# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=474 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 475 --- ## [Winlogbeat suddenly stop when started - Windows 2003 64-bit](https://discuss.elastic.co/t/winlogbeat-suddenly-stop-when-started-windows-2003-64-bit/116369)
**Author:** [@poper](https://discuss.elastic.co/u/poper)\ **Replies:** 14\ **Last updated:** [February 8, 2018, 2:00am UTC](https://discuss.elastic.co/t/winlogbeat-suddenly-stop-when-started-windows-2003-64-bit/116369 "2018-02-08T02:00:07Z")
Hi There, I got the winlogbeat suddenly stop when I run the service. See in my system log said. ID: 7034 The winlogbeat service terminated unexpectedly. It has done this 3 time(s). I run winlogbeat in version 6.1.1 … --- ## [Metricbeat failing to start - Non-existent WMI Counters](https://discuss.elastic.co/t/metricbeat-failing-to-start-non-existent-wmi-counters/118709)
**Author:** [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 7:50pm UTC](https://discuss.elastic.co/t/metricbeat-failing-to-start-non-existent-wmi-counters/118709 "2018-02-07T19:50:56Z")
Hi, Having issues with the current version of metricbeat stopping/failing to start when a WMI counter defined in the windows.yml does not exist. I noticed in Issue 3828 (https://github.com/elastic/beats/issues/3828) th… --- ## [Filebeat 6.2 seems to be monitoring the server it's running on?](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865)
**Author:** [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\ **Replies:** 4\ **Last updated:** [February 7, 2018, 7:25pm UTC](https://discuss.elastic.co/t/filebeat-6-2-seems-to-be-monitoring-the-server-its-running-on/118865 "2018-02-07T19:25:16Z")
I upgraded one of my servers to filebeat 6.2 to test it out and everything seems to work fine but now I'm getting these lines in the log file constantly: 2018-02-07T09:55:12.077-0500 INFO \[monitoring\] log/log.g… --- ## [How to capture loadtime and domloadtime](https://discuss.elastic.co/t/how-to-capture-loadtime-and-domloadtime/118479)
**Author:** [@karanshah](https://discuss.elastic.co/u/karanshah)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 4:42pm UTC](https://discuss.elastic.co/t/how-to-capture-loadtime-and-domloadtime/118479 "2018-02-07T16:42:47Z")
Hi All, I am using packetbeat for end user experience monitoring for our CRM tool by installing it on end user's desktop. We have configured packetbeat to capture only http traffic on port 8080 and we are able to get r… --- ## [Config\_dir vs filebeat.config.prospectors](https://discuss.elastic.co/t/config-dir-vs-filebeat-config-prospectors/118819)
**Author:** [@AbdulH](https://discuss.elastic.co/u/AbdulH)\ **Replies:** 1\ **Last updated:** [February 7, 2018, 4:12pm UTC](https://discuss.elastic.co/t/config-dir-vs-filebeat-config-prospectors/118819 "2018-02-07T16:12:30Z")
Documentation seems to suggest conf\_dir can be used to set the external config directory. However they can also be set using the following: filebeat.config.prospectors: enabled: true path: configs/\*.yml reload.enabled:… --- ## [Filebeat wrongly detects a log rename in rotation, causing "Not resuming rotated file"](https://discuss.elastic.co/t/filebeat-wrongly-detects-a-log-rename-in-rotation-causing-not-resuming-rotated-file/118845)
**Author:** [@tobiasvl](https://discuss.elastic.co/u/tobiasvl)\ **Replies:** 1\ **Last updated:** [February 7, 2018, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-wrongly-detects-a-log-rename-in-rotation-causing-not-resuming-rotated-file/118845 "2018-02-07T15:31:04Z")
Hello, I have a problem with one of my log files in Filebeat 1.3.1: Not resuming rotated file: /cerebrum/var/log/cerebrum/exchange\_daemon.py/log This happens all the time, until this pops up (with a typo, as I assume "… --- ## [Libbeat common schema mapstriface](https://discuss.elastic.co/t/libbeat-common-schema-mapstriface/118678)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 6\ **Last updated:** [February 7, 2018, 2:47pm UTC](https://discuss.elastic.co/t/libbeat-common-schema-mapstriface/118678 "2018-02-07T14:47:22Z")
Hi all Am I missing something or is there a reason why there is no Float function (anymore) in mapstriface like in mapstrstr when converting events? Kind regards Davy --- ## [Errors with Metricbeat rabbitmq module and RabbitMQ 2.7.1](https://discuss.elastic.co/t/errors-with-metricbeat-rabbitmq-module-and-rabbitmq-2-7-1/115667)
