# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=471 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 472 --- ## [Suggestion to ship logs from DMZ to LAN - Elastic stack 6.2.2](https://discuss.elastic.co/t/suggestion-to-ship-logs-from-dmz-to-lan-elastic-stack-6-2-2/121255)
**Author:** [@kattula](https://discuss.elastic.co/u/kattula)\ **Replies:** 2\ **Last updated:** [February 23, 2018, 8:02pm UTC](https://discuss.elastic.co/t/suggestion-to-ship-logs-from-dmz-to-lan-elastic-stack-6-2-2/121255 "2018-02-23T20:02:08Z")
Hi everyone, I need help from you guys as I'm new to working with Elastic stack. I have installed Elastic search, Kibana and Logstash in LAN, and Filebeat in DMZ zone. All the versions are 6.2.2. I would like to output … --- ## [Filebeat to stream .gz logs to ES/LS](https://discuss.elastic.co/t/filebeat-to-stream-gz-logs-to-es-ls/121081)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 4:13pm UTC](https://discuss.elastic.co/t/filebeat-to-stream-gz-logs-to-es-ls/121081 "2018-02-23T16:13:39Z")
Hi, So from doing some research on this topic I realized that the answer is always no, not yet. However, when looking at the elastic website and checking the filebeat configs why would the example be about "excluding" … --- ## [Filebeat "TCP connection refused" error on DCOS cluster](https://discuss.elastic.co/t/filebeat-tcp-connection-refused-error-on-dcos-cluster/121137)
**Author:** [@aysala](https://discuss.elastic.co/u/aysala)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 3:57pm UTC](https://discuss.elastic.co/t/filebeat-tcp-connection-refused-error-on-dcos-cluster/121137 "2018-02-23T15:57:02Z")
Hello, I am trying to run Filebeat on all the nodes(Master, Agent) in my DCOS cluster. Filebeat works fine with ES as output in the configuration. But I get the 'dial tcp : getsockopt connection refused' error when log… --- ## [Does Filebeat registry file get deleted during reboot](https://discuss.elastic.co/t/does-filebeat-registry-file-get-deleted-during-reboot/121222)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 3\ **Last updated:** [February 23, 2018, 3:48pm UTC](https://discuss.elastic.co/t/does-filebeat-registry-file-get-deleted-during-reboot/121222 "2018-02-23T15:48:21Z")
Hi, I'm just wondering does the Filebeat registry file get reset or re-created when rebooting the machine the beat is running on ? Is there any way the file could get affected by any operation other than manually deleti… --- ## [Redis Module - Assign keys based on message content](https://discuss.elastic.co/t/redis-module-assign-keys-based-on-message-content/120745)
**Author:** [@EMChamp](https://discuss.elastic.co/u/EMChamp)\ **Replies:** 2\ **Last updated:** [February 23, 2018, 3:44pm UTC](https://discuss.elastic.co/t/redis-module-assign-keys-based-on-message-content/120745 "2018-02-23T15:44:31Z")
How can I create a key setting that will check if a log message contains a string and outputs to a specific redis key? I was thinking something like this output.redis: hosts: \["localhost"\] keys: - key: "info\_lis… --- ## [What does the 'system load' Metricbeat chart show?](https://discuss.elastic.co/t/what-does-the-system-load-metricbeat-chart-show/121042)
**Author:** [@muhammadrehansaeed](https://discuss.elastic.co/u/muhammadrehansaeed)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 9:39am UTC](https://discuss.elastic.co/t/what-does-the-system-load-metricbeat-chart-show/121042 "2018-02-23T09:39:41Z")
What does system load actually mean? CPU? Memory? IO? Disk? A combination of all of these things? If so, how is system load calculated? --- ## [Including only the multilines for the output](https://discuss.elastic.co/t/including-only-the-multilines-for-the-output/117961)
**Author:** [@RishiSingh](https://discuss.elastic.co/u/RishiSingh)\ **Replies:** 2\ **Last updated:** [February 23, 2018, 2:32am UTC](https://discuss.elastic.co/t/including-only-the-multilines-for-the-output/117961 "2018-02-23T02:32:55Z")
Hi, I am trying to make use of filebeat to only report the exceptions/java stack traces in the log files. So my use case is to ignore all other lines thats are not multiline. 11:18:53:252253|3248-00183:PERSISTENCE: Hi… --- ## [Backend and Frontend fields cannot be used in visualizations](https://discuss.elastic.co/t/backend-and-frontend-fields-cannot-be-used-in-visualizations/120729)
