but when upgrade to 6.0.1 i see that every counter/result is now creating 1 event instead to put all counters/results in one event like befo… --- ## [..request retries exceeded max retry timeout \[30000\]](https://discuss.elastic.co/t/request-retries-exceeded-max-retry-timeout-30000/124007)
**Author:** [@juanaramis](https://discuss.elastic.co/u/juanaramis)\ **Replies:** 2\ **Last updated:** [March 16, 2018, 8:12pm UTC](https://discuss.elastic.co/t/request-retries-exceeded-max-retry-timeout-30000/124007 "2018-03-16T20:12:48Z")
Hi team, I'm receiving this error: org.elasticsearch.common.util.concurrent.UncategorizedExecutionException: Failed execution at org.elasticsearch.action.support.AdapterActionFuture.rethrowExecutionException(AdapterAc… --- ## [Renaming example Kibana dashboards](https://discuss.elastic.co/t/renaming-example-kibana-dashboards/123444)
**Author:** [@sgiri](https://discuss.elastic.co/u/sgiri)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 8:07pm UTC](https://discuss.elastic.co/t/renaming-example-kibana-dashboards/123444 "2018-03-16T20:07:59Z")
Is there a way to rename the example Kibana Dashboards that comes with filebeat? The Configuration Dashboard and Configuration Template do help in changing the elasticsearch index name and index name defined in the dashb… --- ## [Filebeat new module - how to complete](https://discuss.elastic.co/t/filebeat-new-module-how-to-complete/123104)
**Author:** [@Asher\_Shoshan](https://discuss.elastic.co/u/Asher_Shoshan)\ **Replies:** 9\ **Last updated:** [March 16, 2018, 6:01pm UTC](https://discuss.elastic.co/t/filebeat-new-module-how-to-complete/123104 "2018-03-16T18:01:46Z")
Trying to create additional module to filebeat (some application log); followed the manual, but not sure how to complete the task after creating the fields.. How do I move it into a filebeat docker container? --- ## [Winlogbeat network port usage](https://discuss.elastic.co/t/winlogbeat-network-port-usage/124306)
**Author:** [@minidan](https://discuss.elastic.co/u/minidan)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 4:41pm UTC](https://discuss.elastic.co/t/winlogbeat-network-port-usage/124306 "2018-03-16T16:41:43Z")
Hi, maybe daft question, but what protocol port does Winlogbeat use to send from on PCs? --- ## [Kubernetes - ConfigMap](https://discuss.elastic.co/t/kubernetes-configmap/123812)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 9\ **Last updated:** [March 16, 2018, 4:35pm UTC](https://discuss.elastic.co/t/kubernetes-configmap/123812 "2018-03-16T16:35:04Z")
Hi! I'm having an issue with Filebeat running in Kubernetes. I'm using the filebeat-kubernetes.yml file from the documentation and have made following change to the filebeat-prospectors ConfigMap: \> data: \> kubernet… --- ## [How to collect more than 22 event ids with winlogbeat?](https://discuss.elastic.co/t/how-to-collect-more-than-22-event-ids-with-winlogbeat/124274)
**Author:** [@FanteG](https://discuss.elastic.co/u/FanteG)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 2:03pm UTC](https://discuss.elastic.co/t/how-to-collect-more-than-22-event-ids-with-winlogbeat/124274 "2018-03-16T14:03:07Z")
I've got a task to collect over 500 events from DC with winlogbeat. But windows got a limit 22 events to query. I'm using version 6.1.2. I've tried with processors like this: winlogbeat.event\_logs: - name: Security … --- ## [Winlogbeat deploy via GPO](https://discuss.elastic.co/t/winlogbeat-deploy-via-gpo/121063)
**Author:** [@mforg85](https://discuss.elastic.co/u/mforg85)\ **Replies:** 4\ **Last updated:** [March 16, 2018, 2:15pm UTC](https://discuss.elastic.co/t/winlogbeat-deploy-via-gpo/121063 "2018-03-16T14:15:08Z")
Has anybody deployed winlogbeat through GPO? I have a general plan I have worked out to try to get this to work however I want to see if I am missing anything or not thinking about this correctly. --- ## [Two filebeat instances](https://discuss.elastic.co/t/two-filebeat-instances/123132)
