# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=472 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 473 --- ## [Filebeat not starting as deamonset on Kuberneters](https://discuss.elastic.co/t/filebeat-not-starting-as-deamonset-on-kuberneters/119992)
**Author:** [@irina\_andronachi](https://discuss.elastic.co/u/irina_andronachi)\ **Replies:** 5\ **Last updated:** [February 19, 2018, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-as-deamonset-on-kuberneters/119992 "2018-02-19T15:22:29Z")
Hi, I configured a deamonset on a kubernetes cluster apiVersion: v1 items: apiVersion: extensions/v1beta1 kind: DaemonSet metadata: name: tracing-filebeat namespace: "" spec: template: metadata: labels: tra… --- ## [Filebeat Autodiscovery: Filtering by container labels](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201)
**Author:** [@ppik](https://discuss.elastic.co/u/ppik)\ **Replies:** 5\ **Last updated:** [February 19, 2018, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201 "2018-02-19T15:15:32Z")
Hi, I would like to set up Filebeat configuration with docker autodiscovery provider to create prospectors only for docker containers with certain label, e.g., filebeat.enable: "true". However I find it difficult to fin… --- ## [ParseHttp exception. Recovering, but please report this: runtime error: slice bounds out of range](https://discuss.elastic.co/t/parsehttp-exception-recovering-but-please-report-this-runtime-error-slice-bounds-out-of-range/119998)
**Author:** [@Aner\_Izraeli1](https://discuss.elastic.co/u/Aner_Izraeli1)\ **Replies:** 4\ **Last updated:** [February 19, 2018, 1:11pm UTC](https://discuss.elastic.co/t/parsehttp-exception-recovering-but-please-report-this-runtime-error-slice-bounds-out-of-range/119998 "2018-02-19T13:11:33Z")
Hello. im running packetbeat; Version: 6.2.1 on ubuntu machine, Connected to Elasticsearch version 5.1.2. capturing mirrored traffic. this is my yml file: packetbeat.interfaces.device: eth5 packetbeat.interfaces.ty… --- ## [How constract graph for showing network statistic?](https://discuss.elastic.co/t/how-constract-graph-for-showing-network-statistic/119970)
**Author:** [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\ **Replies:** 5\ **Last updated:** [February 19, 2018, 10:28am UTC](https://discuss.elastic.co/t/how-constract-graph-for-showing-network-statistic/119970 "2018-02-19T10:28:33Z")
Hello, I am trying with Grafana, DataSource Elastic with MetricBeat, do a panel that gives me the current network statistic (received and send bytes per second). May somebody give me a hint or example how to do it? In… --- ## [Beats input: SSL Certificate will not be used and deprecated config setting "document\_type"](https://discuss.elastic.co/t/beats-input-ssl-certificate-will-not-be-used-and-deprecated-config-setting-document-type/120374)
**Author:** [@ralfr](https://discuss.elastic.co/u/ralfr)\ **Replies:** 1\ **Last updated:** [February 19, 2018, 3:11am UTC](https://discuss.elastic.co/t/beats-input-ssl-certificate-will-not-be-used-and-deprecated-config-setting-document-type/120374 "2018-02-19T03:11:30Z")
Hi Everyone, I'm pretty new to the ELK stack and love it so far. However, I'm running into some subtle issues and hope you guys can help. I'm on Elasticsearch Version 6.2.1 with the latest Kibana, Logstash and Filebeat… --- ## [Dns Indexing Problem](https://discuss.elastic.co/t/dns-indexing-problem/120349)
**Author:** [@harrunisk](https://discuss.elastic.co/u/harrunisk)\ **Replies:** 4\ **Last updated:** [February 18, 2018, 2:19pm UTC](https://discuss.elastic.co/t/dns-indexing-problem/120349 "2018-02-18T14:19:15Z")
Hi all. I am trying to do this example. Packetbeat can capture traffic but there is indexing problem about dns. I have already installed elasticsearch, kibana, x-pack, packetbeat and logstash. I haven't configured logst… --- ## [Debug Unmatched responses](https://discuss.elastic.co/t/debug-unmatched-responses/119862)
**Author:** [@lren](https://discuss.elastic.co/u/lren)\ **Replies:** 7\ **Last updated:** [February 16, 2018, 11:21pm UTC](https://discuss.elastic.co/t/debug-unmatched-responses/119862 "2018-02-16T23:21:49Z")
Hi, I'm noticing a lot of http requests that aren't being sent through to logstash via packetbeat. When I stop packetbeat I notice a ton of http.unmatched\_responses and tcp.dropped\_because\_of\_gaps: INFO Total non-zero v… --- ## [How to configure filebeat to send multiline logs only after the log file is finished updating?](https://discuss.elastic.co/t/how-to-configure-filebeat-to-send-multiline-logs-only-after-the-log-file-is-finished-updating/120088)
