# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=473 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 474 --- ## [Filebeat 6.2.1 system module does not convert timestamp with timezone](https://discuss.elastic.co/t/filebeat-6-2-1-system-module-does-not-convert-timestamp-with-timezone/119668)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 2\ **Last updated:** [February 13, 2018, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-6-2-1-system-module-does-not-convert-timestamp-with-timezone/119668 "2018-02-13T18:27:28Z")
Hello, It seems that Filebeat system module is wrongly converting timestamp into Elaticsearch/Kibana. While testing all this, I delete all beat indices in my ES to see only new events. When looking inside Kibana I see… --- ## [0 RabbitMQ Nodes / No results found](https://discuss.elastic.co/t/0-rabbitmq-nodes-no-results-found/119312)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [February 13, 2018, 3:58am UTC](https://discuss.elastic.co/t/0-rabbitmq-nodes-no-results-found/119312 "2018-02-13T03:58:42Z")
I'm using latest Metricbeat and trying to collect data from rabbitmq, yet see nothing via Kibana... # cat /etc/metricbeat/modules.d/rabbitmq.yml - module: rabbitmq metricsets: \["node", "queue"\] period: 10s hosts:… --- ## [Filebeat injest same file repeatedly on an interval for logstash filter testing / development](https://discuss.elastic.co/t/filebeat-injest-same-file-repeatedly-on-an-interval-for-logstash-filter-testing-development/119660)
**Author:** [@D-Sect](https://discuss.elastic.co/u/D-Sect)\ **Replies:** 2\ **Last updated:** [February 13, 2018, 3:44pm UTC](https://discuss.elastic.co/t/filebeat-injest-same-file-repeatedly-on-an-interval-for-logstash-filter-testing-development/119660 "2018-02-13T15:44:46Z")
Hello, I am looking to cut the cycle time when developing and testing Logstash configuration file code with a filebeat input. I am working on grok patterns, filters, etc and my current test cycle involved re-ingesting … --- ## [Transport.go:125: ssl client failed to connect](https://discuss.elastic.co/t/transport-go-125-ssl-client-failed-to-connect/119475)
**Author:** [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Replies:** 3\ **Last updated:** [February 13, 2018, 12:51pm UTC](https://discuss.elastic.co/t/transport-go-125-ssl-client-failed-to-connect/119475 "2018-02-13T12:51:30Z")
I am trying to connect filebeat to logstash but I have this error : ● filebeat.service - filebeat Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled) Active: active (running) si… --- ## [Export template from custom beat based on metricbeat](https://discuss.elastic.co/t/export-template-from-custom-beat-based-on-metricbeat/119250)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 7\ **Last updated:** [February 13, 2018, 12:37pm UTC](https://discuss.elastic.co/t/export-template-from-custom-beat-based-on-metricbeat/119250 "2018-02-13T12:37:27Z")
Hi I created my own beat based on metricbeat 6.0 with it's own modules and metricsets. I also created the necessary fields.yml files for the modules and the metricsets and ran successfully make update which gave me a ki… --- ## [Filebeat 6.1 not forwarding syslog and container\_log to kafka (0.11.0.1)](https://discuss.elastic.co/t/filebeat-6-1-not-forwarding-syslog-and-container-log-to-kafka-0-11-0-1/118668)
**Author:** [@Sandeep\_Sarkar](https://discuss.elastic.co/u/Sandeep_Sarkar)\ **Replies:** 12\ **Last updated:** [February 13, 2018, 8:51am UTC](https://discuss.elastic.co/t/filebeat-6-1-not-forwarding-syslog-and-container-log-to-kafka-0-11-0-1/118668 "2018-02-13T08:51:45Z")
Hi , I have filebeat 6.1 and kafka 0.11.0.1. I need to forward syslog and container\_log to kafka. Logs are not getting published, I am getting below log message : 2018/02/06 15:11:15.630752 metrics.go:39: INFO Non-zero… --- ## [Filebeat multiline config problem](https://discuss.elastic.co/t/filebeat-multiline-config-problem/119357)
**Author:** [@9AutumnRain](https://discuss.elastic.co/u/9AutumnRain)\ **Replies:** 2\ **Last updated:** [February 13, 2018, 12:59am UTC](https://discuss.elastic.co/t/filebeat-multiline-config-problem/119357 "2018-02-13T00:59:30Z")
hey guys: I have logs format like this: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* line a line b \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* line c line d \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* line e line f and I want to combine the lines bewteen "\*\*\*" lines and exclude "\*\*\*" lines thems… --- ## [Index template pattern & with different beats and kibana](https://discuss.elastic.co/t/index-template-pattern-with-different-beats-and-kibana/119521)
