# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=482 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 483 --- ## [Filebeat exclude line not working :(](https://discuss.elastic.co/t/filebeat-exclude-line-not-working/113358)
**Author:** [@funtimes](https://discuss.elastic.co/u/funtimes)\ **Replies:** 6\ **Last updated:** [January 3, 2018, 11:13pm UTC](https://discuss.elastic.co/t/filebeat-exclude-line-not-working/113358 "2018-01-03T23:13:43Z")
Hello all! I've tried doing the best I can and research on my issue, however everything i've tried and research doesn't seem to work :frowning: Was hoping somebody on here might be able to help me out. I have a very si… --- ## [Exclude\_lines regex isn't working](https://discuss.elastic.co/t/exclude-lines-regex-isnt-working/112723)
**Author:** [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Replies:** 4\ **Last updated:** [January 3, 2018, 11:02pm UTC](https://discuss.elastic.co/t/exclude-lines-regex-isnt-working/112723 "2018-01-03T23:02:09Z")
I'm trying to exclude lines from apache log that contain /server-status?auto= within the line. It's a standard apache combined log file. exclude\_lines expressions I've tried: \['(?i:/server-status?auto=)'\] \['.server-st… --- ## [Unable to receive the log from filebeat to kafka](https://discuss.elastic.co/t/unable-to-receive-the-log-from-filebeat-to-kafka/113224)
**Author:** [@saravana\_ganesh](https://discuss.elastic.co/u/saravana_ganesh)\ **Replies:** 4\ **Last updated:** [January 3, 2018, 10:58pm UTC](https://discuss.elastic.co/t/unable-to-receive-the-log-from-filebeat-to-kafka/113224 "2018-01-03T22:58:49Z")
Hi, We are using kafka 2.12 and configure the output as below in the filebeat. filebeat.prospectors: type: log enabled: false paths: /var/log/\*.log #============================= Filebeat modules ============… --- ## [Vsphere module delivers inaccurate data](https://discuss.elastic.co/t/vsphere-module-delivers-inaccurate-data/111708)
**Author:** [@Robert\_Schultz](https://discuss.elastic.co/u/Robert_Schultz)\ **Replies:** 5\ **Last updated:** [January 3, 2018, 10:57pm UTC](https://discuss.elastic.co/t/vsphere-module-delivers-inaccurate-data/111708 "2018-01-03T22:57:16Z")
Hello everyone! I am fetching vsphere metrics from 2 different vsphere hosts, containing 5 different datacenter. - module: vsphere metricsets: \["host" , "virtualmachine"\] period: 10s hosts: \["https://vcenter.host… --- ## [SSL to logstash doesnt seem to work](https://discuss.elastic.co/t/ssl-to-logstash-doesnt-seem-to-work/113462)
**Author:** [@Zach\_Lewis](https://discuss.elastic.co/u/Zach_Lewis)\ **Replies:** 5\ **Last updated:** [January 3, 2018, 10:40pm UTC](https://discuss.elastic.co/t/ssl-to-logstash-doesnt-seem-to-work/113462 "2018-01-03T22:40:50Z")
I tired to setup winlogbeat to forward some windows events off to logstash but it seems there might be a bug in winlogbeat. If I dont uncomment any SSL settings for logstash in the yml config then it seems to 'work'. I k… --- ## [Unable to load Winlogbeat Dashboards](https://discuss.elastic.co/t/unable-to-load-winlogbeat-dashboards/113617)
**Author:** [@Chris\_Bosman](https://discuss.elastic.co/u/Chris_Bosman)\ **Replies:** 7\ **Last updated:** [January 3, 2018, 5:12pm UTC](https://discuss.elastic.co/t/unable-to-load-winlogbeat-dashboards/113617 "2018-01-03T17:12:23Z")
I am setting up the ELK stack in a test environment. My ELK server is running CentOS 7. I am running version 6.1.1 of all ELK stack components. I am using nginx as a reverse proxy to server the page to my test environmen… --- ## [Package installer on Windows](https://discuss.elastic.co/t/package-installer-on-windows/113923)
**Author:** [@souf\_el\_badraoui](https://discuss.elastic.co/u/souf_el_badraoui)\ **Replies:** 0\ **Last updated:** [January 3, 2018, 1:06pm UTC](https://discuss.elastic.co/t/package-installer-on-windows/113923 "2018-01-03T13:06:42Z")
Hello, I have a question about the installation of the Beats, particularly Filebeat on Windows. Do we have the possibility to install it using a packet manager like MSI or others, which facilitate the management, upgrad… --- ## [Filebeats not sendind any logs](https://discuss.elastic.co/t/filebeats-not-sendind-any-logs/113916)