**Author:** [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 4:48pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-send-multiline-logs-only-after-the-log-file-is-finished-updating/120088 "2018-02-16T16:48:54Z")
I am using filebeat-5.6 My config filebeat -\> logstash -\> elasticsearch -\> kibana I have hundreds of log files with 1KB - 2KB data in the path "c:\\programdata\\AICdameon\\ " All the files get created when the background… --- ## [Filebeat - Multiline & Exclude Lines Combination](https://discuss.elastic.co/t/filebeat-multiline-exclude-lines-combination/120193)
**Author:** [@Amgryptio](https://discuss.elastic.co/u/Amgryptio)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-multiline-exclude-lines-combination/120193 "2018-02-16T16:15:44Z")
Hi there, We're currently using Filebeat to ship a log file into Logstash where fields are transformed for searching on in Elasticsearch however I've come into an issue I'm hoping someone here can help with. So the ide… --- ## [Filebeat lotstash output and 'exported fields'](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796)
**Author:** [@nathharp](https://discuss.elastic.co/u/nathharp)\ **Replies:** 3\ **Last updated:** [February 16, 2018, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-lotstash-output-and-exported-fields/119796 "2018-02-16T15:36:11Z")
Hi all, I am planning our migration from our ageing rsyslog(RELP) \> logtash \> elasticsearch with a new set of infrastructure. I have been experimenting with filebeat \> logstash \> elasticsearch but I'm not getting the m… --- ## [Metricbeat 6.X - Kafka module with SASL Auth didn't work](https://discuss.elastic.co/t/metricbeat-6-x-kafka-module-with-sasl-auth-didnt-work/119587)
**Author:** [@sgerlach](https://discuss.elastic.co/u/sgerlach)\ **Replies:** 10\ **Last updated:** [February 16, 2018, 3:24pm UTC](https://discuss.elastic.co/t/metricbeat-6-x-kafka-module-with-sasl-auth-didnt-work/119587 "2018-02-16T15:24:44Z")
Hi, we run a 5 node Kafka Cluster and try to collect some metric with metricbeat. - module: kafka metricsets: \["partition" \] hosts: \["localhost:20160"\] enabled: true period: 30s client\_id: metricbeat retri… --- ## [Filebeat 6.1 performance](https://discuss.elastic.co/t/filebeat-6-1-performance/119659)
**Author:** [@artful](https://discuss.elastic.co/u/artful)\ **Replies:** 3\ **Last updated:** [February 16, 2018, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-6-1-performance/119659 "2018-02-16T13:01:13Z")
Hello! I transfer postgres logs with Filebeat PostgreSQL module directly to Elasticsearch 6.1. But bandwidth is limited. How I can tuning my config for max performance? My log: 2018-02-13T12:51:33Z INFO Non-zero metri… --- ## [Kibana index on Wineventlog date](https://discuss.elastic.co/t/kibana-index-on-wineventlog-date/119959)
**Author:** [@samsam](https://discuss.elastic.co/u/samsam)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 11:23am UTC](https://discuss.elastic.co/t/kibana-index-on-wineventlog-date/119959 "2018-02-16T11:23:01Z")
Hi, I want to know if it's possible to filter date of Wineventlog from Winlogbeat for index on kibana. Because my Kibana is index on date of Linux log, and I would like to add my windows servers on. I find some tracks… --- ## [Filebeat 6.2.1 Dashboard errors: Could not locate that index-pattern-field](https://discuss.elastic.co/t/filebeat-6-2-1-dashboard-errors-could-not-locate-that-index-pattern-field/120016)
**Author:** [@garaged](https://discuss.elastic.co/u/garaged)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 11:12am UTC](https://discuss.elastic.co/t/filebeat-6-2-1-dashboard-errors-could-not-locate-that-index-pattern-field/120016 "2018-02-16T11:12:38Z")
\[38%20AM\] I'm trying to replicate what was possible with ELK 2.x in 6.2.1. I tried to create indexes and dashboards for filebeat and topbeat, but the dashboards for filebeat end up like the screenshot above, I haven't … --- ## [Postgresql module not populating event fields (Windows)](https://discuss.elastic.co/t/postgresql-module-not-populating-event-fields-windows/120056)
