# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=467 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 468 --- ## [Filebeat can't get log written at php by “fwrite”](https://discuss.elastic.co/t/filebeat-cant-get-log-written-at-php-by-fwrite/123733)
**Author:** [@vincnetwang0736](https://discuss.elastic.co/u/vincnetwang0736)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 1:28pm UTC](https://discuss.elastic.co/t/filebeat-cant-get-log-written-at-php-by-fwrite/123733 "2018-03-14T13:28:16Z")
My filebeat can't get the log file that written on php by "fwrite" Here is my php coding: Here is my php coding: $date = date("Y-M-d"); $log\_path = JSON\_LOG\_PATH."\_".$date."\_".$eventid.".log"; if (!is\_file($log\_path… --- ## [Why I can't get all log from filebeat to elasticsearch?](https://discuss.elastic.co/t/why-i-cant-get-all-log-from-filebeat-to-elasticsearch/123107)
**Author:** [@vincnetwang0736](https://discuss.elastic.co/u/vincnetwang0736)\ **Replies:** 3\ **Last updated:** [March 14, 2018, 1:26pm UTC](https://discuss.elastic.co/t/why-i-cant-get-all-log-from-filebeat-to-elasticsearch/123107 "2018-03-14T13:26:54Z")
Here is my logstash config: input { beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> \["/etc/pki/tls/certs/filebeat.crt"\] ssl\_certificate =\> "/etc/pki/tls/certs/logstash.crt" … --- ## [Configure sincedb in filebeat](https://discuss.elastic.co/t/configure-sincedb-in-filebeat/123672)
**Author:** [@sunilkumar](https://discuss.elastic.co/u/sunilkumar)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 1:04pm UTC](https://discuss.elastic.co/t/configure-sincedb-in-filebeat/123672 "2018-03-14T13:04:02Z")
how to configure sincedb\_path =\> "/dev/null" ignore\_older =\> 0 in filebeat ? --- ## [Filebeat mysql slowlog pipeline.json decoding failure](https://discuss.elastic.co/t/filebeat-mysql-slowlog-pipeline-json-decoding-failure/123797)
**Author:** [@Rytis](https://discuss.elastic.co/u/Rytis)\ **Replies:** 4\ **Last updated:** [March 14, 2018, 10:11am UTC](https://discuss.elastic.co/t/filebeat-mysql-slowlog-pipeline-json-decoding-failure/123797 "2018-03-14T10:11:04Z")
Hello, I have a problem with mysql slowlog parsing. I tried to change mysql slowlog pipeline.json file so it could parse my slowlogs. Now it looks like this: { "description": "Pipeline for parsing MySQL slow logs.",… --- ## [Filebeat JSON parsing Error](https://discuss.elastic.co/t/filebeat-json-parsing-error/123648)
**Author:** [@prime8](https://discuss.elastic.co/u/prime8)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 8:47am UTC](https://discuss.elastic.co/t/filebeat-json-parsing-error/123648 "2018-03-14T08:47:56Z")
Here is my filebeat configuration in windows type: log enabled: true paths: c:\\logs\* json.keys\_under\_root: true json.add\_error\_key: true and my log looks like: {"level":30,"time":1520891892759,"pid":15268… --- ## [Metricbeat does not create fields in document](https://discuss.elastic.co/t/metricbeat-does-not-create-fields-in-document/123623)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 8:45am UTC](https://discuss.elastic.co/t/metricbeat-does-not-create-fields-in-document/123623 "2018-03-14T08:45:12Z")
Hello, I am having metricbeat configured with system module and enabled but the it does not create the fields in the elasticsearch documents. However creating the vizualization does show the graphs. - module: system … --- ## [Multiple filebeat\_\.yml files from a central log sever](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894)
**Author:** [@penguingeek](https://discuss.elastic.co/u/penguingeek)\ **Replies:** 4\ **Last updated:** [March 14, 2018, 8:36am UTC](https://discuss.elastic.co/t/multiple-filebeat-host-yml-files-from-a-central-log-sever/122894 "2018-03-14T08:36:13Z")
I have a central log server that i want to forward logs to logstash from. The issue I am having is that since I am forwarding logs to the central server, there are no logs stored locally for filebeat to pull from. Now i … --- ## [Cannot unmarshal number into Go value of type map\[string\]interface {}](https://discuss.elastic.co/t/cannot-unmarshal-number-into-go-value-of-type-map-string-interface/123822)
