# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=470 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 471 --- ## [Cannot setup kibana dashboards](https://discuss.elastic.co/t/cannot-setup-kibana-dashboards/121939)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 2\ **Last updated:** [March 1, 2018, 4:13pm UTC](https://discuss.elastic.co/t/cannot-setup-kibana-dashboards/121939 "2018-03-01T16:13:11Z")
I have the following set in my metricbeat.yml setup.kibana: host: "localhost:5601" protocol: "https" ssl.enabled: true ssl.certificate\_authorities: \[ "/etc/opt/zookeeper/MyCorporateCA.pem" \] ssl.verification\_m… --- ## [Time incorrect from system module (syslog)](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 6\ **Last updated:** [March 1, 2018, 2:39pm UTC](https://discuss.elastic.co/t/time-incorrect-from-system-module-syslog/121905 "2018-03-01T14:39:03Z")
Beats and ES 6.2.2 When we enable the System module the time of syslog entries in Kibana shows as UTC appearing 5 hours old. The syslog entries themselves have the correct EST time. If we enable log watching in the fil… --- ## [Misconfigured dashboards?](https://discuss.elastic.co/t/misconfigured-dashboards/121875)
**Author:** [@QuizzyRascal](https://discuss.elastic.co/u/QuizzyRascal)\ **Replies:** 6\ **Last updated:** [March 1, 2018, 9:54am UTC](https://discuss.elastic.co/t/misconfigured-dashboards/121875 "2018-03-01T09:54:27Z")
I have built a syslog receiver using ELK 6.2.1, which works great. Logstash receives syslog data and pushes it into ES and then I can use discover to see the logs coming in via Kibana. I read somewhere that there are s… --- ## [Unable to start Auditbeat container on Docker](https://discuss.elastic.co/t/unable-to-start-auditbeat-container-on-docker/121481)
**Author:** [@antwan](https://discuss.elastic.co/u/antwan)\ **Replies:** 3\ **Last updated:** [March 1, 2018, 8:54am UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-container-on-docker/121481 "2018-03-01T08:54:43Z")
I have tried this in both CentOS 7 and RHEL Atomic Host. Using ansible, I use the following, with the params containing valid values: docker\_container: name: auditbeat image: "{{ auditbeat\_image }}:{{ auditbeat\_version … --- ## [Security of Keystores](https://discuss.elastic.co/t/security-of-keystores/121884)
**Author:** [@Lazarbeam](https://discuss.elastic.co/u/Lazarbeam)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 7:15pm UTC](https://discuss.elastic.co/t/security-of-keystores/121884 "2018-02-28T19:15:59Z")
Team -- I'm running Filebeat and Metricbeat versions 6.2.2 on RHEL 5.11 I've followed the instructions on creating keystores for Filebeat and Metricbeat from the guides listed here and here. Everything works dandy - th… --- ## [Unable to get auditd module configured for Auditbeat](https://discuss.elastic.co/t/unable-to-get-auditd-module-configured-for-auditbeat/121477)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 6\ **Last updated:** [February 28, 2018, 2:08pm UTC](https://discuss.elastic.co/t/unable-to-get-auditd-module-configured-for-auditbeat/121477 "2018-02-28T14:08:00Z")
Hi, just loving yaml at the moment (Grr) after a lot of experimentation, I managed to get the audit module working with the following: ################################################## auditbeat.modules: # The kernel … --- ## [Packetbeat building to v7](https://discuss.elastic.co/t/packetbeat-building-to-v7/121422)
**Author:** [@montem](https://discuss.elastic.co/u/montem)\ **Replies:** 4\ **Last updated:** [February 28, 2018, 8:38am UTC](https://discuss.elastic.co/t/packetbeat-building-to-v7/121422 "2018-02-28T08:38:28Z")
Hey, I am building packetbeat, using the master branch, It's building successfully, but after checking the version of binary, it's showing it to be v7.0.0. packetbeat version 7.0.0-alpha1 (amd64), libbeat 7.0.0-alpha1 … --- ## [Filebeat read only one folder](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748)
**Author:** [@Romain\_Pelissier](https://discuss.elastic.co/u/Romain_Pelissier)\ **Replies:** 1\ **Last updated:** [February 28, 2018, 8:15am UTC](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748 "2018-02-28T08:15:48Z")
Hi, I got filebeat running on a pfsense box (using pkgadd beat package): filebeat version 5.4.3 (amd64), libbeat 5.4.3 I have configured my filebeat agent to grab logs from a path where logs from 2 snort interfaces ar… --- ## [Fetch timestamp of a 2 particular rows based a column](https://discuss.elastic.co/t/fetch-timestamp-of-a-2-particular-rows-based-a-column/121774)