**Author:** [@andyliddle](https://discuss.elastic.co/u/andyliddle)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 9:49am UTC](https://discuss.elastic.co/t/postgresql-module-not-populating-event-fields-windows/120056 "2018-02-16T09:49:30Z")
Hi, I have enabled to the postgres module pointing to my log files. When i start filebeat i can see that is picks up the logs and processes them, but it does not seem to be populating the postgresql fields in the ev… --- ## [Beats montioring shows failed events but no logs](https://discuss.elastic.co/t/beats-montioring-shows-failed-events-but-no-logs/120085)
**Author:** [@andyliddle](https://discuss.elastic.co/u/andyliddle)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 9:34am UTC](https://discuss.elastic.co/t/beats-montioring-shows-failed-events-but-no-logs/120085 "2018-02-16T09:34:40Z")
Hi, So I've setup an number of beats (metricbeat, filebeat, winlogbeat) but i'm seeing a number of failed events / outputs in Monitroign in kibana. I was trying to investigate these but i cannot see any errors in eith… --- ## [Winlogbeat SSL Server auth only](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066)
**Author:** [@albbapm](https://discuss.elastic.co/u/albbapm)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 9:00pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066 "2018-02-15T21:00:33Z")
I have successfully implemented mutual authentication between winlogbeat and logstash. However, due to the logistics of exporting certificates to all windows machines that will be sending logs, I would like to set up s… --- ## [Filebeat service not starting](https://discuss.elastic.co/t/filebeat-service-not-starting/119892)
**Author:** [@jiten](https://discuss.elastic.co/u/jiten)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-service-not-starting/119892 "2018-02-15T16:40:04Z")
i am trying to configure and install filebeat using salt on centos7 machine, code is running fine but when i am checking systemctl status filebeat it is showing below error. \[jbansal@stage1-servicenode1 files\]$ sudo sys… --- ## [Filebeat conditional on annotation](https://discuss.elastic.co/t/filebeat-conditional-on-annotation/119786)
**Author:** [@Jim\_Sheldon](https://discuss.elastic.co/u/Jim_Sheldon)\ **Replies:** 8\ **Last updated:** [February 15, 2018, 3:42pm UTC](https://discuss.elastic.co/t/filebeat-conditional-on-annotation/119786 "2018-02-15T15:42:05Z")
Greetings! I am having trouble using a kubernetes pod annotation in a filebeat autodiscover conditional. I see that metricbeat's autodiscover kubernetes example has include\_annotations then a condition that looks at an… --- ## [Using environment variables on filebeat config file](https://discuss.elastic.co/t/using-environment-variables-on-filebeat-config-file/119944)
**Author:** [@fiunchinho](https://discuss.elastic.co/u/fiunchinho)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 9:38am UTC](https://discuss.elastic.co/t/using-environment-variables-on-filebeat-config-file/119944 "2018-02-15T09:38:10Z")
I'd like to tag the logs coming from filebeat with the content of an environment variable, but I need to remove dashes from the environment variable. I've tried this shipper: tags: \["agent", ${APPLICATION\_NAME//-/}\] b… --- ## [Error decoding JSON: json: cannot unmarshal number into Go value of type map\[string\]interface {}](https://discuss.elastic.co/t/error-decoding-json-json-cannot-unmarshal-number-into-go-value-of-type-map-string-interface/118661)
**Author:** [@Triv1an](https://discuss.elastic.co/u/Triv1an)\ **Replies:** 6\ **Last updated:** [February 15, 2018, 9:15am UTC](https://discuss.elastic.co/t/error-decoding-json-json-cannot-unmarshal-number-into-go-value-of-type-map-string-interface/118661 "2018-02-15T09:15:28Z")
Good afternoon, We are currently using Filebeat to send pre-formatted JSON messages, saved in a logfile through to our processing tool. JSON looks as follows: { "generated\_at": "2018-02-06T13:56:04+00:00", "profile"… --- ## [Filebeat private key parse error](https://discuss.elastic.co/t/filebeat-private-key-parse-error/119633)
**Author:** [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-private-key-parse-error/119633 "2018-02-14T17:09:00Z")
Hi everyone, I'm trying to configure SSL encryption in between filebeat and redis. I self signed the certificate. Logfile: filebeat -c filebeat.yml -e -v 2018/02/13 12:22:37.675420 beat.go:436: INFO Home path: \[/usr/… --- ## [Make package in Gitlab CI with docker](https://discuss.elastic.co/t/make-package-in-gitlab-ci-with-docker/119827)