**Author:** [@Arthur\_Silva\_Sens](https://discuss.elastic.co/u/Arthur_Silva_Sens)\ **Replies:** 1\ **Last updated:** [January 3, 2018, 12:13pm UTC](https://discuss.elastic.co/t/filebeats-not-sendind-any-logs/113916 "2018-01-03T12:13:19Z")
Hello, My filebeat instance is not sending any logs and not giving me any information why. Here are my filebeats.yml: filebeat.prospectors: - type: log enabled: false tags: \["DOCKER"\] paths: - /var/log/messa… --- ## [Filebeat error while setting up dashboard](https://discuss.elastic.co/t/filebeat-error-while-setting-up-dashboard/113263)
**Author:** [@syed](https://discuss.elastic.co/u/syed)\ **Replies:** 6\ **Last updated:** [January 3, 2018, 9:56am UTC](https://discuss.elastic.co/t/filebeat-error-while-setting-up-dashboard/113263 "2018-01-03T09:56:36Z")
Dear Team, we are facing an issue while setting up the dasboard on the beat server below is the error \[elastic@wapinprjb102 filebeat-6.0.0-linux-x86\_64\]$ ./filebeat setup --dashboards Exiting: Error importing Kibana … --- ## [EXE works, service doesn't (Socket permissions)](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431)
**Author:** [@JRSol](https://discuss.elastic.co/u/JRSol)\ **Replies:** 3\ **Last updated:** [January 2, 2018, 4:19pm UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431 "2018-01-02T16:19:52Z")
Hi folks, Winlogbeat is working wonderfully when I start the exe, with all the features I need, such as SSL, but when I try to run it as a service it fails. I've then collected some logs and it seems the service is lac… --- ## [Winlogbeat for XP](https://discuss.elastic.co/t/winlogbeat-for-xp/113253)
**Author:** [@hsiuming](https://discuss.elastic.co/u/hsiuming)\ **Replies:** 1\ **Last updated:** [January 2, 2018, 4:08pm UTC](https://discuss.elastic.co/t/winlogbeat-for-xp/113253 "2018-01-02T16:08:05Z")
Hello We save the windows XP event log to elasticsearch by winlogbeat. But we find there is no field of event\_data.Binary in elasticsearch. For win7 system we can get a field:"event\_data.Binary XXXXXXXXXXXXXX". Is th… --- ## [No data sent to configured output](https://discuss.elastic.co/t/no-data-sent-to-configured-output/113338)
**Author:** [@code-chris](https://discuss.elastic.co/u/code-chris)\ **Replies:** 5\ **Last updated:** [December 29, 2017, 11:06am UTC](https://discuss.elastic.co/t/no-data-sent-to-configured-output/113338 "2017-12-29T11:06:49Z")
Hi, I created a Metricbeat instance with Docker on Linux, but Metricbeat does not emit any error messages, metric results or something else. Only the internal metric-message "INFO Non-zero metrics in the last 30s" is sh… --- ## [Rtkit-daemon process causing me panic!](https://discuss.elastic.co/t/rtkit-daemon-process-causing-me-panic/113047)
**Author:** [@Amer](https://discuss.elastic.co/u/Amer)\ **Replies:** 5\ **Last updated:** [December 29, 2017, 6:15am UTC](https://discuss.elastic.co/t/rtkit-daemon-process-causing-me-panic/113047 "2017-12-29T06:15:24Z")
Hello , I'm running sanity test for almost 36 hours to check the behavior of new ELK server against Merticbeat,Kibana and ES ( I've installed last versions of ES,Kibana and Metricbeat ( nothing elase is running ) Java … --- ## [Mysql disk consuming query](https://discuss.elastic.co/t/mysql-disk-consuming-query/113200)
**Author:** [@Reetika\_Upadhyay](https://discuss.elastic.co/u/Reetika_Upadhyay)\ **Replies:** 4\ **Last updated:** [December 29, 2017, 2:05am UTC](https://discuss.elastic.co/t/mysql-disk-consuming-query/113200 "2017-12-29T02:05:36Z")
I want to get disk consuming query using filebeat. I dont any metrics for same. Please help --- ## [Filebeat visualisation and dashboards not loading](https://discuss.elastic.co/t/filebeat-visualisation-and-dashboards-not-loading/112890)
**Author:** [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)\ **Replies:** 19\ **Last updated:** [December 29, 2017, 2:04am UTC](https://discuss.elastic.co/t/filebeat-visualisation-and-dashboards-not-loading/112890 "2017-12-29T02:04:40Z")
Hi, I am trying to get logs for kubernete using filebeat while I succeeded getting the content. However, I failed in loading the predefined visualization templates and dashboards in the cloud(trial version). My dashboa… --- ## [Metricbeats for Windows - Performance Monitoring](https://discuss.elastic.co/t/metricbeats-for-windows-performance-monitoring/113362)
