# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=479 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 480 --- ## [Confining Beats (aka SELinux policy for beats on EL)](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043)
**Author:** [@fuero0](https://discuss.elastic.co/u/fuero0)\ **Replies:** 3\ **Last updated:** [January 18, 2018, 4:15pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043 "2018-01-18T16:15:36Z")
Hi, I'm evaluating filebeat and auditbeat (plus the contributed journalbeat) as log shippers for our environment. I had a look at the EL packages supplied by Elasticsearch and noticed that a suitable SELinux policy was … --- ## [Logs event order mismatch](https://discuss.elastic.co/t/logs-event-order-mismatch/114896)
**Author:** [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)\ **Replies:** 3\ **Last updated:** [January 18, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logs-event-order-mismatch/114896 "2018-01-18T13:59:03Z")
Am using 5LK 5.6.4. Beats =\> Logstash =\> ElasticSearch =\>Kibana I am collets server logs(using grok and mutate filter) and another one, I parse the whole XML in ELK(using multiline and XML filter plugin). For Log: Whi… --- ## [Filebeat permission denied docker sock](https://discuss.elastic.co/t/filebeat-permission-denied-docker-sock/116024)
**Author:** [@twan](https://discuss.elastic.co/u/twan)\ **Replies:** 4\ **Last updated:** [January 18, 2018, 1:19pm UTC](https://discuss.elastic.co/t/filebeat-permission-denied-docker-sock/116024 "2018-01-18T13:19:07Z")
Hi all! I've encountered an issue with the filebeat 6.1.2 docker when using the add Docker metadata processor. When I turn this on in the filebeat configuration the following error appears: 2018/01/18 10:42:36.931693 b… --- ## [Distributing custom beats?](https://discuss.elastic.co/t/distributing-custom-beats/114313)
**Author:** [@Grigory\_Shamov1](https://discuss.elastic.co/u/Grigory_Shamov1)\ **Replies:** 3\ **Last updated:** [January 18, 2018, 12:59pm UTC](https://discuss.elastic.co/t/distributing-custom-beats/114313 "2018-01-18T12:59:57Z")
Hi All, Is there a best practice on how to distribute custom beats Sources, including the right Golang dependencies? Right now, it is kind of hard, because of Beats library having complex build mechanism. It gives a ni… --- ## [Filebeat filter message for specific path](https://discuss.elastic.co/t/filebeat-filter-message-for-specific-path/115954)
**Author:** [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)\ **Replies:** 1\ **Last updated:** [January 18, 2018, 11:58am UTC](https://discuss.elastic.co/t/filebeat-filter-message-for-specific-path/115954 "2018-01-18T11:58:13Z")
Hi , I am using filebeat-5.6.3 with the below filebeat config i am able to drop the events which doesn't have "testing2" or "testing1" in the message field of path "/var/log/messages" drop the events which doesn't h… --- ## [Filebeat deployment in Kubernetes/Docker](https://discuss.elastic.co/t/filebeat-deployment-in-kubernetes-docker/113759)
**Author:** [@Asher\_Shoshan](https://discuss.elastic.co/u/Asher_Shoshan)\ **Replies:** 26\ **Last updated:** [January 18, 2018, 8:51am UTC](https://discuss.elastic.co/t/filebeat-deployment-in-kubernetes-docker/113759 "2018-01-18T08:51:37Z")
General guidelines for deploying Filebeat in Docker/Kubernetes is to run one instance (container) of Filebeat (in each Kubernetes node), and to harvest logs located in "/var/lib/docker/containers//.log". However, I can'… --- ## [Cannot load field "CommandLine" into a "string": unsupported type](https://discuss.elastic.co/t/cannot-load-field-commandline-into-a-string-unsupported-type/115897)
**Author:** [@Tonni\_Hult](https://discuss.elastic.co/u/Tonni_Hult)\ **Replies:** 2\ **Last updated:** [January 18, 2018, 8:02am UTC](https://discuss.elastic.co/t/cannot-load-field-commandline-into-a-string-unsupported-type/115897 "2018-01-18T08:02:02Z")
Hi I've installed the version 6.1.1 of metricbeat on Win2012R2 but we get a lot of these errors in the log 2018-01-17T15:25:21+01:00 ERR Error getting process details. pid=4672: error getting process arguments for pid… --- ## [How to configure filebeat template](https://discuss.elastic.co/t/how-to-configure-filebeat-template/115855)