**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\ **Replies:** 8\ **Last updated:** [March 16, 2018, 2:03pm UTC](https://discuss.elastic.co/t/two-filebeat-instances/123132 "2018-03-16T14:03:26Z")
can i get two filebeat instances working at the same time, one sending to elasticsearch and the other to logstash? i have lots of messages being parsed by logstash (postfix, cyrus) and it would be too much trouble migra… --- ## [Constant timeouts querying Packetbeat indices](https://discuss.elastic.co/t/constant-timeouts-querying-packetbeat-indices/123897)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 3\ **Last updated:** [March 16, 2018, 1:16pm UTC](https://discuss.elastic.co/t/constant-timeouts-querying-packetbeat-indices/123897 "2018-03-16T13:16:59Z")
We're running one ES/Kibana server and pulling in Filebeat, Metricbeat and Packetbeat data. The Filebeat and Metricbeat indices are a few hundred MB and run fine but Packetbeat indicies are several GB. When we include Pa… --- ## [Strange filebeat behavior: timeout and duplicate pushing to logstash's beats plugin](https://discuss.elastic.co/t/strange-filebeat-behavior-timeout-and-duplicate-pushing-to-logstashs-beats-plugin/122148)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 12\ **Last updated:** [March 16, 2018, 12:55pm UTC](https://discuss.elastic.co/t/strange-filebeat-behavior-timeout-and-duplicate-pushing-to-logstashs-beats-plugin/122148 "2018-03-16T12:55:09Z")
Hi, During my migration from 5.1.2 / 5.2.0 to 6.1.x / 6.2.1 I encountered some issues. Trying to sharpen the cause of my issues I noticed strange behavior when shipping files from filebeat to logstash. I got reproducib… --- ## [Nginx module - WARN Can not index event (status=400)](https://discuss.elastic.co/t/nginx-module-warn-can-not-index-event-status-400/123700)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 5\ **Last updated:** [March 16, 2018, 10:20am UTC](https://discuss.elastic.co/t/nginx-module-warn-can-not-index-event-status-400/123700 "2018-03-16T10:20:48Z")
Hi, I am trying to use NGINX module. Filebeat, elasticsearch and kibana are runing in version 6.1.0. According to here under extract from filebeat logs, I am experiencing index issue due to parsing exception ... Any hel… --- ## [Unable to strip IPv6 Address From Field](https://discuss.elastic.co/t/unable-to-strip-ipv6-address-from-field/124177)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 8:50am UTC](https://discuss.elastic.co/t/unable-to-strip-ipv6-address-from-field/124177 "2018-03-16T08:50:17Z")
I am using the below filter but it isn't working. No errors being thrown, the string just isn't being stripped. filter { if "::ffff:" in \[event\_data.IpAddress\] { mutate { id =\> "IPv6 Strip" gsub =\> \[ … --- ## [Issue with winlogbeat data in visualizations/dashboards](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182)
**Author:** [@Malachi](https://discuss.elastic.co/u/Malachi)\ **Replies:** 1\ **Last updated:** [March 16, 2018, 12:37am UTC](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182 "2018-03-16T00:37:58Z")
Hello, I seem to have an issue with recent data not being available for visualizations or dashboards in Kibana. I have winlogbeats data from several servers that goes into my ELK stack. I have saved searches for this da… --- ## [Filebeat to elasticsearch in Kubernetes](https://discuss.elastic.co/t/filebeat-to-elasticsearch-in-kubernetes/124155)
**Author:** [@clule404](https://discuss.elastic.co/u/clule404)\ **Replies:** 1\ **Last updated:** [March 15, 2018, 5:58pm UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearch-in-kubernetes/124155 "2018-03-15T17:58:58Z")
Hi everyone, I have some problems with Filebeat -\> Elasticsearch -\> Kibana in Kubernetes. I get my logs to show up in Kibana, that's not the problem. The problem is, that every Log that shows up just has the following… --- ## [Filebeat is not shipping the log data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-shipping-the-log-data-to-elasticsearch/120690)
