# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=478 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 479 --- ## [Installing the metricbeat service, It shows notepad, not starting the service](https://discuss.elastic.co/t/installing-the-metricbeat-service-it-shows-notepad-not-starting-the-service/116597)
**Author:** [@Hari\_Baskar](https://discuss.elastic.co/u/Hari_Baskar)\ **Replies:** 1\ **Last updated:** [January 23, 2018, 2:38pm UTC](https://discuss.elastic.co/t/installing-the-metricbeat-service-it-shows-notepad-not-starting-the-service/116597 "2018-01-23T14:38:25Z")
Hi, When installing the metricbeat, it opens the notepad, not installing the service. So, How to install without this issue. --- ## [Beat generator support matrix](https://discuss.elastic.co/t/beat-generator-support-matrix/116659)
**Author:** [@rkshprb](https://discuss.elastic.co/u/rkshprb)\ **Replies:** 1\ **Last updated:** [January 23, 2018, 2:22pm UTC](https://discuss.elastic.co/t/beat-generator-support-matrix/116659 "2018-01-23T14:22:16Z")
Is beat generator available for HP-UX ? --- ## [Metricbeat java](https://discuss.elastic.co/t/metricbeat-java/116680)
**Author:** [@rkshprb](https://discuss.elastic.co/u/rkshprb)\ **Replies:** 1\ **Last updated:** [January 23, 2018, 2:14pm UTC](https://discuss.elastic.co/t/metricbeat-java/116680 "2018-01-23T14:14:57Z")
Is java required for metricbeats ? --- ## [Filebeat 6.0.0 spawns 3 identical processes when sudo-ed](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507)
**Author:** [@Haribo](https://discuss.elastic.co/u/Haribo)\ **Replies:** 4\ **Last updated:** [January 23, 2018, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-6-0-0-spawns-3-identical-processes-when-sudo-ed/116507 "2018-01-23T13:55:12Z")
Hello, I am using Filebeat to send my application logs to a remote Logstash. While testing, I ran ps -aux | grep filebeat and I noticed that starting Filebeat effectively started 3 processes : $ sudo filebeat -e -c /e… --- ## ["\[pipeline\] required property is missing"](https://discuss.elastic.co/t/pipeline-required-property-is-missing/115569)
**Author:** [@tkzv](https://discuss.elastic.co/u/tkzv)\ **Replies:** 12\ **Last updated:** [January 23, 2018, 10:18am UTC](https://discuss.elastic.co/t/pipeline-required-property-is-missing/115569 "2018-01-23T10:18:45Z")
I need to monitor exchange between 2 servers. I'm trying to use Packetbeat + Elasticsearch for that (without ). I keep getting warnings in the log: client.go:465: WARN Can not index event (status=400): {"type":"mapper\_… --- ## [Filebeat process with \`logging.json = true\` does not emit pure JSON to stdout](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522)
**Author:** [@cdaringe](https://discuss.elastic.co/u/cdaringe)\ **Replies:** 6\ **Last updated:** [January 22, 2018, 9:35pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522 "2018-01-22T21:35:08Z")
Hi all: I am using filebeat in docker. I use it to send all my containers' logs from /some/docker/dir/\*-json.log to logstash. To make this work simply, I configure all of my services to write single-line, JSON log mes… --- ## [Aggregating and sending multiple error logs to FileBeat 6](https://discuss.elastic.co/t/aggregating-and-sending-multiple-error-logs-to-filebeat-6/116405)
**Author:** [@Revekius](https://discuss.elastic.co/u/Revekius)\ **Replies:** 9\ **Last updated:** [January 22, 2018, 6:29pm UTC](https://discuss.elastic.co/t/aggregating-and-sending-multiple-error-logs-to-filebeat-6/116405 "2018-01-22T18:29:10Z")
Hi, I have a WHM server with multiple accounts. On each account I have error logs from PHP. I would like to send all error logs to FileBeat for processing and reading. There is a big issue though... I don't know where … --- ## [Filebeat 6.1 in Kubernetes - unable to fetch logs from new pods](https://discuss.elastic.co/t/filebeat-6-1-in-kubernetes-unable-to-fetch-logs-from-new-pods/116503)
**Author:** [@thesilence](https://discuss.elastic.co/u/thesilence)\ **Replies:** 6\ **Last updated:** [January 22, 2018, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-6-1-in-kubernetes-unable-to-fetch-logs-from-new-pods/116503 "2018-01-22T17:45:50Z")
Filebeat version: 6.1.2 Kubernetes nodes are running on Google's GKE Kubernetes version: 1.8.5-gke.0 Context We are following the instructions in https://www.elastic.co/guide/en/beats/filebeat/6.1/running-on-kubernet… --- ## [Filebeat field depending on Path](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480)
