# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=483 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 484 --- ## [TLS Versions - Packetbeat 6.1.1](https://discuss.elastic.co/t/tls-versions-packetbeat-6-1-1/112972)
**Author:** [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Replies:** 2\ **Last updated:** [December 22, 2017, 10:38am UTC](https://discuss.elastic.co/t/tls-versions-packetbeat-6-1-1/112972 "2017-12-22T10:38:08Z")
Hi, I've recently started using packetbeat 6.1.1 to make use of the new TLS module. It works really well, however I'm puzzled as to why the TLS versions are 3.x as opposed to the proper versioning (1.x). I'm assuming … --- ## [\[Solved\] Filebeat on Raspberry Pi?](https://discuss.elastic.co/t/solved-filebeat-on-raspberry-pi/112099)
**Author:** [@andig](https://discuss.elastic.co/u/andig)\ **Replies:** 6\ **Last updated:** [December 22, 2017, 7:32am UTC](https://discuss.elastic.co/t/solved-filebeat-on-raspberry-pi/112099 "2017-12-22T07:32:59Z")
I'm new to ELK and have problems getting started. I got: ELK stack installed on nas via docker filebeat compiled from source on mac via docker image and scp'ed to raspberry beats git cloned to Raspberry Did it this wa… --- ## [How do i fetch pod logs using Filebeat](https://discuss.elastic.co/t/how-do-i-fetch-pod-logs-using-filebeat/109590)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 3\ **Last updated:** [November 30, 2017, 11:02am UTC](https://discuss.elastic.co/t/how-do-i-fetch-pod-logs-using-filebeat/109590 "2017-11-30T11:02:53Z")
So am trying to have a pipeline with Jenkins job polling git for any code changes then to build the code create image and placing it into artifactory and deploying it to Kubernetes pods via Spinnaker. My question is how… --- ## [Logstash not listening on port 5044- Resolved](https://discuss.elastic.co/t/logstash-not-listening-on-port-5044-resolved/112919)
**Author:** [@sconrod](https://discuss.elastic.co/u/sconrod)\ **Replies:** 0\ **Last updated:** [December 22, 2017, 1:43am UTC](https://discuss.elastic.co/t/logstash-not-listening-on-port-5044-resolved/112919 "2017-12-22T01:43:34Z")
resolved please disregard. --- ## [Error loading topbeat.template.json](https://discuss.elastic.co/t/error-loading-topbeat-template-json/112526)
**Author:** [@Amer](https://discuss.elastic.co/u/Amer)\ **Replies:** 2\ **Last updated:** [December 21, 2017, 2:43pm UTC](https://discuss.elastic.co/t/error-loading-topbeat-template-json/112526 "2017-12-21T14:43:16Z")
Hi , I'm using topbeat-1.3.1-x86\_64 to connect withES 6.0. I've tried the following to load the template mannualy to ES before start topbeat on RHEL 7.2 using the following : curl -XPUT 'localhost:9200/\_template/topbea… --- ## [Docker Swarm + Filebeat](https://discuss.elastic.co/t/docker-swarm-filebeat/112002)
**Author:** [@ZaphordB](https://discuss.elastic.co/u/ZaphordB)\ **Replies:** 4\ **Last updated:** [December 21, 2017, 1:35pm UTC](https://discuss.elastic.co/t/docker-swarm-filebeat/112002 "2017-12-21T13:35:40Z")
Hi! There is a server with ELK 5.6 stack and now I need to analyze logs from Docker Swarm hosts. Is it possible to config Filebeat (or any other Beat) inside Swarm to send logs to the ELK server? --- ## [Index Name is not changing in metric beat](https://discuss.elastic.co/t/index-name-is-not-changing-in-metric-beat/112452)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 2\ **Last updated:** [December 21, 2017, 10:05am UTC](https://discuss.elastic.co/t/index-name-is-not-changing-in-metric-beat/112452 "2017-12-21T10:05:34Z")
Hi, I have installed metricbeat in my cluster and its working fine. Now I want to change the index name for the metricbeat. For that I have changed index name in Outputs of metricbeat.reference.yml file as shown below … --- ## [Filebeat index pattern is created in ES. but cant be mapped by kibana](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198)
**Author:** [@Ree](https://discuss.elastic.co/u/Ree)\ **Replies:** 4\ **Last updated:** [December 21, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-index-pattern-is-created-in-es-but-cant-be-mapped-by-kibana/112198 "2017-12-21T10:04:46Z")
my file index pattern is created on elasticsearch. but wen i m trying to create a new index pattern in kibana.this is the output: Unable to fetch mapping. Do you have indices matching the pattern? i performed a search… --- ## [Allow for renaming of json fields in http module output](https://discuss.elastic.co/t/allow-for-renaming-of-json-fields-in-http-module-output/112461)