**Author:** [@darkl0rd](https://discuss.elastic.co/u/darkl0rd)\ **Replies:** 1\ **Last updated:** [February 22, 2018, 5:57pm UTC](https://discuss.elastic.co/t/backend-and-frontend-fields-cannot-be-used-in-visualizations/120729 "2018-02-22T17:57:04Z")
Two important fields in Traefik are the "traefik.access.frontend\_name" and "traefik.access.backend\_name" fields. Based on these fields one can identify the service which is being hit, especially in a Docker world this is… --- ## [Configure MySQL module](https://discuss.elastic.co/t/configure-mysql-module/120899)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [February 22, 2018, 4:35pm UTC](https://discuss.elastic.co/t/configure-mysql-module/120899 "2018-02-22T16:35:00Z")
Per Configure the MySQL module # cat mysql.yml - module: mysql # Error logs error: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your … --- ## [Logstash not receiving any Logs](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661)
**Author:** [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Replies:** 8\ **Last updated:** [February 22, 2018, 4:28pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661 "2018-02-22T16:28:38Z")
Hello, I have installed and configured Filebeat in Wind River Linux 5.0.1.4. And I have installed and configured ELK in Ubuntu 16.04. I am trying to access syslog from Wind River. Everything seems fine and all four con… --- ## [Metricbeat RabbitMQ collect message rates](https://discuss.elastic.co/t/metricbeat-rabbitmq-collect-message-rates/120910)
**Author:** [@Christian\_H](https://discuss.elastic.co/u/Christian_H)\ **Replies:** 2\ **Last updated:** [February 22, 2018, 10:26am UTC](https://discuss.elastic.co/t/metricbeat-rabbitmq-collect-message-rates/120910 "2018-02-22T10:26:31Z")
It would be great to also have the incoming/outgoing message rates fields collected by metricbeat for both queues and exchanges. This way, I could monitor whether someone is still sending data over my RMQ instance --- ## [List of hosts to ping?](https://discuss.elastic.co/t/list-of-hosts-to-ping/120437)
**Author:** [@kottapar](https://discuss.elastic.co/u/kottapar)\ **Replies:** 2\ **Last updated:** [February 22, 2018, 10:26am UTC](https://discuss.elastic.co/t/list-of-hosts-to-ping/120437 "2018-02-22T10:26:07Z")
Hey guys, I was just wondering if it's possible to provide a list of hosts in the "hosts" field for the ping test. For example, in our case we want to do a ping test to all the servers in the list /tmp/unixhosts. The do… --- ## [Choosing filed and tag in filebeat](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914)
**Author:** [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)\ **Replies:** 1\ **Last updated:** [February 22, 2018, 9:46am UTC](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914 "2018-02-22T09:46:00Z")
Hello, I am trying to understand if we have to use field or tag in filebeat prospectors. What are the use cases of using fields and tags? When should we use fields over tags? Is there any performance impact on elasticse… --- ## [Add Heartbeat to every beat](https://discuss.elastic.co/t/add-heartbeat-to-every-beat/120865)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 4\ **Last updated:** [February 21, 2018, 7:56pm UTC](https://discuss.elastic.co/t/add-heartbeat-to-every-beat/120865 "2018-02-21T19:56:43Z")
Hi, It would be rather useful to have an option to send some sort of heartbeat with every beat. While it's good to have the Heartbeat-beat to show whether a host is up or not I'd really like to have a way to see if a sp… --- ## [Feature: Metricbeat for showing statistics of nodes managed by chef.io](https://discuss.elastic.co/t/feature-metricbeat-for-showing-statistics-of-nodes-managed-by-chef-io/120424)
**Author:** [@Christian\_H](https://discuss.elastic.co/u/Christian_H)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 6:39pm UTC](https://discuss.elastic.co/t/feature-metricbeat-for-showing-statistics-of-nodes-managed-by-chef-io/120424 "2018-02-21T18:39:37Z")
I use chef for automation. I want to build a dashboard where I can monitor the status of my nodes. For example, I want to be able to see which nodes have been bootstrapped, when the last checked in, their uptime like in… --- ## [Numeric Level Value in Event Logs](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808)