**Author:** [@OptiFine](https://discuss.elastic.co/u/OptiFine)\ **Replies:** 3\ **Last updated:** [January 22, 2018, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480 "2018-01-22T16:40:04Z")
Hi, I am trying to add a specific field which will be varying depending on path. I have logs coming from 6 different environment respectively 'prod', '101', '102', '201', '202', '301'. It is planned to add an other one… --- ## [Metricbeats](https://discuss.elastic.co/t/metricbeats/116228)
**Author:** [@Ninoslav](https://discuss.elastic.co/u/Ninoslav)\ **Replies:** 4\ **Last updated:** [January 22, 2018, 3:45pm UTC](https://discuss.elastic.co/t/metricbeats/116228 "2018-01-22T15:45:36Z")
Hi, I have installed metricbeats on server, and configured index, so i have output in kibana... But what ever i do to set up dashboard in kibana fails. If I try to do: setup.dashboards.enabled: true in metricbeat.yml… --- ## [How to write processors?](https://discuss.elastic.co/t/how-to-write-processors/115458)
**Author:** [@benben](https://discuss.elastic.co/u/benben)\ **Replies:** 5\ **Last updated:** [January 22, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-write-processors/115458 "2018-01-22T14:59:21Z")
Hi, I recently wrote a new beat for serial data, called serialbeat. Now I want to add a processor to this beat, which does a few things with the data before sending it somewhere. Is there any documentation on how to wri… --- ## [Filebeat and Magento2 reports](https://discuss.elastic.co/t/filebeat-and-magento2-reports/116226)
**Author:** [@sergiu.tot](https://discuss.elastic.co/u/sergiu.tot)\ **Replies:** 2\ **Last updated:** [January 22, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-and-magento2-reports/116226 "2018-01-22T09:22:22Z")
Hello guys, I have a Magento2 instance for which I collect the logs using prospectors in filebeat-5.2.1. This is happening on a docker container based on ubuntu xenial (16.04). The Magento2 report is a valid json file … --- ## [Filebeat Process not clearing after STDIN input stops](https://discuss.elastic.co/t/filebeat-process-not-clearing-after-stdin-input-stops/115740)
**Author:** [@Vignesh\_Kumar\_A](https://discuss.elastic.co/u/Vignesh_Kumar_A)\ **Replies:** 3\ **Last updated:** [January 21, 2018, 11:54pm UTC](https://discuss.elastic.co/t/filebeat-process-not-clearing-after-stdin-input-stops/115740 "2018-01-21T23:54:50Z")
I am running mesos external logger. In that I am creating dynamic filebeat processes per container. This process will forward logs to Graylog. The container when it is terminated, the STDIN content will stop flowing. The… --- ## [Filebeat 5.6 error](https://discuss.elastic.co/t/filebeat-5-6-error/114602)
**Author:** [@Samuel\_Miller](https://discuss.elastic.co/u/Samuel_Miller)\ **Replies:** 2\ **Last updated:** [January 21, 2018, 9:43pm UTC](https://discuss.elastic.co/t/filebeat-5-6-error/114602 "2018-01-21T21:43:50Z")
I'm seeing the error below, it looks extremely similar to Error when reloading prospectors for filebeat - #7 by ruflin (Filebeat: Live Reload incorrectly stops prospectors · Issue #4133 · elastic/beats · GitHub) , which… --- ## [Filebeat.yml file configuration - Any major changes needed between FB 5.5 to FB 6.1?](https://discuss.elastic.co/t/filebeat-yml-file-configuration-any-major-changes-needed-between-fb-5-5-to-fb-6-1/114260)
**Author:** [@FreddyRaj](https://discuss.elastic.co/u/FreddyRaj)\ **Replies:** 2\ **Last updated:** [January 20, 2018, 8:21am UTC](https://discuss.elastic.co/t/filebeat-yml-file-configuration-any-major-changes-needed-between-fb-5-5-to-fb-6-1/114260 "2018-01-20T08:21:04Z")
Hi Team, When setting up filebeat in lower environment we used filebeat 5.5 version and now we are planning to move to filebeat 6.1.0. My question is to understand if there is any major configuration change that we nee… --- ## [Can we have a regex to only get 2 or 3 level deep urls from a nginx logs, before passing them on](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310)