**Author:** [@andyliddle](https://discuss.elastic.co/u/andyliddle)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 8:53pm UTC](https://discuss.elastic.co/t/index-template-pattern-with-different-beats-and-kibana/119521 "2018-02-12T20:53:43Z")
Hi, Still trying to get my head around indexes, templates and patterns. I understand that its best practice to have metricbeat and filebeat to use separate indexes as their is potential for conflicts with fields (e.g o… --- ## [Error Return code 21: SSL encryption between filebeat 5.2 and kafka 1.0 (self signed)](https://discuss.elastic.co/t/error-return-code-21-ssl-encryption-between-filebeat-5-2-and-kafka-1-0-self-signed/119126)
**Author:** [@Gangadhar\_Mahadevan](https://discuss.elastic.co/u/Gangadhar_Mahadevan)\ **Replies:** 29\ **Last updated:** [February 12, 2018, 7:41pm UTC](https://discuss.elastic.co/t/error-return-code-21-ssl-encryption-between-filebeat-5-2-and-kafka-1-0-self-signed/119126 "2018-02-12T19:41:34Z")
I am trying to set up ssl connection between filebeat 5.2 and kafka 1.0 using the below steps. I am fairly new to encryption world and seeing errors during this process. Not sure if I am missing something in cert/key or … --- ## [FB connection timed out](https://discuss.elastic.co/t/fb-connection-timed-out/119326)
**Author:** [@Medard\_Rebero](https://discuss.elastic.co/u/Medard_Rebero)\ **Replies:** 3\ **Last updated:** [February 12, 2018, 4:21pm UTC](https://discuss.elastic.co/t/fb-connection-timed-out/119326 "2018-02-12T16:21:12Z")
I am struggling so badly with this issue. I am trying to use filebeat to send logs to logstash and I get this kind of error: 2018-02-10T04:27:51.356+0100 INFO \[monitoring\] log/log.go:124 Non-zero metrics in th… --- ## [Older logs than 30days](https://discuss.elastic.co/t/older-logs-than-30days/119246)
**Author:** [@MLdz](https://discuss.elastic.co/u/MLdz)\ **Replies:** 3\ **Last updated:** [February 12, 2018, 2:33pm UTC](https://discuss.elastic.co/t/older-logs-than-30days/119246 "2018-02-12T14:33:08Z")
Hello, I have a problem, I want to send logs to logstash with filebeat, i just want to send the 30 last days of logs. The prospectors of filebeat scan 4 logs files. I just want the line in the logs files for the last … --- ## [Packetbeat not starting after standby](https://discuss.elastic.co/t/packetbeat-not-starting-after-standby/119034)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 7\ **Last updated:** [February 12, 2018, 2:06pm UTC](https://discuss.elastic.co/t/packetbeat-not-starting-after-standby/119034 "2018-02-12T14:06:38Z")
I have packetbeat 6.1.2 installed as a service, running fine, but when I turn my laptop in standby (closing it) and I wake it up, packetbeat would not start. I can start it manually. And all 3 other beats that I instal… --- ## [Filebeats : failed to start found a tab character](https://discuss.elastic.co/t/filebeats-failed-to-start-found-a-tab-character/119461)
**Author:** [@Pierre\_What\_s\_Up\_Sca](https://discuss.elastic.co/u/Pierre_What_s_Up_Sca)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 1:07pm UTC](https://discuss.elastic.co/t/filebeats-failed-to-start-found-a-tab-character/119461 "2018-02-12T13:07:35Z")
Hi ! When I try to launch filebeat I have this error message : \< Feb 12 11:49:40 localhost.localdomain systemd\[1\]: Unit filebeat.service entered failed state. Feb 12 11:49:40 localhost.localdomain systemd\[1\]: filebeat.… --- ## [How to conf filebeat input path use date such as (/var/log/${+yyyyMMDD})](https://discuss.elastic.co/t/how-to-conf-filebeat-input-path-use-date-such-as-var-log-yyyymmdd/119342)
**Author:** [@wede2046](https://discuss.elastic.co/u/wede2046)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 10:40am UTC](https://discuss.elastic.co/t/how-to-conf-filebeat-input-path-use-date-such-as-var-log-yyyymmdd/119342 "2018-02-12T10:40:33Z")
how to conf filebeat input path use date such as (/var/log/${+yyyyMMDD})? filebeat.prospectors: type: log paths: /var/log/${+yyyyMMDD} is filebeat support this file path? --- ## [Filebeat sending duplicate logs to logstash](https://discuss.elastic.co/t/filebeat-sending-duplicate-logs-to-logstash/119216)