**Author:** [@ashish\_khulbe](https://discuss.elastic.co/u/ashish_khulbe)\ **Replies:** 1\ **Last updated:** [February 28, 2018, 8:12am UTC](https://discuss.elastic.co/t/fetch-timestamp-of-a-2-particular-rows-based-a-column/121774 "2018-02-28T08:12:25Z")
Hi Team, I want to fetch timestamp of a 2 particular rows based a column and then want to find out duration in between both. Is there any inbuilt way to implement this or possible ways. All suggestions are welcome. Tha… --- ## [Time interval for sending logs using Winlogbeat](https://discuss.elastic.co/t/time-interval-for-sending-logs-using-winlogbeat/120822)
**Author:** [@Hari\_Baskar](https://discuss.elastic.co/u/Hari_Baskar)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 5:54am UTC](https://discuss.elastic.co/t/time-interval-for-sending-logs-using-winlogbeat/120822 "2018-02-28T05:54:44Z")
Hi, I'm using the Winlogbeat for log shipping into elasticsearch. But I don't want to send the logs continuously into elasticsearch. I need to send only every half hour once. So, Please suggest me How to do that. Than… --- ## [Truncating multi line](https://discuss.elastic.co/t/truncating-multi-line/121425)
**Author:** [@Yudha\_Herwono](https://discuss.elastic.co/u/Yudha_Herwono)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 5:47am UTC](https://discuss.elastic.co/t/truncating-multi-line/121425 "2018-02-28T05:47:41Z")
Hi, I would like to know how to truncate log message. Below is the example: 2018/02/22 00:26:36.233 | ERROR \[TaskExecutor-master-11369-ProcessTask \[8879082013622\]\] \[ActionNode\] Error executing 2018/02/22 00:26:36.233 … --- ## [Filebeat is running but not sending logs to logstash](https://discuss.elastic.co/t/filebeat-is-running-but-not-sending-logs-to-logstash/121276)
**Author:** [@jiten](https://discuss.elastic.co/u/jiten)\ **Replies:** 7\ **Last updated:** [February 28, 2018, 12:25am UTC](https://discuss.elastic.co/t/filebeat-is-running-but-not-sending-logs-to-logstash/121276 "2018-02-28T00:25:53Z")
Hi Team, I am trying to setup filebeat on my centos 7 machine. filebeat is working fine but still not able to see any logs to logz.io. filebeat.yml file configuration filebeat.prospectors: - type: log enabled: true … --- ## [Could not locate that index-pattern (auditbeat,filebat)](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-auditbeat-filebat/121485)
**Author:** [@illiash](https://discuss.elastic.co/u/illiash)\ **Replies:** 2\ **Last updated:** [February 27, 2018, 10:40am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-auditbeat-filebat/121485 "2018-02-27T10:40:04Z")
Hi , It looks like when using custom pattern in auditbeat of filebeat, that ID for dashboards which are created with auditbeat or filebeat are created with extra space in the begging , For example in auditbeat I'm usin… --- ## [Processors not working](https://discuss.elastic.co/t/processors-not-working/121445)
**Author:** [@Feng\_Mi](https://discuss.elastic.co/u/Feng_Mi)\ **Replies:** 2\ **Last updated:** [February 27, 2018, 6:25am UTC](https://discuss.elastic.co/t/processors-not-working/121445 "2018-02-27T06:25:02Z")
\#=========================== Filebeat prospectors ============================= filebeat.config.prospectors: enabled: true path: conf.d/\*.yml #============================= Filebeat modules =========================… --- ## [Issues with Elastic, Kibana and Metricbeat](https://discuss.elastic.co/t/issues-with-elastic-kibana-and-metricbeat/121585)
**Author:** [@Alexey\_Shalin](https://discuss.elastic.co/u/Alexey_Shalin)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 4:32am UTC](https://discuss.elastic.co/t/issues-with-elastic-kibana-and-metricbeat/121585 "2018-02-27T04:32:03Z")
Hello I have setuped Elastic, Kibana, Logstash... .. :slight\_smile: Everything seems OK .. so .. I have added 6 server with heartbeat and ELK server and sometimes .. some info missing for hosts check attached image \[… --- ## [Kibana Template for Dock Beats](https://discuss.elastic.co/t/kibana-template-for-dock-beats/121555)
