# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=469 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 470 --- ## [Filebeat 6.2 throughput and general performance](https://discuss.elastic.co/t/filebeat-6-2-throughput-and-general-performance/122422)
**Author:** [@elena](https://discuss.elastic.co/u/elena)\ **Replies:** 6\ **Last updated:** [March 6, 2018, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-6-2-throughput-and-general-performance/122422 "2018-03-06T12:55:10Z")
Hello! I'm having some difficulties to maximize performances and I'd like to receive some advices. I'm using Filebeat (v. 6.2.2) to send output directly to Elasticsearch (v. 6.2.2), on a Linux Ubuntu machine with 16 co… --- ## [Windows beats and Logstash](https://discuss.elastic.co/t/windows-beats-and-logstash/122674)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 10:32am UTC](https://discuss.elastic.co/t/windows-beats-and-logstash/122674 "2018-03-06T10:32:14Z")
Hi All, Am trying to send the windows events from AD to logstash through winlogbeat. I have enabled the TLS in elastic and kibana , i use the cert and key generated by my CA. It works perfectly fine. I was trying to enc… --- ## [Filebeat at kubernetes return "CRIT Exiting: invalid prospector type: docker. Change type"](https://discuss.elastic.co/t/filebeat-at-kubernetes-return-crit-exiting-invalid-prospector-type-docker-change-type/122482)
**Author:** [@LihoyKozak](https://discuss.elastic.co/u/LihoyKozak)\ **Replies:** 2\ **Last updated:** [March 6, 2018, 8:32am UTC](https://discuss.elastic.co/t/filebeat-at-kubernetes-return-crit-exiting-invalid-prospector-type-docker-change-type/122482 "2018-03-06T08:32:40Z")
Hello, I want to collect data from kubernetes cluster using filebeat. I have copied configs from here: And have the next config map: --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-prospectors nam… --- ## [Nginx filebeat logging](https://discuss.elastic.co/t/nginx-filebeat-logging/120650)
**Author:** [@clock21am](https://discuss.elastic.co/u/clock21am)\ **Replies:** 8\ **Last updated:** [March 6, 2018, 7:38am UTC](https://discuss.elastic.co/t/nginx-filebeat-logging/120650 "2018-03-06T07:38:49Z")
Hi, we are trying to log our nginx log to elasticsearch. our code is working fine and logging in es. but while creating dashboard it is showing following\[1\] errors in our kibana-dashboard dashboard is showing the fol… --- ## [Metricbeat: haproxy module - Error converting param to](https://discuss.elastic.co/t/metricbeat-haproxy-module-error-converting-param-to/122551)
**Author:** [@neizmirasego](https://discuss.elastic.co/u/neizmirasego)\ **Replies:** 2\ **Last updated:** [March 6, 2018, 7:01am UTC](https://discuss.elastic.co/t/metricbeat-haproxy-module-error-converting-param-to/122551 "2018-03-06T07:01:29Z")
Hi everyone! I have some problems with haproxy module. Here are some details.. Beat version - metricbeat-6.2.2-1 Operating System - CentOS Linux release 7.2.1511 Configuration metricbeat.modules: hosts: \['localhost:8… --- ## [Filebeats(5.40) keeps on recreating the indices after deletion](https://discuss.elastic.co/t/filebeats-5-40-keeps-on-recreating-the-indices-after-deletion/121986)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 7\ **Last updated:** [March 6, 2018, 5:48am UTC](https://discuss.elastic.co/t/filebeats-5-40-keeps-on-recreating-the-indices-after-deletion/121986 "2018-03-06T05:48:51Z")
I have filebeats reading the log files on a remote server and shipping it to logstash on the same server. I have tried deleting the last 6 months old indices but I have noticed that indices are recreated on the elastic s… --- ## [Windows FileBeat not found in Kibana](https://discuss.elastic.co/t/windows-filebeat-not-found-in-kibana/122185)
**Author:** [@Simonhawk](https://discuss.elastic.co/u/Simonhawk)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 5:21am UTC](https://discuss.elastic.co/t/windows-filebeat-not-found-in-kibana/122185 "2018-03-06T05:21:38Z")
OS? Windows 10. Guide used? http://robwillis.info/2016/05/installing-elasticsearch-logstash-and-kibana-elk-on-windows-server-2012-r2/ Did I research before coming here? YES Error? No matching indices found: No indices… --- ## [Filebeat not harvesting files from subdirectories](https://discuss.elastic.co/t/filebeat-not-harvesting-files-from-subdirectories/121109)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 4\ **Last updated:** [March 6, 2018, 5:17am UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-files-from-subdirectories/121109 "2018-03-06T05:17:55Z")