**Author:** [@Kaouther\_Mechri](https://discuss.elastic.co/u/Kaouther_Mechri)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 10:25am UTC](https://discuss.elastic.co/t/errors-with-metricbeat-rabbitmq-module-and-rabbitmq-2-7-1/115667 "2018-02-07T10:25:16Z")
Hello; when I enable rabbitmq module with metricbeats; I have the following error in my metricbeats logfile 2018-01-16T09:33:54+01:00 ERR Error on field 'state': Missing field: state, Error: Key state not found: ke… --- ## [Importing Kibana dashboards: fail to create the Kibana loader](https://discuss.elastic.co/t/importing-kibana-dashboards-fail-to-create-the-kibana-loader/118637)
**Author:** [@BezVeze](https://discuss.elastic.co/u/BezVeze)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 8:48am UTC](https://discuss.elastic.co/t/importing-kibana-dashboards-fail-to-create-the-kibana-loader/118637 "2018-02-07T08:48:24Z")
Ok, im pretty sure that i know what is the deal but i cant figure it out how i can manage to work... the thing is when i start the filebeat setup -E action it cannot install the dashboards in the kibana it gives me an … --- ## [Filebeat read log4j2 rotated log file again](https://discuss.elastic.co/t/filebeat-read-log4j2-rotated-log-file-again/118565)
**Author:** [@Denshou](https://discuss.elastic.co/u/Denshou)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 12:36am UTC](https://discuss.elastic.co/t/filebeat-read-log4j2-rotated-log-file-again/118565 "2018-02-07T00:36:38Z")
Hi, I am using filebeat 6.1.3 in windows to read log files from log4j2 to logstash. When the logfile ratated from xxx.log -\> xxx.log.1 logstash received the lines in file xxx.log.1 again so all the log is read twice. … --- ## [Filebeat \>5.4: Apply geoip only if a IP field exists](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 2\ **Last updated:** [February 6, 2018, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684 "2018-02-06T20:42:03Z")
I listen to my app with a filebeat that watches the application logs. To parse my custom log lines, I have a pipeline in my elasticsearch \_ingest. Some of the lines have a IP address, some others have not. I want to geo… --- ## [Packetbeat giving errors](https://discuss.elastic.co/t/packetbeat-giving-errors/118694)
**Author:** [@ranjeets](https://discuss.elastic.co/u/ranjeets)\ **Replies:** 2\ **Last updated:** [February 6, 2018, 7:08pm UTC](https://discuss.elastic.co/t/packetbeat-giving-errors/118694 "2018-02-06T19:08:25Z")
Hello All, I am trying to configured the packetbeats to monitor the mongodb long running query. But its look like packetbeats not working . Logs file pointed as 2018-02-06T12:40:35-05:00 ERR Unknown operation code: --- ## [Not able to read time field from docker logs](https://discuss.elastic.co/t/not-able-to-read-time-field-from-docker-logs/117234)
**Author:** [@shekharupland](https://discuss.elastic.co/u/shekharupland)\ **Replies:** 7\ **Last updated:** [February 6, 2018, 4:42pm UTC](https://discuss.elastic.co/t/not-able-to-read-time-field-from-docker-logs/117234 "2018-02-06T16:42:51Z")
I have configured filebeat on my kubernetes cluster with elastic Search stack to collect all the generated dockers logs. The logs string are in this format : {"log":"Execution time (ms): 4\\n","stream":"stdout","time":… --- ## [Elasticsearch starting creating extra indices](https://discuss.elastic.co/t/elasticsearch-starting-creating-extra-indices/118666)
**Author:** [@Jeremy\_C](https://discuss.elastic.co/u/Jeremy_C)\ **Replies:** 2\ **Last updated:** [February 6, 2018, 3:22pm UTC](https://discuss.elastic.co/t/elasticsearch-starting-creating-extra-indices/118666 "2018-02-06T15:22:13Z")
A few weeks ago I upgraded from 5.6.6 to 6.1.2. A few days ago elasticsearch started creating some extra indices. For example, today instead of just the usual winlogbeat index "winlogbeat-2018.02.06" there is also "wi… --- ## [Hyper-V Monitoring using ELK Stack](https://discuss.elastic.co/t/hyper-v-monitoring-using-elk-stack/118636)
**Author:** [@PauliniMrtns](https://discuss.elastic.co/u/PauliniMrtns)\ **Replies:** 1\ **Last updated:** [February 6, 2018, 2:18pm UTC](https://discuss.elastic.co/t/hyper-v-monitoring-using-elk-stack/118636 "2018-02-06T14:18:11Z")
Hello all! I'm currently deploying an ELK cluster for monitoring several virtualization platforms. I'm currently using vSphere module for monitoring VMWare vCenter resources using Metricbeats, but and I also have some … --- ## [Filebeat Harvester](https://discuss.elastic.co/t/filebeat-harvester/118599)