**Author:** [@Potakamur](https://discuss.elastic.co/u/Potakamur)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 3:55am UTC](https://discuss.elastic.co/t/kibana-template-for-dock-beats/121555 "2018-02-27T03:55:54Z")
Hi, We are using Dock Beats for monitoing docker statistics. Everything is working fine and we need a sample Kibana template for analyzing the collected statistics using graphs. Potakamuri --- ## [How to Configure Failover Shipping to remote server when Logstash connection fails](https://discuss.elastic.co/t/how-to-configure-failover-shipping-to-remote-server-when-logstash-connection-fails/121511)
**Author:** [@Vignesh\_Kumar\_A](https://discuss.elastic.co/u/Vignesh_Kumar_A)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 3:50am UTC](https://discuss.elastic.co/t/how-to-configure-failover-shipping-to-remote-server-when-logstash-connection-fails/121511 "2018-02-27T03:50:54Z")
Hi Team, I have a requirement where my filebeat will connect to Logstash and ships the file content. But I really dont have a failover mechanism now if my logstash goes down. If my logstash goes down, Log4j will rotate … --- ## [Configuring Filebeat to send the logs to remote Logstash(ELK)](https://discuss.elastic.co/t/configuring-filebeat-to-send-the-logs-to-remote-logstash-elk/121355)
**Author:** [@Henry\_Han](https://discuss.elastic.co/u/Henry_Han)\ **Replies:** 1\ **Last updated:** [February 27, 2018, 3:44am UTC](https://discuss.elastic.co/t/configuring-filebeat-to-send-the-logs-to-remote-logstash-elk/121355 "2018-02-27T03:44:48Z")
Hello, This is the first time I use Filebeat, and I learned some basic knowledge of ELK from the online tutorial. Basically, I would like to pass the log information from the web-tier instance to the ELK server instanc… --- ## [FB -\> Logstash -\> ES -\> kibana not working](https://discuss.elastic.co/t/fb-logstash-es-kibana-not-working/121496)
**Author:** [@rudok](https://discuss.elastic.co/u/rudok)\ **Replies:** 1\ **Last updated:** [February 26, 2018, 10:18pm UTC](https://discuss.elastic.co/t/fb-logstash-es-kibana-not-working/121496 "2018-02-26T22:18:55Z")
Hi all I am new in ELK ,I tried setup 6.2 ELK infrastructure. I used filebeat with apache module to send parsed apache log directly to ES and all was working fine. But I need to do some changes in event ( timestamp… --- ## [Filebeat not sending empty lines](https://discuss.elastic.co/t/filebeat-not-sending-empty-lines/118060)
**Author:** [@dmontemayors](https://discuss.elastic.co/u/dmontemayors)\ **Replies:** 7\ **Last updated:** [February 26, 2018, 6:04pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-empty-lines/118060 "2018-02-26T18:04:20Z")
Hi all, I looked around and it seems like filebeat should be sending empty lines in the log files. Running version 6.1.3 with a pretty basic configuration but it looks like the harvester is ignoring them. Am I missing… --- ## [Installing dashboards from Auditbeat to Docker containers](https://discuss.elastic.co/t/installing-dashboards-from-auditbeat-to-docker-containers/119270)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 6\ **Last updated:** [February 26, 2018, 9:24am UTC](https://discuss.elastic.co/t/installing-dashboards-from-auditbeat-to-docker-containers/119270 "2018-02-26T09:24:10Z")
Apologies, pretty much a newbie to Docker and ELK. I have a Redhat system that I am trying to monitor on an Ubuntu system using ELK. I have the Ubuntu system running Elasticsearch, Logstash and Kibana 5.6.4 in separate c… --- ## [Logstash's - Beat to Elasticsearch Configuration - metadata](https://discuss.elastic.co/t/logstashs-beat-to-elasticsearch-configuration-metadata/121362)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 3\ **Last updated:** [February 26, 2018, 6:41am UTC](https://discuss.elastic.co/t/logstashs-beat-to-elasticsearch-configuration-metadata/121362 "2018-02-26T06:41:33Z")
I'm trying to follow Beats input plugin | Logstash Reference \[6.2\] | Elastic logstash's (input/output): # cat pipeline/10-input-beats.conf input { beats { port =\> 5044 } } # # cat pipeline/30-output-elasticsearch… --- ## [What happened to filebeat?](https://discuss.elastic.co/t/what-happened-to-filebeat/121179)