**Author:** [@Alan\_Yang](https://discuss.elastic.co/u/Alan_Yang)\ **Replies:** 1\ **Last updated:** [March 14, 2018, 7:43am UTC](https://discuss.elastic.co/t/cannot-unmarshal-number-into-go-value-of-type-map-string-interface/123822 "2018-03-14T07:43:51Z")
Here is my log: 2017-05-12 08:46:35.1280 - INFO: Performance - ConfigurationComponent.GetCountryFields executed in 2625 ms. - {"Class":"ConfigurationComponent","Method":"GetCountryFields","Ms":"test","Ticks":"test1"} H… --- ## [Where can I see alll Winlogbeat Event ID definitions?](https://discuss.elastic.co/t/where-can-i-see-alll-winlogbeat-event-id-definitions/123190)
**Author:** [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)\ **Replies:** 1\ **Last updated:** [March 13, 2018, 7:59pm UTC](https://discuss.elastic.co/t/where-can-i-see-alll-winlogbeat-event-id-definitions/123190 "2018-03-13T19:59:33Z")
Does anyone know where the winlogbeat event ID's are at? I have winlogbet\_even\_id = 600 But I would also like to know where I can see all of them as a knowledgebase? --- ## [How to load winlogbeat dashboard --\> KIB/ES](https://discuss.elastic.co/t/how-to-load-winlogbeat-dashboard-kib-es/123410)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 4\ **Last updated:** [March 13, 2018, 7:28pm UTC](https://discuss.elastic.co/t/how-to-load-winlogbeat-dashboard-kib-es/123410 "2018-03-13T19:28:14Z")
Hi. I'm having difficulty trying to load my default Kibana Dashboard because my ES stack is on a separate system compared to where I have installed winlogbeat. Does anybody have the correct syntax that I can follow.... … --- ## [Filebeat multiline parsing problem](https://discuss.elastic.co/t/filebeat-multiline-parsing-problem/122525)
**Author:** [@jof300](https://discuss.elastic.co/u/jof300)\ **Replies:** 4\ **Last updated:** [March 13, 2018, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parsing-problem/122525 "2018-03-13T12:48:14Z")
Hi community, I started to use filebeat to get my tomcats logs into ELK. It works fine for some logs but when I am trying to use multiline pattern, I got troubles. I followed the documentation to get all lines of one e… --- ## [Multline Logs via filebeat](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706)
**Author:** [@saramali](https://discuss.elastic.co/u/saramali)\ **Replies:** 2\ **Last updated:** [March 13, 2018, 11:31am UTC](https://discuss.elastic.co/t/multline-logs-via-filebeat/123706 "2018-03-13T11:31:59Z")
I'm sending logs to a remote server via filebeat. Currently, each line of log is sent separately as a document. I want to send filebeat to send the log as one document till the loglevel of the next log is found. It is ea… --- ## [Filebeat 5.6.4 Service can't be created : Access Denied](https://discuss.elastic.co/t/filebeat-5-6-4-service-cant-be-created-access-denied/123679)
**Author:** [@arun3](https://discuss.elastic.co/u/arun3)\ **Replies:** 1\ **Last updated:** [March 13, 2018, 11:24am UTC](https://discuss.elastic.co/t/filebeat-5-6-4-service-cant-be-created-access-denied/123679 "2018-03-13T11:24:12Z")
When I am trying to install filebeat with "install-service-filebeat.ps1" , getting the below error. Please suggest. PS C:\\Users\\Arun\\filebeat-5.6.4\> PowerShell.exe -ExecutionPolicy UnRestricted -File .\\install-service-… --- ## [How to get more kubernetes metadata with filebeat](https://discuss.elastic.co/t/how-to-get-more-kubernetes-metadata-with-filebeat/123612)
**Author:** [@jenciso](https://discuss.elastic.co/u/jenciso)\ **Replies:** 1\ **Last updated:** [March 13, 2018, 11:22am UTC](https://discuss.elastic.co/t/how-to-get-more-kubernetes-metadata-with-filebeat/123612 "2018-03-13T11:22:59Z")
Hi community I'm collecting logs of my kubernetes cluster using this guide "the blog article of ELK 6.x ". Using this method, I'm collecting many fields, like kubernetes.pod.name, kubernetes.annotations.abc, etc, it's … --- ## [Filebeat --\> Logstash works but directly to Elasticsearch = nothing](https://discuss.elastic.co/t/filebeat-logstash-works-but-directly-to-elasticsearch-nothing/123399)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 4\ **Last updated:** [March 13, 2018, 10:55am UTC](https://discuss.elastic.co/t/filebeat-logstash-works-but-directly-to-elasticsearch-nothing/123399 "2018-03-13T10:55:44Z")
Hi. Filebeat can grab logs via the prospectors and send to Logstash then to Elasticsearch no problem but when I change the filebeat.yml to send directly to Elasticsearch I am not getting any output. Can anybody shed som… --- ## [High Memory for specific application](https://discuss.elastic.co/t/high-memory-for-specific-application/123705)