**Author:** [@zhangrandl](https://discuss.elastic.co/u/zhangrandl)\ **Replies:** 9\ **Last updated:** [January 18, 2018, 1:54am UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-template/115855 "2018-01-18T01:54:27Z")
HI， I'm setting up a Filebeat with elasticsearch output, when i setting two index , I setting two template in filebeat.yml setup.template.name: "nginx" setup.template.overwrite: false setup.template.pattern: "nginx-\*"… --- ## [Adding the File Version resource to the Windows executable for all Beats](https://discuss.elastic.co/t/adding-the-file-version-resource-to-the-windows-executable-for-all-beats/115779)
**Author:** [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Replies:** 3\ **Last updated:** [January 17, 2018, 3:24pm UTC](https://discuss.elastic.co/t/adding-the-file-version-resource-to-the-windows-executable-for-all-beats/115779 "2018-01-17T15:24:53Z")
I brought this up 16 months ago with v5.4.1 In order to monitor the versions of beats I have installed on windows servers, I would like the File version added to the Windows binary of all beats. I understand I can run … --- ## [Metricbeat setup dashboards fails](https://discuss.elastic.co/t/metricbeat-setup-dashboards-fails/115864)
**Author:** [@jamesliu\_london](https://discuss.elastic.co/u/jamesliu_london)\ **Replies:** 1\ **Last updated:** [January 17, 2018, 11:37am UTC](https://discuss.elastic.co/t/metricbeat-setup-dashboards-fails/115864 "2018-01-17T11:37:34Z")
kibana 5.0.3 metricbeat6.0.1 metricbeat setup --dashboards INFO Kibana url: http://:5601 2018-01-17T10:27:56Z CRIT Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana c… --- ## [Stashing my first pipeline with Filebeat and Logstash](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828)
**Author:** [@Suryakumar](https://discuss.elastic.co/u/Suryakumar)\ **Replies:** 2\ **Last updated:** [January 17, 2018, 7:11am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828 "2018-01-17T07:11:36Z")
Hi, I have just started using elasticsearch. I am now trying the first example with Filebeats and logstash as given in this tutorial : \[https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html.\] I am fac… --- ## [Kibana 5.6 - Error importing Kibana dashboards: fail to get the Kibana version](https://discuss.elastic.co/t/kibana-5-6-error-importing-kibana-dashboards-fail-to-get-the-kibana-version/115365)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 2\ **Last updated:** [January 17, 2018, 2:19am UTC](https://discuss.elastic.co/t/kibana-5-6-error-importing-kibana-dashboards-fail-to-get-the-kibana-version/115365 "2018-01-17T02:19:48Z")
for some reason I cannot load the sample dashboard, and ideas on how I can fix this? I am using kibana 5.6 ansible@atlas01:~$ sudo /usr/share/auditbeat/bin/auditbeat setup -E setup.dashboards.kibana\_index=.kibana-5.x -E… --- ## [System diskio positive selection](https://discuss.elastic.co/t/system-diskio-positive-selection/115536)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [January 17, 2018, 12:48am UTC](https://discuss.elastic.co/t/system-diskio-positive-selection/115536 "2018-01-17T00:48:52Z")
Wondering if it's possible to config system.diskio to only sample selected devices rather than all 'mounted disks' a bit like filesystem.ignore\_types? filters.drop\_event.regexp is ImHO a negative list, I'll rather do a … --- ## [Multi-field on CommandLine in Winlogbeat](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 5\ **Last updated:** [January 16, 2018, 10:10pm UTC](https://discuss.elastic.co/t/multi-field-on-commandline-in-winlogbeat/113810 "2018-01-16T22:10:47Z")
I'm working with Winlogbeat and I need event\_data.CommandLine field to 'text' so I can run 'term' query on it and look for badness, I guess multi-fields is the way to go to add another field as text... Trying to get my … --- ## [IDS based on windows logs](https://discuss.elastic.co/t/ids-based-on-windows-logs/115748)
**Author:** [@cbastone1](https://discuss.elastic.co/u/cbastone1)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 7:30pm UTC](https://discuss.elastic.co/t/ids-based-on-windows-logs/115748 "2018-01-16T19:30:39Z")
Hello everyone, I m new in ELK. I would realize an intrusion detection system based on windows logs. I thought I could use machine learning x-pack, but creating multi metric job I don t know which fields I have to use t… --- ## [Could not locate that index-pattern-field (id: count) on Packetbeat](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-count-on-packetbeat/115435)