**Author:** [@Feng\_Mi](https://discuss.elastic.co/u/Feng_Mi)\ **Replies:** 5\ **Last updated:** [February 26, 2018, 2:57am UTC](https://discuss.elastic.co/t/what-happened-to-filebeat/121179 "2018-02-26T02:57:50Z")
\[filebeat\] from 15th February, my filebeat output log only at 8:30 am and stopped after two or three hours. I can not find error in log.please help me --- ## [RabbitMQ Add connections metricset](https://discuss.elastic.co/t/rabbitmq-add-connections-metricset/121252)
**Author:** [@jaipradeesh](https://discuss.elastic.co/u/jaipradeesh)\ **Replies:** 1\ **Last updated:** [February 26, 2018, 2:06am UTC](https://discuss.elastic.co/t/rabbitmq-add-connections-metricset/121252 "2018-02-26T02:06:33Z")
This is regarding new metricset addition: connections. I've put together a PR - https://github.com/elastic/beats/pull/6458 Not sure how to generate the docs, .. --- ## [Error importing Kibana dashboards](https://discuss.elastic.co/t/error-importing-kibana-dashboards/120336)
**Author:** [@Gaurav\_Vijayvergia](https://discuss.elastic.co/u/Gaurav_Vijayvergia)\ **Replies:** 3\ **Last updated:** [February 25, 2018, 1:36am UTC](https://discuss.elastic.co/t/error-importing-kibana-dashboards/120336 "2018-02-25T01:36:34Z")
Error message : instance/beat.go:667 Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: can not convert 'object' into 'string' accessing 'setup.kibana.hos… --- ## [\[LogStash::Runner\] agent - failed to fetch pipeline configuration](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736)
**Author:** [@yrizal](https://discuss.elastic.co/u/yrizal)\ **Replies:** 2\ **Last updated:** [February 24, 2018, 4:33am UTC](https://discuss.elastic.co/t/logstash-runner-agent-failed-to-fetch-pipeline-configuration/120736 "2018-02-24T04:33:33Z")
Hi I followed the tutorial on "https://extelligenceblog.it/2017/07/23/elastic-stack-suricata-idps-and-pfsense-firewall-part-3-logstash-pipeline-additions-suricata-alerts/" this step is affected error (/usr/share/logsta… --- ## [Value out of range](https://discuss.elastic.co/t/value-out-of-range/121302)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 11:20pm UTC](https://discuss.elastic.co/t/value-out-of-range/121302 "2018-02-23T23:20:27Z")
using metric beat 6.2.1 and logstash 6.2.2 I am getting the following error. I this a metricbeat bug? It seems that the value is too large to fit into a long in ES? \[2018-02-23T23:09:43,469\]\[WARN \]\[logstash.outputs.elas… --- ## [File appender for filebeat not working in groovy](https://discuss.elastic.co/t/file-appender-for-filebeat-not-working-in-groovy/120954)
**Author:** [@jiten](https://discuss.elastic.co/u/jiten)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 11:06pm UTC](https://discuss.elastic.co/t/file-appender-for-filebeat-not-working-in-groovy/120954 "2018-02-23T23:06:18Z")
Hi All, i have configured filebeat on my centos machine and it is working fine and now i am trying to use file appender for filebeat using groovy script but it is not creating file. any help will be appericate. below i… --- ## [Metricbeat Windows network stats resetting (MIB\_IFROW vs MIB\_IFROW2)](https://discuss.elastic.co/t/metricbeat-windows-network-stats-resetting-mib-ifrow-vs-mib-ifrow2/120858)
**Author:** [@CeeDee](https://discuss.elastic.co/u/CeeDee)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 11:04pm UTC](https://discuss.elastic.co/t/metricbeat-windows-network-stats-resetting-mib-ifrow-vs-mib-ifrow2/120858 "2018-02-23T23:04:18Z")
Hi, On Windows based hosts the network statistics seem to be reset at 4GB. There's already an older thread about this, but it's closed, hence the new thread. According to the answer by Andrew Kroh, this is because 'Th… --- ## [ELK Docker with Filebeat Dashboard Problem](https://discuss.elastic.co/t/elk-docker-with-filebeat-dashboard-problem/121199)
**Author:** [@Andre\_Vert](https://discuss.elastic.co/u/Andre_Vert)\ **Replies:** 6\ **Last updated:** [February 23, 2018, 7:48pm UTC](https://discuss.elastic.co/t/elk-docker-with-filebeat-dashboard-problem/121199 "2018-02-23T19:48:22Z")
Hello together, I'm trying to setup an ELK stack using the docker elk (https://github.com/deviantony/docker-elk). For testing purpose I use two virtual machines running ubuntu. One with the ELK docker and one sending t… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=469) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=471)