**Author:** [@charan.gandra](https://discuss.elastic.co/u/charan.gandra)\ **Replies:** 2\ **Last updated:** [February 6, 2018, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-harvester/118599 "2018-02-06T13:40:26Z")
Filebeat is not harvesting all the log file details in prospectors. Here is my prospectors: filebeat.prospectors: type: log enabled: true paths: /var/log/\*.log /var/log/secure /var/log/messages However Filebe… --- ## [Import Dashboards failed - failed to load](https://discuss.elastic.co/t/import-dashboards-failed-failed-to-load/118420)
**Author:** [@A.Klos](https://discuss.elastic.co/u/A.Klos)\ **Replies:** 2\ **Last updated:** [February 6, 2018, 8:21am UTC](https://discuss.elastic.co/t/import-dashboards-failed-failed-to-load/118420 "2018-02-06T08:21:52Z")
Hi, I tried to follow this guide: https://www.elastic.co/blog/grokking-the-linux-authorization-logs I cannot enable system using following command: filebeat -e -setup -modules=system I cannot install dashboards usin… --- ## [MySQL Required Privileges?](https://discuss.elastic.co/t/mysql-required-privileges/118530)
**Author:** [@weldon](https://discuss.elastic.co/u/weldon)\ **Replies:** 2\ **Last updated:** [February 5, 2018, 11:36pm UTC](https://discuss.elastic.co/t/mysql-required-privileges/118530 "2018-02-05T23:36:53Z")
I'm new to elastic and metricbeat, but I'd like to set up the mysql module with a user account that has the least required privileges. The example shows "root@" and the question about privileges was never answered in thi… --- ## [Filebeat holds on to a file descriptor too long even after a file was deleted?](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long-even-after-a-file-was-deleted/117731)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 8\ **Last updated:** [February 5, 2018, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long-even-after-a-file-was-deleted/117731 "2018-02-05T20:26:55Z")
Hello, filebeat experts, I reported a similar problem before in Filebeat might erroneously hold on to the file descriptor? thanks @steffens for the tips! I added the following to our config file back then, which worked… --- ## [Recursive glob patterns syntax help](https://discuss.elastic.co/t/recursive-glob-patterns-syntax-help/117885)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 4\ **Last updated:** [February 5, 2018, 6:30pm UTC](https://discuss.elastic.co/t/recursive-glob-patterns-syntax-help/117885 "2018-02-05T18:30:42Z")
Hello, I was attempting this pattern - input\_type: log paths: - /apps/log/\*\*/catalina.out multiline.pattern: '^\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}' multiline.negate: true multiline.match: after fields\_under\_root… --- ## [How to include metrics for a specific process when using process.include\_top\_n](https://discuss.elastic.co/t/how-to-include-metrics-for-a-specific-process-when-using-process-include-top-n/118483)
**Author:** [@Vishnu59](https://discuss.elastic.co/u/Vishnu59)\ **Replies:** 1\ **Last updated:** [February 5, 2018, 4:06pm UTC](https://discuss.elastic.co/t/how-to-include-metrics-for-a-specific-process-when-using-process-include-top-n/118483 "2018-02-05T16:06:56Z")
Hi, I have a requirement, where I will need to collect data for top 10 resource consuming processes on the VM along with having to collect resource utilization data for metricbeat. First part was pretty simple, but when… --- ## [Custom Application Eventlog not picked up by winlogbeat](https://discuss.elastic.co/t/custom-application-eventlog-not-picked-up-by-winlogbeat/118117)
**Author:** [@Paul\_Cadd](https://discuss.elastic.co/u/Paul_Cadd)\ **Replies:** 8\ **Last updated:** [February 5, 2018, 3:51pm UTC](https://discuss.elastic.co/t/custom-application-eventlog-not-picked-up-by-winlogbeat/118117 "2018-02-05T15:51:43Z")
Hi, Wonder if some one could assist with problem I have Background: We have logstash 5.4.1 installed on a three node cluster and 80 clients, servers and workstations. All workstations are configured for winlogbeat to … --- ## [Difference between "filebeat setup" and "filebeat --setup"](https://discuss.elastic.co/t/difference-between-filebeat-setup-and-filebeat-setup/117307)