**Author:** [@Luan\_Ha\_Thanh](https://discuss.elastic.co/u/Luan_Ha_Thanh)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 6:34pm UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-field-id-count-on-packetbeat/115435 "2018-01-16T18:34:33Z")
Hi all. I 'm a newbie for Kibana and Elasticsearch. I want to monitor MongoDB server by Packetbeat. My enviroment: Kibana 5.6.5. Elasticsearch 5.6.5. Packetbeat 5.6.5 (default configuration). But it's not successfully… --- ## [Condition with decode\_json\_fields processor](https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093)
**Author:** [@jochenchrist](https://discuss.elastic.co/u/jochenchrist)\ **Replies:** 9\ **Last updated:** [January 16, 2018, 6:18pm UTC](https://discuss.elastic.co/t/condition-with-decode-json-fields-processor/115093 "2018-01-16T18:18:46Z")
Hi, I try to collect docker logs with filebeats 6.1. The application logs are written as JSON, which I want to decode with decode\_json\_fields processor. Spring Boot's Bootstrapping also writes some plain log messages,… --- ## [Unable to Parse HTTP Logs when the remote IP is empty](https://discuss.elastic.co/t/unable-to-parse-http-logs-when-the-remote-ip-is-empty/115375)
**Author:** [@abhilashusha](https://discuss.elastic.co/u/abhilashusha)\ **Replies:** 2\ **Last updated:** [January 16, 2018, 5:55pm UTC](https://discuss.elastic.co/t/unable-to-parse-http-logs-when-the-remote-ip-is-empty/115375 "2018-01-16T17:55:45Z")
HTTP Parsing fails Grok Pattern Working Logs 172.27.81.113, 192.34.56.67 - - \[07/Jan/2018:19:00:30 -0500\] RspTime= 555 microsecond + "GET / HTTP/1.1" 200 3493 - "-" "-" GrokPattern Non Working Log - - - \[07/Jan/2018:… --- ## [Winlogbeat modified to Text and Keyword](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 5:11pm UTC](https://discuss.elastic.co/t/winlogbeat-modified-to-text-and-keyword/115754 "2018-01-16T17:11:37Z")
I modified winlogbeat template - Current - { "winlogbeat-2018.01.02": { "mappings": { "doc": { "event\_data.CommandLine": { "full\_name": "event\_data.CommandLine", "mapping": { … --- ## [Connection Refused for Metricbeat \<-\> ES on Docker](https://discuss.elastic.co/t/connection-refused-for-metricbeat-es-on-docker/115596)
**Author:** [@laubnyc](https://discuss.elastic.co/u/laubnyc)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 3:58pm UTC](https://discuss.elastic.co/t/connection-refused-for-metricbeat-es-on-docker/115596 "2018-01-16T15:58:25Z")
I am trying to use metricbeat and ES in a docker environment. Both are running, but not communicating. Here are the docker logs for the docker containing the metricbeat image: 2018/01/15 19:45:11.260059 beat.go:426: INF… --- ## [Possible to override beat.hostname in local metricbeat](https://discuss.elastic.co/t/possible-to-override-beat-hostname-in-local-metricbeat/115116)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [January 16, 2018, 9:27am UTC](https://discuss.elastic.co/t/possible-to-override-beat-hostname-in-local-metricbeat/115116 "2018-01-16T09:27:02Z")
I wondered if I could override default value of beat.hostname in metricbeat.yml as I have classing short hostnames? --- ## [Unable to read webogic logs](https://discuss.elastic.co/t/unable-to-read-webogic-logs/115018)
**Author:** [@shiva.thota](https://discuss.elastic.co/u/shiva.thota)\ **Replies:** 6\ **Last updated:** [January 16, 2018, 9:21am UTC](https://discuss.elastic.co/t/unable-to-read-webogic-logs/115018 "2018-01-16T09:21:26Z")
Hi All, I am new to filebeat and am trying to configure ELK stack. Right now I have configured filebeat to read from weblogic logs. But am unable to read anything from the logs. Below are the configuration details. Ple… --- ## [Filebeat on RHEL5.x?](https://discuss.elastic.co/t/filebeat-on-rhel5-x/115306)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 4:19am UTC](https://discuss.elastic.co/t/filebeat-on-rhel5-x/115306 "2018-01-16T04:19:48Z")
Hi, I saw that filebeat is not available for RHEL 5.x. Is it just not tested or does it not work? We are planing to introduce elastics stack to an older project. Unfortunately some machines are still running on RHEL 5… --- ## [Deploy filebeat in docker using a custom Dockerfile with a entry script](https://discuss.elastic.co/t/deploy-filebeat-in-docker-using-a-custom-dockerfile-with-a-entry-script/115530)