**Author:** [@deepanshu\_yadav](https://discuss.elastic.co/u/deepanshu_yadav)\ **Replies:** 1\ **Last updated:** [March 13, 2018, 10:12am UTC](https://discuss.elastic.co/t/high-memory-for-specific-application/123705 "2018-03-13T10:12:57Z")
Hi, I'm facing High Memory for particular microservice application on one time per day basis while CPU is normal --- ## [Beats to Elasticsearch or Beats to Logstash? Which is best practice](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594)
**Author:** [@RayS](https://discuss.elastic.co/u/RayS)\ **Replies:** 2\ **Last updated:** [March 13, 2018, 8:41am UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594 "2018-03-13T08:41:01Z")
Is it better to send all beats data to logstash or send it directly to elasticsearch? I'm in the process of engineering my setup here and was wonder what is considered best practice? --- ## [Preferred way to upgrade beats library](https://discuss.elastic.co/t/preferred-way-to-upgrade-beats-library/122744)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 3\ **Last updated:** [March 13, 2018, 8:35am UTC](https://discuss.elastic.co/t/preferred-way-to-upgrade-beats-library/122744 "2018-03-13T08:35:13Z")
Hi I have a custom beat based upon metricbeat 6.0 now I want to build this beat against metricbeat 6.2. Just checking out the 6.2 version of the beat code and compiling doesn't work. I got the following error: ./main… --- ## [Docker module doesn't send healthcheck info](https://discuss.elastic.co/t/docker-module-doesnt-send-healthcheck-info/122001)
**Author:** [@thomaskelder](https://discuss.elastic.co/u/thomaskelder)\ **Replies:** 5\ **Last updated:** [March 13, 2018, 7:14am UTC](https://discuss.elastic.co/t/docker-module-doesnt-send-healthcheck-info/122001 "2018-03-13T07:14:32Z")
Hi, I'm running metricbeat 6.2.2 using the official Docker image and have it configured to use the system and docker modules (see configuration below). I mapped the required volumes to /hostfs and my logstash is receivi… --- ## [How to Configure watch.poll\_file in heartbeat.yml file](https://discuss.elastic.co/t/how-to-configure-watch-poll-file-in-heartbeat-yml-file/123391)
**Author:** [@dsvaishal](https://discuss.elastic.co/u/dsvaishal)\ **Replies:** 2\ **Last updated:** [March 13, 2018, 6:33am UTC](https://discuss.elastic.co/t/how-to-configure-watch-poll-file-in-heartbeat-yml-file/123391 "2018-03-13T06:33:43Z")
Hi Team, I am trying to use watch.poll\_file in heartbeat.yml file. But facing error. |2018-03-10T21:01:02.113+0530|ERROR|beater/manager.go:176|Failed parsing job schedule: %!(EXTRA ucfg.baseError=missing required fiel… --- ## [Kafka Output](https://discuss.elastic.co/t/kafka-output/123650)
**Author:** [@ms\_sec](https://discuss.elastic.co/u/ms_sec)\ **Replies:** 0\ **Last updated:** [March 12, 2018, 11:07pm UTC](https://discuss.elastic.co/t/kafka-output/123650 "2018-03-12T23:07:00Z")
We are not able to get Kafka to failover correctly when our first Kafka broker is stopped. We want beats data to flow to our other Kafka brokers in our cluster. We have a 3 node broker cluster. Our first IP address is th… --- ## [FIlebeat timesout connecting to logstash](https://discuss.elastic.co/t/filebeat-timesout-connecting-to-logstash/122118)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [March 12, 2018, 7:34pm UTC](https://discuss.elastic.co/t/filebeat-timesout-connecting-to-logstash/122118 "2018-03-12T19:34:25Z")
Hello, I am running filebeat 6.2.x on ubuntu 14.04 used for gathering logs which should be pushed to logstash. However I keep seing that the filebeat cannot push the logs into the logstash because it is timing out conta… --- ## [Is it safe to use filebeat.registry\_flush in the filebeat 6.21](https://discuss.elastic.co/t/is-it-safe-to-use-filebeat-registry-flush-in-the-filebeat-6-21/121983)
**Author:** [@RishiSingh](https://discuss.elastic.co/u/RishiSingh)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 5:00pm UTC](https://discuss.elastic.co/t/is-it-safe-to-use-filebeat-registry-flush-in-the-filebeat-6-21/121983 "2018-03-12T17:00:29Z")
Hi, I am making use of filebeat 6.21, there are some cases when the include pattern does not match any line in the log file and hence the registry file is being updated frequently. By looking into the code I came ac… --- ## [Filebeat connection to elastic search](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search/123387)