**Author:** [@rajshekhar](https://discuss.elastic.co/u/rajshekhar)\ **Replies:** 1\ **Last updated:** [February 9, 2018, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-sending-duplicate-logs-to-logstash/119216 "2018-02-09T15:11:27Z")
Hi Team, We are testing filebeat for our development setup, using filebeat 5.6.2. The logs are sent to logstash hosted by logz.io via SSL, but we observed that we are getting some duplicate logs entries in elasticsearch… --- ## [Winlogbeat - Installation on multiple hosts](https://discuss.elastic.co/t/winlogbeat-installation-on-multiple-hosts/118898)
**Author:** [@codeguru](https://discuss.elastic.co/u/codeguru)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 2:30pm UTC](https://discuss.elastic.co/t/winlogbeat-installation-on-multiple-hosts/118898 "2018-02-09T14:30:43Z")
I am a beginner with the elastic stack and trying to learn and understand all the capabilities/features. I have successfully installed winlog on one machine and I want to installt it on 10 more machines and see how I lik… --- ## [Beats Module IPMI/iLO](https://discuss.elastic.co/t/beats-module-ipmi-ilo/118888)
**Author:** [@PauliniMrtns](https://discuss.elastic.co/u/PauliniMrtns)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 1:58pm UTC](https://discuss.elastic.co/t/beats-module-ipmi-ilo/118888 "2018-02-09T13:58:10Z")
Dear all, I'm looking for a new solution for our monitoring platform. We are deploying a new ELK Stack cluster dedicated for this and one of our options for monitoring the physical stats on our devices we considered tha… --- ## [Index\_Pattern set to metricbeat-\* on sample dashboards](https://discuss.elastic.co/t/index-pattern-set-to-metricbeat-on-sample-dashboards/118889)
**Author:** [@andyliddle](https://discuss.elastic.co/u/andyliddle)\ **Replies:** 3\ **Last updated:** [February 9, 2018, 1:46pm UTC](https://discuss.elastic.co/t/index-pattern-set-to-metricbeat-on-sample-dashboards/118889 "2018-02-09T13:46:11Z")
Hi, Not sure if this is limited to metricbeat but, I noticed that in 6.2 that the index\_pattern on the default dashboards is set to "index\_pattern":"metricbeat-" when in the version 6.1.3 is was set to "index\_pattern"… --- ## [Filebeat send the entire logfile as a single message](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265)
**Author:** [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)\ **Replies:** 1\ **Last updated:** [February 9, 2018, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-send-the-entire-logfile-as-a-single-message/118265 "2018-02-09T13:03:33Z")
I am using filebeat-5.6 My config filebeat -\> logstash -\> elasticsearch -\> kibana I have hundreds of log files with 1KB - 2KB data( usually each file has atmost 15 lines of messages in them) in a folder. Is it possible… --- ## [Got 400 with system\_api\_version \[6\] is not supported by system\_id \[beats\]](https://discuss.elastic.co/t/got-400-with-system-api-version-6-is-not-supported-by-system-id-beats/119012)
**Author:** [@Moshe\_Nadler](https://discuss.elastic.co/u/Moshe_Nadler)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 6:18am UTC](https://discuss.elastic.co/t/got-400-with-system-api-version-6-is-not-supported-by-system-id-beats/119012 "2018-02-09T06:18:46Z")
I get the following 400 when trying to send monitoring data from filebeat to elasticsearch: ERROR pipeline/output.go:92 Failed to publish events: 400 Bad Request: {"error":{"root\_cause":\[{"type":"illegal\_argument\_ex… --- ## [SSL certificate error for sending logs from Filebeat to Graylog using logstash output](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969)
**Author:** [@Umesh\_Dc](https://discuss.elastic.co/u/Umesh_Dc)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 11:51pm UTC](https://discuss.elastic.co/t/ssl-certificate-error-for-sending-logs-from-filebeat-to-graylog-using-logstash-output/118969 "2018-02-08T23:51:39Z")
Hi, Currently I am planning to use TLS certificate for sending logs using filebeat to Graylog. I am using below command to generate server certificate and private key, openssl req -x509 -nodes -days 3650 -newkey rsa:2… --- ## [Filebeat multiline configuration issue](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 11:45pm UTC](https://discuss.elastic.co/t/filebeat-multiline-configuration-issue/118934 "2018-02-08T23:45:48Z")