**Author:** [@froto](https://discuss.elastic.co/u/froto)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 4:11pm UTC](https://discuss.elastic.co/t/numeric-level-value-in-event-logs/120808 "2018-02-21T16:11:33Z")
Hi There! I have a question about WinlogBeat. Is there any way to display the "level" field in the EventLog as a numeric value? When I search for the data in Elasticsearch the value of the level field is always displaye… --- ## [Send logs from Windows without agent / winlogbeat / filebeat](https://discuss.elastic.co/t/send-logs-from-windows-without-agent-winlogbeat-filebeat/120600)
**Author:** [@Roy\_Binderman](https://discuss.elastic.co/u/Roy_Binderman)\ **Replies:** 3\ **Last updated:** [February 21, 2018, 2:35pm UTC](https://discuss.elastic.co/t/send-logs-from-windows-without-agent-winlogbeat-filebeat/120600 "2018-02-21T14:35:47Z")
Hi - I'm new to ELK-Stack, I've managed to install & config the ELK stack on Ubuntu server (I'm a professional Linux sysadmin...) and to setup the winlogbeat on a windows client, I wonder if there is a way to send logs f… --- ## [Error while getting memory usage: error retrieving process stats](https://discuss.elastic.co/t/error-while-getting-memory-usage-error-retrieving-process-stats/120638)
**Author:** [@muhammadrehansaeed](https://discuss.elastic.co/u/muhammadrehansaeed)\ **Replies:** 7\ **Last updated:** [February 21, 2018, 2:34pm UTC](https://discuss.elastic.co/t/error-while-getting-memory-usage-error-retrieving-process-stats/120638 "2018-02-21T14:34:39Z")
I get the following logs while running Metricbeat 6.2.1 on Docker Swarm. I am hosted on Docker for AWS which uses Moby Linux and that is based on Alpine if that helps. Is this a supported scenario? 2018-02-20T12:12:03.1… --- ## [Filebeat merge lines when we do not need that](https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853)
**Author:** [@uvali](https://discuss.elastic.co/u/uvali)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 1:43pm UTC](https://discuss.elastic.co/t/filebeat-merge-lines-when-we-do-not-need-that/120853 "2018-02-21T13:43:59Z")
Hi, I have a strange problem with Filebeat, it combines lines. In the below example the line with "TID ... DEBUG" is merged in one single line with the next which contain "TID...INFO" In fact they are separate lines i… --- ## [What are "number\_of\_routing\_shards"?](https://discuss.elastic.co/t/what-are-number-of-routing-shards/120506)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 3\ **Last updated:** [February 20, 2018, 7:31pm UTC](https://discuss.elastic.co/t/what-are-number-of-routing-shards/120506 "2018-02-20T19:31:34Z")
Hi, I've looked online for answers to this but can't find anything that tells me definitively. I'm looking for an explanation of what "number\_of\_routing\_shards": 30 means. I'm reducing the default template to 1 shard … --- ## [Metricbeat loading wrong type in elasticsearch index mapping for pct fields if first document of an index has a 0](https://discuss.elastic.co/t/metricbeat-loading-wrong-type-in-elasticsearch-index-mapping-for-pct-fields-if-first-document-of-an-index-has-a-0/118915)
**Author:** [@nickoh](https://discuss.elastic.co/u/nickoh)\ **Replies:** 2\ **Last updated:** [February 20, 2018, 7:19pm UTC](https://discuss.elastic.co/t/metricbeat-loading-wrong-type-in-elasticsearch-index-mapping-for-pct-fields-if-first-document-of-an-index-has-a-0/118915 "2018-02-20T19:19:14Z")
Hey Elastic Folks: I'm using metricbeat to collect cpu utilization data from a number of linux hosts, publishing directly to elasticsearch. I'm seeing cases where pct type fields are getting mapped in elasticsearch as l… --- ## [Packet/Data Rate - Extracting Derivatives](https://discuss.elastic.co/t/packet-data-rate-extracting-derivatives/120670)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 3\ **Last updated:** [February 20, 2018, 4:14pm UTC](https://discuss.elastic.co/t/packet-data-rate-extracting-derivatives/120670 "2018-02-20T16:14:08Z")
I see that Packetbeat records cumulative values for its interim Flow captures. What is the best way to extract the derivatives for this? A Beat processor, or sending to Logstash or something clever on Kibana (note we do … --- ## [Filebeat strict to elasticsearch send only default fields](https://discuss.elastic.co/t/filebeat-strict-to-elasticsearch-send-only-default-fields/120426)