**Author:** [@gokhalep](https://discuss.elastic.co/u/gokhalep)\ **Replies:** 1\ **Last updated:** [January 20, 2018, 3:06am UTC](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310 "2018-01-20T03:06:50Z")
I am using filebeat to get the nginx logs and pass them to the "wavefront" Now the log line in nginx looks like this: - - \[09/Jan/2018:09:16:07 +0000\] "GET /abc/def/ghi/jkl/mnop? HTTP/1.1" 200 4471 "http://:8000" "Serv… --- ## [Why is the type of system.cpu.total.norm.pct is long?](https://discuss.elastic.co/t/why-is-the-type-of-system-cpu-total-norm-pct-is-long/116241)
**Author:** [@HelloUniverse](https://discuss.elastic.co/u/HelloUniverse)\ **Replies:** 2\ **Last updated:** [January 20, 2018, 2:07am UTC](https://discuss.elastic.co/t/why-is-the-type-of-system-cpu-total-norm-pct-is-long/116241 "2018-01-20T02:07:03Z")
I used metricbeat to fetch cpu& process cpu metrics to elasticsearch. When trying to get the system.cpu.total.norm.pct usage by aggregation, it always get 0. I typed the query in kibana and found that within the tips t… --- ## [SSL configured in Beat but ES gives io.netty.handler.ssl.NotSslRecordException](https://discuss.elastic.co/t/ssl-configured-in-beat-but-es-gives-io-netty-handler-ssl-notsslrecordexception/115421)
**Author:** [@Flaviu](https://discuss.elastic.co/u/Flaviu)\ **Replies:** 3\ **Last updated:** [January 19, 2018, 9:02pm UTC](https://discuss.elastic.co/t/ssl-configured-in-beat-but-es-gives-io-netty-handler-ssl-notsslrecordexception/115421 "2018-01-19T21:02:06Z")
Hello, I see every ~10 seconds the following elasticsearch error message: \[2018-01-13T22:38:41,877\]\[WARN \]\[o.e.x.s.t.n.SecurityNetty4HttpServerTransport\] \[QNk3RNV\] caught exception while handling client http traffic, … --- ## [Metricbeat failed to start at system reboot](https://discuss.elastic.co/t/metricbeat-failed-to-start-at-system-reboot/116256)
**Author:** [@ijazadm](https://discuss.elastic.co/u/ijazadm)\ **Replies:** 5\ **Last updated:** [January 19, 2018, 8:32pm UTC](https://discuss.elastic.co/t/metricbeat-failed-to-start-at-system-reboot/116256 "2018-01-19T20:32:29Z")
Hi , Metricbeat is running fine , and is enabled to start at system boot through systemd, rhel7. but when I reboot the system , it fails to start and I have to restart is manually. Any ideas? log: \[root@wp-p3s-2c ~\]… --- ## [Filebeats fields mapping to logstash](https://discuss.elastic.co/t/filebeats-fields-mapping-to-logstash/116274)
**Author:** [@danpoltawski](https://discuss.elastic.co/u/danpoltawski)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 7:47pm UTC](https://discuss.elastic.co/t/filebeats-fields-mapping-to-logstash/116274 "2018-01-19T19:47:36Z")
I'm currently evaluating using the elastic stack (6.1.2) and trying to get going with an initial basic config. I see that filebeat comes with some field mapping defined for the core modules (system/apache etc) and as far… --- ## [Filebeat does not correctly resolve container IP](https://discuss.elastic.co/t/filebeat-does-not-correctly-resolve-container-ip/115803)
**Author:** [@grantcurell](https://discuss.elastic.co/u/grantcurell)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-does-not-correctly-resolve-container-ip/115803 "2018-01-19T19:31:38Z")
I'm setting up a Filebeat container with Kafka output to another container on the same back end docker network. I can confirm the container itself appropriately resolve the kafka container with: \[root@rocksensor1 ~\]# do… --- ## [Filebeat INFO output - libbeat.pipeline.events.filtered](https://discuss.elastic.co/t/filebeat-info-output-libbeat-pipeline-events-filtered/115798)
**Author:** [@rkearsley](https://discuss.elastic.co/u/rkearsley)\ **Replies:** 6\ **Last updated:** [January 19, 2018, 4:55pm UTC](https://discuss.elastic.co/t/filebeat-info-output-libbeat-pipeline-events-filtered/115798 "2018-01-19T16:55:15Z")
Hello Watching filebeat run in the console with '-e' option, I can see it spitting out "INFO Non-zero metrics in the last 30s:" I looked closer at some of the values: beat.info.uptime.ms=29996 beat.memstats.gc\_next=2… --- ## [Filebeat is not closig the file descriptor, when the file is deleted/renamed](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-when-the-file-is-deleted-renamed/115819)