**Author:** [@NiceGuyIT](https://discuss.elastic.co/u/NiceGuyIT)\ **Replies:** 6\ **Last updated:** [February 5, 2018, 3:32pm UTC](https://discuss.elastic.co/t/difference-between-filebeat-setup-and-filebeat-setup/117307 "2018-02-05T15:32:00Z")
According to the docs, filebeat setup is the same as filebeat --setup except that filebeat --setup keeps running while filebeat setup runs the setup and exits. filebeat setup Sets up the initial environment, including… --- ## [Prospector "fields" values being overwritten](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423)
**Author:** [@Aceman87](https://discuss.elastic.co/u/Aceman87)\ **Replies:** 4\ **Last updated:** [February 5, 2018, 1:54pm UTC](https://discuss.elastic.co/t/prospector-fields-values-being-overwritten/118423 "2018-02-05T13:54:39Z")
Hi, We have a Filebeat config that has two prospectors. Both prospectors define their own tags and "fields" values. However, the fields values of the first prospector are being overwritten by the values of the second pr… --- ## [Single Event Not Parsed Correctly](https://discuss.elastic.co/t/single-event-not-parsed-correctly/117505)
**Author:** [@cappy](https://discuss.elastic.co/u/cappy)\ **Replies:** 10\ **Last updated:** [February 5, 2018, 1:46pm UTC](https://discuss.elastic.co/t/single-event-not-parsed-correctly/117505 "2018-02-05T13:46:38Z")
Hello, I currently have FB 5.6.5 running and performing multiline log matching for json with something like the following in filebeat.yml: multiline.pattern: '^{' multiline.negate: true multiline.match: after This mat… --- ## [Winlogbeat continuously crashes on Windows 2003 server](https://discuss.elastic.co/t/winlogbeat-continuously-crashes-on-windows-2003-server/73076)
**Author:** [@gregva](https://discuss.elastic.co/u/gregva)\ **Replies:** 15\ **Last updated:** [February 2, 2018, 5:50pm UTC](https://discuss.elastic.co/t/winlogbeat-continuously-crashes-on-windows-2003-server/73076 "2018-02-02T17:50:44Z")
Hello, we need to support Win 2003 servers while we migrate the app over to a new stack. Winlogbeat continuously crash on these boxes. There are 4 app servers. Two are clones of the first one. The fourth was built s… --- ## [\[Metricbeat System\] Host overview does not display correct disk usage](https://discuss.elastic.co/t/metricbeat-system-host-overview-does-not-display-correct-disk-usage/115319)
**Author:** [@garin](https://discuss.elastic.co/u/garin)\ **Replies:** 2\ **Last updated:** [February 5, 2018, 1:02pm UTC](https://discuss.elastic.co/t/metricbeat-system-host-overview-does-not-display-correct-disk-usage/115319 "2018-02-05T13:02:04Z")
When I view \[Metricbeat System\] Host overview , all the file paths give the same percentage number. I noticed that system.filesystem.used.pct is set to 0.18 for every single system.filesystem.mount\_point that contain… --- ## [Should Metricbeat Kafka module consumergroup now bee working?](https://discuss.elastic.co/t/should-metricbeat-kafka-module-consumergroup-now-bee-working/118038)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 2\ **Last updated:** [February 5, 2018, 8:59am UTC](https://discuss.elastic.co/t/should-metricbeat-kafka-module-consumergroup-now-bee-working/118038 "2018-02-05T08:59:53Z")
I've found the ticket for #5880 but can't work out from that whether I'm supposed to be seeing consumergroup working or not (Metricbeat 5.6.7, Kafka 1.0.0). So is it (a) yes, it should be working, I'm doing something… --- ## [Best practice for setting index names when using filebeats to logstash](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597)
**Author:** [@David\_Gidony](https://discuss.elastic.co/u/David_Gidony)\ **Replies:** 2\ **Last updated:** [February 4, 2018, 10:33am UTC](https://discuss.elastic.co/t/best-practice-for-setting-index-names-when-using-filebeats-to-logstash/117597 "2018-02-04T10:33:44Z")
hi, i a monitoring a log directory with filebeats, this directory has severl log files, how can i send a specific log file to a specific index in elasticsearch when going through logstash? fileBeats settings: filebeat… --- ## [Metric beat system metrics](https://discuss.elastic.co/t/metric-beat-system-metrics/118177)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 5:13pm UTC](https://discuss.elastic.co/t/metric-beat-system-metrics/118177 "2018-02-02T17:13:19Z")
I am using metric beat to get the system metrics using system module. I started the metric beat on all required nodes and metric data is coming properly to elastic search and able to see the data using default dashboard… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=473) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=475)