**Author:** [@tomerl](https://discuss.elastic.co/u/tomerl)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 2:02am UTC](https://discuss.elastic.co/t/metricbeats-for-windows-performance-monitoring/113362 "2017-12-29T02:02:08Z")
Hi, I'm new to ELK. I've installed metricbeats on Windows and started to get the default metrics without any problem. Now, I wanted to use the Windows module to gain insight on one of the sites in this server. My yam… --- ## [Filebeat module configs not being read](https://discuss.elastic.co/t/filebeat-module-configs-not-being-read/113341)
**Author:** [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Replies:** 1\ **Last updated:** [December 29, 2017, 1:58am UTC](https://discuss.elastic.co/t/filebeat-module-configs-not-being-read/113341 "2017-12-29T01:58:34Z")
I can't figure out if I'm doing some wrong or things are just wonky on my system when reading into logstash. Changes to the module configs (system and apache2 in my case) aren't being read from /etc/filebeat/modules.d I… --- ## [Module variable cannot be overriden](https://discuss.elastic.co/t/module-variable-cannot-be-overriden/113447)
**Author:** [@Dmitriy\_Parkhonin](https://discuss.elastic.co/u/Dmitriy_Parkhonin)\ **Replies:** 0\ **Last updated:** [December 28, 2017, 1:08pm UTC](https://discuss.elastic.co/t/module-variable-cannot-be-overriden/113447 "2017-12-28T13:08:29Z")
Hi! I'm trying to create a new FileBeat (6.1.0) module in the following way: modules.d\\marina.yml: - module: marina dbadicts: enabled: true var.myEnv: target module\\marina\\dbadicts\\manifest.yml: module\_version: "… --- ## [Filebeat output.logstash indicex & kibana index pattern for dashboard visualize](https://discuss.elastic.co/t/filebeat-output-logstash-indicex-kibana-index-pattern-for-dashboard-visualize/112717)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [December 28, 2017, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-output-logstash-indicex-kibana-index-pattern-for-dashboard-visualize/112717 "2017-12-28T16:19:53Z")
I'm using filebeat to collect some of the data: # rpm -q filebeat filebeat-6.1.0-1.x86\_64 # per filebeat.yml there are two outputs: # egrep 'output\\..\*\*\\:$' /etc/filebeat/filebeat.yml.rpmnew #output.elasticsearch: o… --- ## [AutoDiscover - can't ship docker container logs by image name](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110)
**Author:** [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Replies:** 7\ **Last updated:** [December 28, 2017, 6:37am UTC](https://discuss.elastic.co/t/autodiscover-cant-ship-docker-container-logs-by-image-name/113110 "2017-12-28T06:37:45Z")
I'm trying to set up the AutoDiscover component in the Filebeat.yml. I'm using it in order to take logs from specific containers which generated by a specific Docker image. When I'm working with the "filebeat.autodisco… --- ## [Could filebeat be dropping messages here?](https://discuss.elastic.co/t/could-filebeat-be-dropping-messages-here/112637)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 1\ **Last updated:** [December 28, 2017, 1:51am UTC](https://discuss.elastic.co/t/could-filebeat-be-dropping-messages-here/112637 "2017-12-28T01:51:42Z")
Hi, I have filebeat running on 10 hosts that send logs to a central logstash. I notice these messages on all of them. The time on different hosts does not coincide suggesting there is no specific window for these failu… --- ## [Cant get apache module working](https://discuss.elastic.co/t/cant-get-apache-module-working/112869)
**Author:** [@Pavan\_Kumar1](https://discuss.elastic.co/u/Pavan_Kumar1)\ **Replies:** 2\ **Last updated:** [December 27, 2017, 3:46pm UTC](https://discuss.elastic.co/t/cant-get-apache-module-working/112869 "2017-12-27T15:46:51Z")
Hi, I installed filebeat on client server. And used the following guide to start filebeat with apache2 module: https://www.elastic.co/guide/en/beats/filebeat/5.3/filebeat-modules-quickstart.html I used the default sett… --- ## [Stopped Filebeat for 8 hours and old logs did not get pushed out](https://discuss.elastic.co/t/stopped-filebeat-for-8-hours-and-old-logs-did-not-get-pushed-out/112279)