Good Afternoon All, I have filebeat set up to harvest files in the log directory of an application and the application developers just changed the logging format to include sub-directories containing client specific inf… --- ## [Kafka Dashboard is not available in metricbeat 6.2.2](https://discuss.elastic.co/t/kafka-dashboard-is-not-available-in-metricbeat-6-2-2/122497)
**Author:** [@Narayanan\_Sukumar](https://discuss.elastic.co/u/Narayanan_Sukumar)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 12:17am UTC](https://discuss.elastic.co/t/kafka-dashboard-is-not-available-in-metricbeat-6-2-2/122497 "2018-03-06T00:17:47Z")
I have configured the metricbeat using the kafka module and loaded the dashboard to the Kibana. However, I am not able to see the KAFKA dashboard. Do I need to install it manually? Please help!! --- ## [Monitor administrator in network folders](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 3\ **Last updated:** [March 4, 2018, 10:10pm UTC](https://discuss.elastic.co/t/monitor-administrator-in-network-folders/121830 "2018-03-04T22:10:47Z")
Hi All, I have query on this . Do we have any beats or something to monitor administrator access to specific network folders? We have a variety of classic network drives, one of which must be monitored. Need: If an a… --- ## [{"error":"Content-Type header \[application/x-www-form-urlencoded\] is not supported","status":406}](https://discuss.elastic.co/t/error-content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/122017)
**Author:** [@Chiang\_Poh\_Lin](https://discuss.elastic.co/u/Chiang_Poh_Lin)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 5:34am UTC](https://discuss.elastic.co/t/error-content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/122017 "2018-03-04T05:34:40Z")
Hi, so i was installing elk on server following this website: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04#load-kibana-dashboards so until h… --- ## [Filebeats to logstash issues](https://discuss.elastic.co/t/filebeats-to-logstash-issues/121284)
**Author:** [@ddpbsd](https://discuss.elastic.co/u/ddpbsd)\ **Replies:** 5\ **Last updated:** [March 4, 2018, 5:11am UTC](https://discuss.elastic.co/t/filebeats-to-logstash-issues/121284 "2018-03-04T05:11:12Z")
It seems like this is all too common, but I'm having issues sending from beats to logstash. filebeat version: filebeat-5.6.4p0 (the working and not working versions are the same) Another host successfully sends messages… --- ## [Filebeat.yml not picking up env variables](https://discuss.elastic.co/t/filebeat-yml-not-picking-up-env-variables/121795)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 12:06am UTC](https://discuss.elastic.co/t/filebeat-yml-not-picking-up-env-variables/121795 "2018-03-04T00:06:17Z")
I have a filebeat.yml file as written below and it's not taking up the env variable. I get error like this: Exiting: error unpacking config data: missing field accessing 'name' (source:'/etc/filebeat/filebeat.yml') ...… --- ## [Strange behavior of filebeat for small number of filtered events](https://discuss.elastic.co/t/strange-behavior-of-filebeat-for-small-number-of-filtered-events/121156)
**Author:** [@RishiSingh](https://discuss.elastic.co/u/RishiSingh)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 12:03am UTC](https://discuss.elastic.co/t/strange-behavior-of-filebeat-for-small-number-of-filtered-events/121156 "2018-03-04T00:03:25Z")
Hi, I am using filebeat to ship the logs that contained only the java exception stack traces in the LogFile. To test the feasibility I ran the filebeat in the host machine and ELK stack on other server. I ran the simu… --- ## [Tcp.go WARN DNS lookup failure no such host](https://discuss.elastic.co/t/tcp-go-warn-dns-lookup-failure-no-such-host/121048)
**Author:** [@fabifrank](https://discuss.elastic.co/u/fabifrank)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 11:54pm UTC](https://discuss.elastic.co/t/tcp-go-warn-dns-lookup-failure-no-such-host/121048 "2018-03-03T23:54:39Z")
Today I set up metricbeat on a kubernetes cluster and cant make it connect to the elastic search logging pod. I followed this example here: https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.… --- ## [Is UDP input JSON aware?](https://discuss.elastic.co/t/is-udp-input-json-aware/121668)