**Author:** [@t.d.garland100](https://discuss.elastic.co/u/t.d.garland100)\ **Replies:** 18\ **Last updated:** [March 13, 2018, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-is-not-shipping-the-log-data-to-elasticsearch/120690 "2018-03-13T15:28:56Z")
I am following the use case for Machine Learning for Elastic Stack found at the link below: Suspicious Login Activity My system: Ubuntu 16.04, Elastic Stack 5.6.7 (Elasticsearch, Kibana and Filebeat) with X-Pack and I… --- ## [Filebeat is not sending data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/123915)
**Author:** [@solo](https://discuss.elastic.co/u/solo)\ **Replies:** 2\ **Last updated:** [March 15, 2018, 2:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-data-to-elasticsearch/123915 "2018-03-15T14:46:42Z")
I have a standard Ubuntu 17.10 installation. I've installed elasticsearch, kibana and filebeat. Filebeat is processing data from a log file named fuse.log, but it is not sending it to Elasticsearch. I'm not sure where… --- ## [Is raw data gathering possible with packetbeat?](https://discuss.elastic.co/t/is-raw-data-gathering-possible-with-packetbeat/123935)
**Author:** [@tancfire](https://discuss.elastic.co/u/tancfire)\ **Replies:** 2\ **Last updated:** [March 15, 2018, 2:32pm UTC](https://discuss.elastic.co/t/is-raw-data-gathering-possible-with-packetbeat/123935 "2018-03-15T14:32:34Z")
Hello, Packetbeat is very useful to sniff and send data to logstash, so i started to use it. But now, i have a problem: I want to get the raw data (in heaxdecimal, like in wireshark) when packetbeat cannot recognize th… --- ## [Filebeat logfile property expansion json](https://discuss.elastic.co/t/filebeat-logfile-property-expansion-json/121088)
**Author:** [@tom.stark](https://discuss.elastic.co/u/tom.stark)\ **Replies:** 8\ **Last updated:** [March 15, 2018, 2:09pm UTC](https://discuss.elastic.co/t/filebeat-logfile-property-expansion-json/121088 "2018-03-15T14:09:33Z")
Did replace fluentd/logstash with filebeat. Use filebeat on 6.2 version and works well, filebeat-prospector with following config. Explaining: type docker did not work, because json in json problem, error messages with p… --- ## [Filebeat is not closig the file descriptor and the file descriptors are dangling, when the file is deleted/renamed](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-and-the-file-descriptors-are-dangling-when-the-file-is-deleted-renamed/123600)
**Author:** [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Replies:** 3\ **Last updated:** [March 15, 2018, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-and-the-file-descriptors-are-dangling-when-the-file-is-deleted-renamed/123600 "2018-03-15T12:29:10Z")
Hi, We are still facing same issue that file descriptors are dangling. for reference: Do we have to update the logstash version from logstash-5.2.1-1.noarch to logstash-5.6 Need your assistance on this issue. Than… --- ## [Kibana - setup specific dashboard (not everything)](https://discuss.elastic.co/t/kibana-setup-specific-dashboard-not-everything/124076)
**Author:** [@Constantin07](https://discuss.elastic.co/u/Constantin07)\ **Replies:** 1\ **Last updated:** [March 15, 2018, 12:12pm UTC](https://discuss.elastic.co/t/kibana-setup-specific-dashboard-not-everything/124076 "2018-03-15T12:12:31Z")
Hi, Looks like metricbeat setup --dashboards allows to import all available default dashboards thus polluting Kibana with unnecessary dashboards/visualisations. Is there any way to tell metricbeat to import just MongoD… --- ## [Message gets split](https://discuss.elastic.co/t/message-gets-split/123856)