**Author:** [@lonangel](https://discuss.elastic.co/u/lonangel)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 4:49pm UTC](https://discuss.elastic.co/t/make-package-in-gitlab-ci-with-docker/119827 "2018-02-14T16:49:17Z")
I'm creating a test beat and after following the code generator every thing seems to work of. Working with a Gitlab based CI system I tried to run the "make package" inside docker. The docker has the docker socket in a… --- ## [Running metricbeat in docker and monitoring the host system does not work with command from documentation](https://discuss.elastic.co/t/running-metricbeat-in-docker-and-monitoring-the-host-system-does-not-work-with-command-from-documentation/119821)
**Author:** [@Christian\_H](https://discuss.elastic.co/u/Christian_H)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 4:39pm UTC](https://discuss.elastic.co/t/running-metricbeat-in-docker-and-monitoring-the-host-system-does-not-work-with-command-from-documentation/119821 "2018-02-14T16:39:26Z")
I wanted to start a metricbeat container with a custom metricbeat.yml to monitor the host it runs on. I used this command from the documentation (https://www.elastic.co/guide/en/beats/metricbeat/6.1/running-on-docker.ht… --- ## [Filebeat making too many log files and refuses to send JSON strings](https://discuss.elastic.co/t/filebeat-making-too-many-log-files-and-refuses-to-send-json-strings/119752)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-making-too-many-log-files-and-refuses-to-send-json-strings/119752 "2018-02-14T14:41:38Z")
I'm using filebeats to directly ship my logs to ES cluster. The log file has one Json per line. I'm also asking filebeat to generate it's own logs in debug mode by log rotation. Here are logging settings: logging.level… --- ## [Installing metricbeat on vsphere](https://discuss.elastic.co/t/installing-metricbeat-on-vsphere/119789)
**Author:** [@Mark\_Collins](https://discuss.elastic.co/u/Mark_Collins)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 2:30pm UTC](https://discuss.elastic.co/t/installing-metricbeat-on-vsphere/119789 "2018-02-14T14:30:44Z")
Hi All, I am quite new to elastic and also vsphere and would like make use of the vsphere module of metricbeat a quick question is how do I install metricbeat on esxi vsphere thanks mark --- ## [Filebeat 6.2 and Windows](https://discuss.elastic.co/t/filebeat-6-2-and-windows/119318)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 6\ **Last updated:** [February 14, 2018, 2:07pm UTC](https://discuss.elastic.co/t/filebeat-6-2-and-windows/119318 "2018-02-14T14:07:45Z")
I recently upgraded my stack to 6.2 from 5.7.1, and struggled to get Filebeat working. On my Linux hosts, I had to upgrade to Filebeat-6.2, as well as to create a new Filebeat index based on Filebeat-6.2 in my Elastic h… --- ## [How to use the stdin prospector](https://discuss.elastic.co/t/how-to-use-the-stdin-prospector/119017)
**Author:** [@Cristi\_Cioriia](https://discuss.elastic.co/u/Cristi_Cioriia)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 12:48pm UTC](https://discuss.elastic.co/t/how-to-use-the-stdin-prospector/119017 "2018-02-14T12:48:29Z")
Hey guys, I've been setting up a filebeat 6.2 docker image with a custom filebeat.yml that looks like below: #=========================== Filebeat prospectors ============================= filebeat.prospectors: - typ… --- ## [Logs WinlogBeat](https://discuss.elastic.co/t/logs-winlogbeat/119622)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 12:32pm UTC](https://discuss.elastic.co/t/logs-winlogbeat/119622 "2018-02-14T12:32:52Z")
Hello, I have a question about WinlogBeat, I've installed and configured it and all is working perfectly, my question is: How is WinlogBeat working ? I currently see all the logs about all the users in the network, isn… --- ## [Advice regarding Metricbeat sharding and retention](https://discuss.elastic.co/t/advice-regarding-metricbeat-sharding-and-retention/119053)
**Author:** [@matt.hagenbuch](https://discuss.elastic.co/u/matt.hagenbuch)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 12:01am UTC](https://discuss.elastic.co/t/advice-regarding-metricbeat-sharding-and-retention/119053 "2018-02-14T00:01:35Z")
Hi, I have a largish(?) metricbeat installation which collects from ~2000 machines minutely, generating ~100GB index with 135M docs per day. Currently I have the indexes set to 5 shards x2 replication, which is perform… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=471) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=473)