**Author:** [@ramzey1981](https://discuss.elastic.co/u/ramzey1981)\ **Replies:** 3\ **Last updated:** [December 27, 2017, 4:00am UTC](https://discuss.elastic.co/t/stopped-filebeat-for-8-hours-and-old-logs-did-not-get-pushed-out/112279 "2017-12-27T04:00:37Z")
hello team, so i have filebeat 6.0 and our application is logging to a single file. Last night i put filebeat in debug mode to troubleshoot an issue and then I killed the debug session and did not resume the filebeat … --- ## [Save the last fetch/execution time in a persistent file](https://discuss.elastic.co/t/save-the-last-fetch-execution-time-in-a-persistent-file/111959)
**Author:** [@mguggi](https://discuss.elastic.co/u/mguggi)\ **Replies:** 3\ **Last updated:** [December 27, 2017, 1:42am UTC](https://discuss.elastic.co/t/save-the-last-fetch-execution-time-in-a-persistent-file/111959 "2017-12-27T01:42:18Z")
I’m developing a metricbeat module which quries data from a table. As I would like to fetch the data only once, I want store the last fetch time in a persistent store so that I can pull the required data after a planned… --- ## [Metricbeat timestamp mapping as string type, should be date?](https://discuss.elastic.co/t/metricbeat-timestamp-mapping-as-string-type-should-be-date/112521)
**Author:** [@andig](https://discuss.elastic.co/u/andig)\ **Replies:** 3\ **Last updated:** [December 27, 2017, 1:38am UTC](https://discuss.elastic.co/t/metricbeat-timestamp-mapping-as-string-type-should-be-date/112521 "2017-12-27T01:38:06Z")
Trying to get started with filebeat and metricbeat I've noticed that filebeat defines @timestamp as type/format date/date while metricbeat does so as string/date (as shown in the kibana index patterns). Consequently, us… --- ## [Include\_fields problem](https://discuss.elastic.co/t/include-fields-problem/109809)
**Author:** [@fgouin](https://discuss.elastic.co/u/fgouin)\ **Replies:** 6\ **Last updated:** [December 26, 2017, 10:39pm UTC](https://discuss.elastic.co/t/include-fields-problem/109809 "2017-12-26T22:39:42Z")
Hi, I'm having troubles with include\_fields when the fields contains dots. For instance, here is an extract of a Jolokia response: "jolokia": { "metrics": { "Metrics": { "atomikos.nbTransactions": 0.000000, "class… --- ## [Is filebeat 6.1.0 support multi templates setup?](https://discuss.elastic.co/t/is-filebeat-6-1-0-support-multi-templates-setup/112941)
**Author:** [@Astralidea](https://discuss.elastic.co/u/Astralidea)\ **Replies:** 1\ **Last updated:** [December 26, 2017, 10:08pm UTC](https://discuss.elastic.co/t/is-filebeat-6-1-0-support-multi-templates-setup/112941 "2017-12-26T22:08:35Z")
filebeat.prospectors: - paths: \["/home/ec2-user/filebeat/app1.log"\] fields: type: "app1" - paths: \["/home/ec2-user/filebeat/app2.log"\] fields: type: "app2" setup.template.settings: index.number\_of\_shards: … --- ## [Custom module for file beat - parsing a custom log fomat](https://discuss.elastic.co/t/custom-module-for-file-beat-parsing-a-custom-log-fomat/110908)
**Author:** [@john.akash](https://discuss.elastic.co/u/john.akash)\ **Replies:** 4\ **Last updated:** [December 26, 2017, 9:22pm UTC](https://discuss.elastic.co/t/custom-module-for-file-beat-parsing-a-custom-log-fomat/110908 "2017-12-26T21:22:37Z")
Hi Team, We do have a custom log in one of our infra and we are trying to push the data to ES using filebeat (don't want to use logstash). For better visualisation, we can create custom modules and make it happened. Co… --- ## [FIlebeat multiline pattern](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868)
**Author:** [@akashP](https://discuss.elastic.co/u/akashP)\ **Replies:** 1\ **Last updated:** [December 26, 2017, 7:09pm UTC](https://discuss.elastic.co/t/filebeat-multiline-pattern/112868 "2017-12-26T19:09:49Z")
I have log file with multiline events: 4773 \[Access(63)-21-02.00-dxf\_laboratories\] ERROR 2017-12-14T17:29:38.946 com.utils.CommonUtils - event=Laboratory - dv\_laboratories recordKey=nullTest || errorMessage=ERROR\_T… --- ## [Collecting logs from windows server](https://discuss.elastic.co/t/collecting-logs-from-windows-server/113136)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 4\ **Last updated:** [December 26, 2017, 9:09am UTC](https://discuss.elastic.co/t/collecting-logs-from-windows-server/113136 "2017-12-26T09:09:31Z")
Hi! I would like to get advice for gathering text logs on windows server. I have a log stream that is implemented as below. Important part of below stream is that all logs must be also collected on node2 as a log file… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=481) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=483)