**Author:** [@kanchan\_pingale](https://discuss.elastic.co/u/kanchan_pingale)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 4:06pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-elastic-search/123387 "2018-03-12T16:06:13Z")
I'm trying to connect filebeat which is running on windows to elasticsearch which is running on ubuntu i.e connection of filebeat and elasticsearch on two different machines. --- ## [Kafka publish failed with: circuit breaker is open](https://discuss.elastic.co/t/kafka-publish-failed-with-circuit-breaker-is-open/123339)
**Author:** [@andlaz](https://discuss.elastic.co/u/andlaz)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 3:36pm UTC](https://discuss.elastic.co/t/kafka-publish-failed-with-circuit-breaker-is-open/123339 "2018-03-12T15:36:08Z")
hi all, i'm having a problem with the kafka output in that it sends a couple MB worth of log messages right after start, then not a single one. It does not log much about a connection issue, the kafka cluster is healthy,… --- ## [Wildcard with drop\_fields](https://discuss.elastic.co/t/wildcard-with-drop-fields/123237)
**Author:** [@CeeDee](https://discuss.elastic.co/u/CeeDee)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 2:07pm UTC](https://discuss.elastic.co/t/wildcard-with-drop-fields/123237 "2018-03-12T14:07:02Z")
Hi, I wish to drop multiple fields starting with the same pattern (e.g. postgresql.database.rows.\*) from my metricbeat config. I've tried the following syntax but it does not seem to work: processors: - drop\_field… --- ## [Nil pointer dereference exception in libbeat/processors/add\_kubernetes\_metadata/kubernetes.go:161](https://discuss.elastic.co/t/nil-pointer-dereference-exception-in-libbeat-processors-add-kubernetes-metadata-kubernetes-go-161/123500)
**Author:** [@okke-formsma](https://discuss.elastic.co/u/okke-formsma)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 12:47pm UTC](https://discuss.elastic.co/t/nil-pointer-dereference-exception-in-libbeat-processors-add-kubernetes-metadata-kubernetes-go-161/123500 "2018-03-12T12:47:28Z")
I am seeing an issue in Filebeat 6.2.2. I'm running libbeat in a container on Kubernetes. Every other hour, the process will crash with the following stack trace: panic: runtime error: invalid memory address or nil poin… --- ## [Multiline read 2 times](https://discuss.elastic.co/t/multiline-read-2-times/122684)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 5\ **Last updated:** [March 12, 2018, 12:42pm UTC](https://discuss.elastic.co/t/multiline-read-2-times/122684 "2018-03-12T12:42:41Z")
I follow this example: https://www.elastic.co/guide/en/beats/filebeat/master/\_examples\_of\_multiline\_configuration.html I read the multiline properly but I read also the same log line by line. \[Sans%20titre\] My config: … --- ## [CRIT Exiting: Error in initing prospector: prospector outlet closed](https://discuss.elastic.co/t/crit-exiting-error-in-initing-prospector-prospector-outlet-closed/121992)
**Author:** [@bismayam](https://discuss.elastic.co/u/bismayam)\ **Replies:** 5\ **Last updated:** [March 12, 2018, 12:26pm UTC](https://discuss.elastic.co/t/crit-exiting-error-in-initing-prospector-prospector-outlet-closed/121992 "2018-03-12T12:26:13Z")
Hi, We have issue while starting filebeat. It was not sending data to logstash after working successfully for around 30 days. We checked that the size of registry file is 261MB. We are parsing around 1000 log files in … --- ## [Configuration error in filebeat in logstash](https://discuss.elastic.co/t/configuration-error-in-filebeat-in-logstash/123373)
**Author:** [@Abdur\_Raqeeb1](https://discuss.elastic.co/u/Abdur_Raqeeb1)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 10:41am UTC](https://discuss.elastic.co/t/configuration-error-in-filebeat-in-logstash/123373 "2018-03-12T10:41:13Z")
Hi, I am getting the below error after starting the filebeat 2018-03-10T06:29:01Z INFO Error publishing events (retrying): write tcp Agent-IP:46906-\>ELK-IP:5044: write: broken pipe 2018-03-10T06:29:24Z INFO Non-zero m… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=466) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=468)