**Author:** [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)\ **Replies:** 2\ **Last updated:** [January 15, 2018, 4:57pm UTC](https://discuss.elastic.co/t/deploy-filebeat-in-docker-using-a-custom-dockerfile-with-a-entry-script/115530 "2018-01-15T16:57:31Z")
Hello, I am deploying my custom config filebeat using docker with the following docker file. FROM docker.elastic.co/beats/filebeat:5.6.3 COPY filebeat.yml /usr/share/filebeat/filebeat.yml USER root RUN chown filebea… --- ## [Filebeat uses internal dns name of Kafka Broker](https://discuss.elastic.co/t/filebeat-uses-internal-dns-name-of-kafka-broker/115407)
**Author:** [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)\ **Replies:** 2\ **Last updated:** [January 15, 2018, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-uses-internal-dns-name-of-kafka-broker/115407 "2018-01-15T13:50:54Z")
Hello, We are trying to harvest csv data using filebeat to Elasticsearch. Data pipeline is set up to stream to Kafka -\> Logstash -\> Elasticsearch. We have a hybrid cloud setup of corporate cloud data center and aws. fi… --- ## [Filebeat as sidecar deployment in K8 cluster](https://discuss.elastic.co/t/filebeat-as-sidecar-deployment-in-k8-cluster/114796)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 5\ **Last updated:** [January 15, 2018, 10:54am UTC](https://discuss.elastic.co/t/filebeat-as-sidecar-deployment-in-k8-cluster/114796 "2018-01-15T10:54:23Z")
HI , So am using spinnaker for deployment of our microservices to Kubernetes cluster. How to use filebeat as a sidecar pattern with other application to deploy simultaneously? --- ## [Performing Stress Tests for winlogbeats](https://discuss.elastic.co/t/performing-stress-tests-for-winlogbeats/114013)
**Author:** [@Mazhar](https://discuss.elastic.co/u/Mazhar)\ **Replies:** 1\ **Last updated:** [January 15, 2018, 8:47am UTC](https://discuss.elastic.co/t/performing-stress-tests-for-winlogbeats/114013 "2018-01-15T08:47:14Z")
I need to perform the following as part of Stress Test for using winlogbeats as part of ingesting data from windows end devices, a. Bandwidth Utilization b. Resource Utilization c. Compression Ratio d. Caching (Thres… --- ## [Parsing-log-files-with-filebeat-and-sending-them-to-elasticsearch](https://discuss.elastic.co/t/parsing-log-files-with-filebeat-and-sending-them-to-elasticsearch/115256)
**Author:** [@anson\_ch](https://discuss.elastic.co/u/anson_ch)\ **Replies:** 1\ **Last updated:** [January 12, 2018, 12:40pm UTC](https://discuss.elastic.co/t/parsing-log-files-with-filebeat-and-sending-them-to-elasticsearch/115256 "2018-01-12T12:40:17Z")
hello, i use logback print log in my java application. i want use filebeat to parse my many different log files, which are using different format. but i don't want to ship log to logstash, because it is not lightweight.a… --- ## [Multiple prospectors vs. More work in pipeline](https://discuss.elastic.co/t/multiple-prospectors-vs-more-work-in-pipeline/115076)
**Author:** [@domisan](https://discuss.elastic.co/u/domisan)\ **Replies:** 2\ **Last updated:** [January 12, 2018, 8:35am UTC](https://discuss.elastic.co/t/multiple-prospectors-vs-more-work-in-pipeline/115076 "2018-01-12T08:35:03Z")
Hi, I have a design question. Let's say I have 1 filebeat process to monitor X log-files. The log-data is sent to ES through a pipeline. The pipeline is anyway required for date/timestamp processing. The data when s… --- ## [Metricbeat jolokia problem using wildcard](https://discuss.elastic.co/t/metricbeat-jolokia-problem-using-wildcard/114943)
**Author:** [@belingueres](https://discuss.elastic.co/u/belingueres)\ **Replies:** 1\ **Last updated:** [January 11, 2018, 10:43pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-problem-using-wildcard/114943 "2018-01-11T22:43:45Z")
Hi: I configured jolokia to get metrics on a Tomcat 7 ThreadPool. The configuration included the wildcard (\*) to avoid to specify the pool name (which changes from Tomcat 7 to Tomcat 8) this way: module: jolokia m… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=478) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=480)