**Author:** [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 4:42pm UTC](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-when-the-file-is-deleted-renamed/115819 "2018-01-19T16:42:51Z")
Hi, We didnt had any conclusion on the file descriptor is hanging. FYI: https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-once-the-file-is-deleted- renamed/104077 Request to provide some solutio… --- ## [SSL certificate renewal](https://discuss.elastic.co/t/ssl-certificate-renewal/115762)
**Author:** [@albbapm](https://discuss.elastic.co/u/albbapm)\ **Replies:** 3\ **Last updated:** [January 19, 2018, 3:59pm UTC](https://discuss.elastic.co/t/ssl-certificate-renewal/115762 "2018-01-19T15:59:42Z")
I currently have SSL working between Winlogbeat 6.1.1 on a Windows 10 x64 computer and logstash 6.1.1 running on CentOS 7. The way I set it up was to request a new certificate from the local computer certificate store a… --- ## [Postgresql Module in Filebeat Not Getting Start](https://discuss.elastic.co/t/postgresql-module-in-filebeat-not-getting-start/114693)
**Author:** [@manya12](https://discuss.elastic.co/u/manya12)\ **Replies:** 14\ **Last updated:** [January 19, 2018, 3:49pm UTC](https://discuss.elastic.co/t/postgresql-module-in-filebeat-not-getting-start/114693 "2018-01-19T15:49:55Z")
Hi Team, I am trying to integrate postgresql logs in Kibana using postgres module. Here is my filebeat.yml ######################## Filebeat Configuration ############################ #========================== Modu… --- ## [Traefik module for filbeat don't parse traefik logs](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170)
**Author:** [@e8kor](https://discuss.elastic.co/u/e8kor)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 9:21am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170 "2018-01-19T09:21:48Z")
Log message example: 85.115.248.206 - - \[19/Jan/2018:06:08:56 +0000\] "GET /assets/513050f1e4b0a08cc2435786/valuation?oauth\_token=ya29.Gl0bBckbBUoFLYZtYEHu4\_7LWKAKfNkQpaM9P0FerOmiQXyjth9qOWw0NJjp9\_nocSPs2XA\_icHafiqbaT7oa… --- ## [Filebeat logs to logstash to kibana](https://discuss.elastic.co/t/filebeat-logs-to-logstash-to-kibana/115842)
**Author:** [@Firdaus](https://discuss.elastic.co/u/Firdaus)\ **Replies:** 9\ **Last updated:** [January 19, 2018, 10:18am UTC](https://discuss.elastic.co/t/filebeat-logs-to-logstash-to-kibana/115842 "2018-01-19T10:18:18Z")
I am using ELK and filebeat of version 6 and above. I have configured everything but struggling with seeing filebeat logs in kibana. If i put output as elasticsearch, i can see logs. But when I put as logstash in filebea… --- ## [Setup for kibana dashboards: fail to get the Kibana version](https://discuss.elastic.co/t/setup-for-kibana-dashboards-fail-to-get-the-kibana-version/114111)
**Author:** [@derikss](https://discuss.elastic.co/u/derikss)\ **Replies:** 5\ **Last updated:** [January 19, 2018, 8:21am UTC](https://discuss.elastic.co/t/setup-for-kibana-dashboards-fail-to-get-the-kibana-version/114111 "2018-01-19T08:21:55Z")
Hi, I get this error message when trying to import the dashboard for winlogbeat in to kibana. (winlogbeat-6.1.1-windows-x86\_64) .\\winlogbeat.exe setup --dashboards Exiting: Error importing Kibana dashboards: fail to … --- ## [Create new beat based on libbeat 6.1?](https://discuss.elastic.co/t/create-new-beat-based-on-libbeat-6-1/116051)
**Author:** [@cyrilleverrier](https://discuss.elastic.co/u/cyrilleverrier)\ **Replies:** 1\ **Last updated:** [January 18, 2018, 10:29pm UTC](https://discuss.elastic.co/t/create-new-beat-based-on-libbeat-6-1/116051 "2018-01-18T22:29:22Z")
Hi, What is/will be the preferred way of creating a new go application that uses libbeat 6.1? The official documentation says to generate the new project using the cookie cutter template: https://www.elastic.co/guide… --- ## [Not sending logs to logstash](https://discuss.elastic.co/t/not-sending-logs-to-logstash/112278)
**Author:** [@Nich240](https://discuss.elastic.co/u/Nich240)\ **Replies:** 17\ **Last updated:** [January 18, 2018, 9:14pm UTC](https://discuss.elastic.co/t/not-sending-logs-to-logstash/112278 "2018-01-18T21:14:49Z")
We are having issue sending logs from filebeat to logstash. We do not see the network connections being made, nor errors. There is no firewall between the two components. Filebeat registry is showing files being inges… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=477) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=479)