**Author:** [@Uwais\_Ibrahim](https://discuss.elastic.co/u/Uwais_Ibrahim)\ **Replies:** 1\ **Last updated:** [March 15, 2018, 11:35am UTC](https://discuss.elastic.co/t/message-gets-split/123856 "2018-03-15T11:35:27Z")
Hi, I have a log file with a single hit as given below. 2018-01-23 05:13:52,995 INFO org.service.impl.TemplateService - template data after update for templateId: 501 and case-type 1 is {"regionalAnesthesiaValues":{"… --- ## [RabbitMQ cluster - node metrics reported multiple times](https://discuss.elastic.co/t/rabbitmq-cluster-node-metrics-reported-multiple-times/123592)
**Author:** [@Constantin07](https://discuss.elastic.co/u/Constantin07)\ **Replies:** 4\ **Last updated:** [March 15, 2018, 9:53am UTC](https://discuss.elastic.co/t/rabbitmq-cluster-node-metrics-reported-multiple-times/123592 "2018-03-15T09:53:56Z")
Hello, I've deployed metricbeat 6.2.2 on a cluster of 3 RabbitMQ nodes. It works fine and I see node & queue metrics in Elasticsearch/Kibana coming through. But for some reason for the node metrics every 10 seconds I ge… --- ## [Filebeat to collect Pega logs and to send to ELK machine](https://discuss.elastic.co/t/filebeat-to-collect-pega-logs-and-to-send-to-elk-machine/123834)
**Author:** [@deepasreetk](https://discuss.elastic.co/u/deepasreetk)\ **Replies:** 3\ **Last updated:** [March 14, 2018, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-to-collect-pega-logs-and-to-send-to-elk-machine/123834 "2018-03-14T20:02:10Z")
Hi All, Facing big challenge while setting up and testing the filebeat on a Pega machine and to send the json logs to filebeat.once this is succesful need to parse the logs to elk stack. Kindly help.typically new to th… --- ## [Wmi: cannot load field "CommandLine" into a "string": unsupported type (\)](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931)
**Author:** [@phil.zac](https://discuss.elastic.co/u/phil.zac)\ **Replies:** 7\ **Last updated:** [March 14, 2018, 6:59pm UTC](https://discuss.elastic.co/t/wmi-cannot-load-field-commandline-into-a-string-unsupported-type-nil/123931 "2018-03-14T18:59:58Z")
Hi, I am using elasticsearch-5.6.1 kibana-5.6.1 logstash-5.6.1 metricbeat-5.6.1 packetbeat-5.6.1 x-pack-5.6.1 for Windows Server 2012 R2 I am working on Metric beats and find this error. 2018/03/14 15:16:48.733… --- ## [Auditbeat event types](https://discuss.elastic.co/t/auditbeat-event-types/123966)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 6:10pm UTC](https://discuss.elastic.co/t/auditbeat-event-types/123966 "2018-03-14T18:10:14Z")
Is there a list of auditbeat event types and categories? It seems that auditbeat is logging authentication events when I don't see anything besides 1 single rule in my auditbeat.yml config file so I'm curious if there is… --- ## [Kubernetes state\_container issues](https://discuss.elastic.co/t/kubernetes-state-container-issues/122759)
**Author:** [@Richard\_Neely](https://discuss.elastic.co/u/Richard_Neely)\ **Replies:** 4\ **Last updated:** [March 14, 2018, 6:02pm UTC](https://discuss.elastic.co/t/kubernetes-state-container-issues/122759 "2018-03-14T18:02:51Z")
Currently running 6.2.2 across the board. I'm looking to gather metrics for kubernetes.container.memory.request.bytes and kubernetes.container.cpu.request.nanocores from state\_container but it doesn't list all pods the… --- ## [Need help to setup filebeat](https://discuss.elastic.co/t/need-help-to-setup-filebeat/120320)
**Author:** [@itzik16](https://discuss.elastic.co/u/itzik16)\ **Replies:** 8\ **Last updated:** [March 14, 2018, 1:47pm UTC](https://discuss.elastic.co/t/need-help-to-setup-filebeat/120320 "2018-03-14T13:47:16Z")
Hello I want to use filebeat to import my logs to elasticsearch. I have a python script which collects data from 30 sensors and stores data from each sensor to his own directory and log (A-B/0-14/YYYY-MM-dd.log) every 1… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=465) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=467)