**Author:** [@maurorappa](https://discuss.elastic.co/u/maurorappa)\ **Replies:** 3\ **Last updated:** [March 3, 2018, 11:50pm UTC](https://discuss.elastic.co/t/is-udp-input-json-aware/121668 "2018-03-03T23:50:34Z")
I'm having trouble using the UDP input in the same way the file input does with Json files. I would like automatic field recognition for the structured data it receives. Here's my test: I'm using version 6.2.1 (amd64… --- ## [Beats basic authentication with Nginx?](https://discuss.elastic.co/t/beats-basic-authentication-with-nginx/122253)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 11:42pm UTC](https://discuss.elastic.co/t/beats-basic-authentication-with-nginx/122253 "2018-03-03T23:42:14Z")
Is it possible to use the authentication settings in a beat.yml to authenticate to nginx before sending into Elasticsearch? --- ## [Solaris 11.3 Filebeat installation](https://discuss.elastic.co/t/solaris-11-3-filebeat-installation/122274)
**Author:** [@AbdulH](https://discuss.elastic.co/u/AbdulH)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 11:36pm UTC](https://discuss.elastic.co/t/solaris-11-3-filebeat-installation/122274 "2018-03-03T23:36:53Z")
What are the steps to install and run Filebeat on Solaris 11.3? I know that Solaris is not officially supported though I'd like to test it's capabilities on this OS. --- ## [Change in the RabbitMq module to support more node information](https://discuss.elastic.co/t/change-in-the-rabbitmq-module-to-support-more-node-information/122292)
**Author:** [@oyKris](https://discuss.elastic.co/u/oyKris)\ **Replies:** 1\ **Last updated:** [March 3, 2018, 11:34pm UTC](https://discuss.elastic.co/t/change-in-the-rabbitmq-module-to-support-more-node-information/122292 "2018-03-03T23:34:16Z")
Hi, could it be possible to also send out nodes information. Today the module only send out information about each node and that makes it impossible to check for partitions because this info is only available at the root… --- ## [Logstash optional client cert authentication/validation](https://discuss.elastic.co/t/logstash-optional-client-cert-authentication-validation/122341)
**Author:** [@Archit\_Baweja](https://discuss.elastic.co/u/Archit_Baweja)\ **Replies:** 0\ **Last updated:** [March 3, 2018, 12:12am UTC](https://discuss.elastic.co/t/logstash-optional-client-cert-authentication-validation/122341 "2018-03-03T00:12:16Z")
Hey folks, I'm trying to setup filebeat/metric client authentication in logstash. I followed the article at https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html I currently have a fleet … --- ## [How can I tell if Auditbeat is grouping syscall messages?](https://discuss.elastic.co/t/how-can-i-tell-if-auditbeat-is-grouping-syscall-messages/121867)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 7\ **Last updated:** [March 2, 2018, 2:34pm UTC](https://discuss.elastic.co/t/how-can-i-tell-if-auditbeat-is-grouping-syscall-messages/121867 "2018-03-02T14:34:51Z")
Just a quick question to make sure I'm not missing something. Thanks to @andrewkroh I have my auditbeat working. My understanding of the auditd module in auditbeat is that it groups syscalls together so. for example, a… --- ## [Filebeat ssl connection error: certificate is valid for x, not x](https://discuss.elastic.co/t/filebeat-ssl-connection-error-certificate-is-valid-for-x-not-x/122267)
**Author:** [@max2](https://discuss.elastic.co/u/max2)\ **Replies:** 0\ **Last updated:** [March 2, 2018, 2:11pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-error-certificate-is-valid-for-x-not-x/122267 "2018-03-02T14:11:59Z")
Hi. I have a very odd issue with filebeat connection to logstash. The deployment is as follows: Logstash on hosted AWS infrastructure. Filebeat on AWS Windows server 2012 on a different network and VPC. Server-side SS… --- ## [Load the templates manually - is the output correct?](https://discuss.elastic.co/t/load-the-templates-manually-is-the-output-correct/121520)