**Author:** [@Bardelli\_B](https://discuss.elastic.co/u/Bardelli_B)\ **Replies:** 4\ **Last updated:** [February 20, 2018, 4:06pm UTC](https://discuss.elastic.co/t/filebeat-strict-to-elasticsearch-send-only-default-fields/120426 "2018-02-20T16:06:13Z")
HI all, My setup has only a filebeat sending the logs to elasticsearch, I'm trying to use multiple templates with different indexes. When filebeat starts, the indexes are created, but only with default fields (beat.nam… --- ## [Make fails for Examplebeat on Debian 8](https://discuss.elastic.co/t/make-fails-for-examplebeat-on-debian-8/120602)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 2\ **Last updated:** [February 20, 2018, 2:58pm UTC](https://discuss.elastic.co/t/make-fails-for-examplebeat-on-debian-8/120602 "2018-02-20T14:58:59Z")
Hi everyone I followed the manual on how to create your own beat (examplebeat/countbeat), but I got stuck on the make part on a Debian 8 system. I got the following errors: root@bamboojessie:~/go/src/github.com/dcroone… --- ## [Filebeat / slow mysql log](https://discuss.elastic.co/t/filebeat-slow-mysql-log/119973)
**Author:** [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Replies:** 5\ **Last updated:** [February 20, 2018, 10:53am UTC](https://discuss.elastic.co/t/filebeat-slow-mysql-log/119973 "2018-02-20T10:53:32Z")
Hi there, I'm trying to ingest the "mysql slow log" into my elasticsearch. As my mysql version doesn't match the PATTERN defined in /usr/share/filebeat/module/mysql/slowlog/ingest/pipeline.json, I've modified the patte… --- ## [How to create indices based on kubernetes metadata](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525)
**Author:** [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\ **Replies:** 3\ **Last updated:** [February 19, 2018, 11:16pm UTC](https://discuss.elastic.co/t/how-to-create-indices-based-on-kubernetes-metadata/120525 "2018-02-19T23:16:11Z")
I am using filebeat in kubernetes to ship logs to Elasticsearch. I want to create indexes based on namespaces . I tried this : output.elasticsearch: hosts: \["http://localhost:9200"\] index: "filebeat-%{\[beat.version\]… --- ## [Using 'traefik' module in combination with autodiscovery feature does not work as expected](https://discuss.elastic.co/t/using-traefik-module-in-combination-with-autodiscovery-feature-does-not-work-as-expected/120522)
**Author:** [@darkl0rd](https://discuss.elastic.co/u/darkl0rd)\ **Replies:** 1\ **Last updated:** [February 19, 2018, 7:58pm UTC](https://discuss.elastic.co/t/using-traefik-module-in-combination-with-autodiscovery-feature-does-not-work-as-expected/120522 "2018-02-19T19:58:13Z")
Hello, I'm using filebeat in combination with the new autodiscovery feature for docker containers. After some struggling (thank again @exekias!) I finally managed to get it to pick up and process the docker containers. … --- ## [Using AutoDiscover feature for Docker does not work when running in Swarm mode](https://discuss.elastic.co/t/using-autodiscover-feature-for-docker-does-not-work-when-running-in-swarm-mode/120342)
**Author:** [@darkl0rd](https://discuss.elastic.co/u/darkl0rd)\ **Replies:** 2\ **Last updated:** [February 19, 2018, 5:52pm UTC](https://discuss.elastic.co/t/using-autodiscover-feature-for-docker-does-not-work-when-running-in-swarm-mode/120342 "2018-02-19T17:52:13Z")
Running Docker Swarm 18.02 CE + Filebeat 6.2.1. Filebeat is configured to perform auto-discovery of Docker containers, and ship its logs to logstash. On the logstash side of things however, I see the follow messages for… --- ## [Issue with filebeat kafka output lz4 compression](https://discuss.elastic.co/t/issue-with-filebeat-kafka-output-lz4-compression/120427)
**Author:** [@prabin\_meitei](https://discuss.elastic.co/u/prabin_meitei)\ **Replies:** 3\ **Last updated:** [February 19, 2018, 5:53pm UTC](https://discuss.elastic.co/t/issue-with-filebeat-kafka-output-lz4-compression/120427 "2018-02-19T17:53:28Z")
I am trying to setup filebeat (6.2) with kafka output using lz4 compression, but always getting error as ERR Invalid kafka configuration: kafka: invalid configuration (lz4 compression requires Version \>= V0\_10\_0\_0) My … --- ## [Have the timestamp when filebeat send log](https://discuss.elastic.co/t/have-the-timestamp-when-filebeat-send-log/120435)
**Author:** [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Replies:** 1\ **Last updated:** [February 19, 2018, 3:43pm UTC](https://discuss.elastic.co/t/have-the-timestamp-when-filebeat-send-log/120435 "2018-02-19T15:43:27Z")
Hi, How can I have the timestamp from Filebeat when he has sending le log to Logstash ? I need to know how many time take filebeat to send log in logstash [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=470) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=472)