Hello, I am trying to parse a java log file using filebeat with multiline. The filebeat.yml looks like this: filebeat.prospectors: - type: log enabled: true paths: - /home/jetty/logs/\*.log tags: \["jett… --- ## [Lowercase index when created from fields](https://discuss.elastic.co/t/lowercase-index-when-created-from-fields/118893)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 11:37pm UTC](https://discuss.elastic.co/t/lowercase-index-when-created-from-fields/118893 "2018-02-08T23:37:32Z")
Hello, I want to create an index that depends on some of the fields of my input lines (JSON lines). like index: "wilco-%{\[site\]}-%{\[fwot\_type\]}-%{\[layout\_id\]}-%{+yyyy.MM}-v1" But %{\[fwot\_type\]} has some uppercases, th… --- ## [How to make filebeat multiline plugin send the unmatched logs](https://discuss.elastic.co/t/how-to-make-filebeat-multiline-plugin-send-the-unmatched-logs/117906)
**Author:** [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)\ **Replies:** 3\ **Last updated:** [February 8, 2018, 11:22pm UTC](https://discuss.elastic.co/t/how-to-make-filebeat-multiline-plugin-send-the-unmatched-logs/117906 "2018-02-08T23:22:40Z")
Hi, I am using filebeat 5.6.X version With the below config, filebeat sends five lines to elasticsearch from below log file, using multi line pattern. But the first line " host down true wiley-host" is dropped. How to… --- ## [Sending Filebeat logs to file instead of STDOUT](https://discuss.elastic.co/t/sending-filebeat-logs-to-file-instead-of-stdout/119131)
**Author:** [@obodard](https://discuss.elastic.co/u/obodard)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 10:36pm UTC](https://discuss.elastic.co/t/sending-filebeat-logs-to-file-instead-of-stdout/119131 "2018-02-08T22:36:30Z")
I'm trying to redirect the filebeat logs from STDOUT to a file, but they always end on my console. Filebeat version: filebeat-6.2.1-linux-x86\_64 Config: logging.level: info logging.to\_files: true logging.files: path… --- ## [Drop\_event proccessor](https://discuss.elastic.co/t/drop-event-proccessor/119050)
**Author:** [@Asaf\_David](https://discuss.elastic.co/u/Asaf_David)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 9:13pm UTC](https://discuss.elastic.co/t/drop-event-proccessor/119050 "2018-02-08T21:13:12Z")
Hello All, i have an issue with filebeat. I tried to "drop\_event" with response code "200" and it's not working for me. this is my filebeat configuration: processors: - drop\_event: when: equal… --- ## [Metricbeat Apache Info](https://discuss.elastic.co/t/metricbeat-apache-info/117125)
**Author:** [@elJoeyJojo](https://discuss.elastic.co/u/elJoeyJojo)\ **Replies:** 10\ **Last updated:** [February 8, 2018, 6:06pm UTC](https://discuss.elastic.co/t/metricbeat-apache-info/117125 "2018-02-08T18:06:01Z")
I've setup the metricbeat config on 3 servers (1 of them is the kibana/elasticsearch host) and i am able to see the logs/dashboards for system overall, cpu, memory etc.. I enabled the apache and mysql module on all 3 ser… --- ## [Standard output data ingestion](https://discuss.elastic.co/t/standard-output-data-ingestion/118885)
**Author:** [@satyag](https://discuss.elastic.co/u/satyag)\ **Replies:** 2\ **Last updated:** [February 8, 2018, 2:37pm UTC](https://discuss.elastic.co/t/standard-output-data-ingestion/118885 "2018-02-08T14:37:46Z")
We need to ingest standard output that generated from 3rd party apps from one of the host and ingest that information into logstash? The OS is 2012 R2. please suggest which one to use. thx --- ## [Filebeat reads the complete log file from start](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629)
**Author:** [@Punit\_Bangade](https://discuss.elastic.co/u/Punit_Bangade)\ **Replies:** 3\ **Last updated:** [February 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/filebeat-reads-the-complete-log-file-from-start/118629 "2018-02-08T11:21:00Z")
Hello, I am using filebeat version 5.6.0,in my log file location I am copying log files from remote machine.If the file already exist in my local directory i am replacing it with newer one after some time interval. But… --- ## [No data in Auditbeat events when using include\_fields processor](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 4\ **Last updated:** [February 8, 2018, 7:45am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802 "2018-02-08T07:45:46Z")
Hey, I'm trying to run auditbeat for the first time on debian jessie. I've downloaded the current .deb (6.2) and configured auditbeat to log everything that it can (using the auditbeat.reference.yaml). It's also exporti… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=472) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=474)