**Author:** [@przemolb](https://discuss.elastic.co/u/przemolb)\ **Replies:** 5\ **Last updated:** [March 2, 2018, 9:17am UTC](https://discuss.elastic.co/t/load-the-templates-manually-is-the-output-correct/121520 "2018-03-02T09:17:11Z")
Hi all, since my filebeat doesn't have any access to Elasticsearch I have to follow this procedure https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html#load-template-manually. I have the follow… --- ## [Rename the WinlogBeat index](https://discuss.elastic.co/t/rename-the-winlogbeat-index/119604)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 5\ **Last updated:** [March 2, 2018, 5:48am UTC](https://discuss.elastic.co/t/rename-the-winlogbeat-index/119604 "2018-03-02T05:48:24Z")
Hello, I installed and configured winlogbeat to send his logs to logstash and it's successful. My question is, now, I want to change the name of the index in kibana, all I see is this by example: \[Capture\] The index I… --- ## [Filebeats multiline pattern - specific syntax](https://discuss.elastic.co/t/filebeats-multiline-pattern-specific-syntax/122173)
**Author:** [@byungik](https://discuss.elastic.co/u/byungik)\ **Replies:** 1\ **Last updated:** [March 2, 2018, 2:28am UTC](https://discuss.elastic.co/t/filebeats-multiline-pattern-specific-syntax/122173 "2018-03-02T02:28:49Z")
I want to set specific syntax as multiline pattern. so I test in logstash first and It works. this is logstash's configration. input { stdin { codec =\> multiline { pattern =\> 'execute\_all srv' what =\> "previous" … --- ## [When will Beats Modules support logstash output?](https://discuss.elastic.co/t/when-will-beats-modules-support-logstash-output/121508)
**Author:** [@jsmith1](https://discuss.elastic.co/u/jsmith1)\ **Replies:** 3\ **Last updated:** [March 2, 2018, 1:37am UTC](https://discuss.elastic.co/t/when-will-beats-modules-support-logstash-output/121508 "2018-03-02T01:37:53Z")
Hi everyone, I've been playing about with the Elastic stack and Beats recently with the aim of setting up a distributed logging and attribution platform. Thus far I've been really impressed with Beats and the excellent … --- ## [BEAT - Performance impact on the End Points?](https://discuss.elastic.co/t/beat-performance-impact-on-the-end-points/121614)
**Author:** [@Sanjeev\_Routray](https://discuss.elastic.co/u/Sanjeev_Routray)\ **Replies:** 1\ **Last updated:** [March 2, 2018, 1:36am UTC](https://discuss.elastic.co/t/beat-performance-impact-on-the-end-points/121614 "2018-03-02T01:36:10Z")
I am planning to deploy BEAT log shippers on the end points for data collection. I am trying to find information around the overhead that these shippers might have on the system resources (CPU, Memory etc.). Do we have a… --- ## [{ASK} Filebeat 6.2 prospector (document\_type)](https://discuss.elastic.co/t/ask-filebeat-6-2-prospector-document-type/121612)
**Author:** [@yrizal](https://discuss.elastic.co/u/yrizal)\ **Replies:** 1\ **Last updated:** [March 2, 2018, 1:25am UTC](https://discuss.elastic.co/t/ask-filebeat-6-2-prospector-document-type/121612 "2018-03-02T01:25:24Z")
ELK 5.6.8 Filebeat 6.2.1 I have question, For filebeat 6.2.1 on the prospector -\> document\_type is still used or not - field: tags: - SuricataIDPS - JSON document\_type: suricataIDPS fields\_under… --- ## [Filebeat: Excessive disk usage ( ~15M/s) when no line is matched in the input log file](https://discuss.elastic.co/t/filebeat-excessive-disk-usage-15m-s-when-no-line-is-matched-in-the-input-log-file/121482)
**Author:** [@RishiSingh](https://discuss.elastic.co/u/RishiSingh)\ **Replies:** 5\ **Last updated:** [March 2, 2018, 1:23am UTC](https://discuss.elastic.co/t/filebeat-excessive-disk-usage-15m-s-when-no-line-is-matched-in-the-input-log-file/121482 "2018-03-02T01:23:03Z")
Hi, I am using filebeat 6.2.0 vesrion. In one of my run I found filebeat is writing to the disk (~15Mbps) when there is no matching line found in the log file (size of file = 500 MB). filebeat.prospectors: - type: log… --- ## [Filebeat install script for windows is broken](https://discuss.elastic.co/t/filebeat-install-script-for-windows-is-broken/122119)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 2\ **Last updated:** [March 1, 2018, 7:53pm UTC](https://discuss.elastic.co/t/filebeat-install-script-for-windows-is-broken/122119 "2018-03-01T19:53:29Z")
I tried to use the powershell install script, but it created a service that would not start. Then i looked at the script and the service and found extra slash erroneously put in there install-service-filebeat.ps1: ...… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=468) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=470)