**Author:** [@spfeiffer](https://discuss.elastic.co/u/spfeiffer)\ **Replies:** 2\ **Last updated:** [December 21, 2017, 4:40am UTC](https://discuss.elastic.co/t/allow-for-renaming-of-json-fields-in-http-module-output/112461 "2017-12-21T04:40:39Z")
I want to ingest Spring Boot Actuator metrics information (/metrics endpoint). The http module takes the JSON returned by my spring boot application and feeds it to ES using the elasticsearch output. Basically, i run in… --- ## [Multiple destinations for failover](https://discuss.elastic.co/t/multiple-destinations-for-failover/112188)
**Author:** [@Mazhar](https://discuss.elastic.co/u/Mazhar)\ **Replies:** 4\ **Last updated:** [December 21, 2017, 1:46am UTC](https://discuss.elastic.co/t/multiple-destinations-for-failover/112188 "2017-12-21T01:46:28Z")
I am configuring the following at my end, output.kafka: enabled:true hosts:\["kafkahost1:port1","kafkahost2:port2"\] topic: topic\_name From the configuration I understand I am sending the same logs/event to multiple rec… --- ## [Can't start winlogbeat as service](https://discuss.elastic.co/t/cant-start-winlogbeat-as-service/112694)
**Author:** [@talis](https://discuss.elastic.co/u/talis)\ **Replies:** 0\ **Last updated:** [December 20, 2017, 6:11pm UTC](https://discuss.elastic.co/t/cant-start-winlogbeat-as-service/112694 "2017-12-20T18:11:15Z")
I experienced the following error when trying to start winlogbeat as a service: Windows could not start the winlogbeat service on Local Computer. Error 1053: The service did not respond to the start or control request … --- ## [How to define custom database in Metricbeat for pgsql](https://discuss.elastic.co/t/how-to-define-custom-database-in-metricbeat-for-pgsql/112513)
**Author:** [@Abdur\_Raqeeb1](https://discuss.elastic.co/u/Abdur_Raqeeb1)\ **Replies:** 1\ **Last updated:** [December 20, 2017, 11:40am UTC](https://discuss.elastic.co/t/how-to-define-custom-database-in-metricbeat-for-pgsql/112513 "2017-12-20T11:40:28Z")
On my metricbeat the pgsql config takes default database.I need to define custom database on metricbeat. --- ## [Shiping logs from kubernetes to elasticsearch using beats - Failed to connect: Get http://xxxxxx.us-central1.gcp.cloud.es.io:9243: read tcp 13.17.4.10:40766-\>31.177.77.2:9243: read: connection reset by peer](https://discuss.elastic.co/t/shiping-logs-from-kubernetes-to-elasticsearch-using-beats-failed-to-connect-get-http-xxxxxx-us-central1-gcp-cloud-es-io-9243-read-tcp-13-17-4-10-40766-31-177-77-2-9243-read-connection-reset-by-peer/112236)
**Author:** [@dinaWork](https://discuss.elastic.co/u/dinaWork)\ **Replies:** 3\ **Last updated:** [December 20, 2017, 10:45am UTC](https://discuss.elastic.co/t/shiping-logs-from-kubernetes-to-elasticsearch-using-beats-failed-to-connect-get-http-xxxxxx-us-central1-gcp-cloud-es-io-9243-read-tcp-13-17-4-10-40766-31-177-77-2-9243-read-connection-reset-by-peer/112236 "2017-12-20T10:45:38Z")
following beats fails to ship logs get the following log: ERR Failed to connect: Get http://xxxxxx.us-central1.gcp.cloud.es.io:9243: read tcp 13.17.4.10:40766-\>31.177.77.2:9243: read: connection reset by peer 11:38… --- ## [Metricbeat on kubernetes](https://discuss.elastic.co/t/metricbeat-on-kubernetes/112524)
**Author:** [@kanthimathi](https://discuss.elastic.co/u/kanthimathi)\ **Replies:** 11\ **Last updated:** [December 20, 2017, 1:17am UTC](https://discuss.elastic.co/t/metricbeat-on-kubernetes/112524 "2017-12-20T01:17:22Z")
I am a novice user and just started to explore metric beats. I wanted to monitor kubernetes, right now I am using the cloud trial version. The issue is I couldn't get the data from kubernetes into the elastic cloud.Howev… --- ## [Auditd module | No results found](https://discuss.elastic.co/t/auditd-module-no-results-found/112315)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [December 20, 2017, 12:50am UTC](https://discuss.elastic.co/t/auditd-module-no-results-found/112315 "2017-12-20T00:50:41Z")
I'm trying to utilize Auditd module | Filebeat Reference \[6.1\] | Elastic. My Elastic Stack environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.4 (Maipo) # rpm -q filebeat elasticsearch fil… --- ## [Custom configuration for new Beat](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470)
**Author:** [@Michael\_Albers](https://discuss.elastic.co/u/Michael_Albers)\ **Replies:** 3\ **Last updated:** [December 19, 2017, 10:46pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470 "2017-12-19T22:46:51Z")
I'm creating a new Beat from the Developer Guide (https://www.elastic.co/guide/en/beats/devguide/master/index.html). The Beat is functioning well, but I would like to do some final configuration. I've looked all over and… --- ## [Conditional topics not work: since document\_type is deprecated, how to use %{\[type\]} in kafka ouput?](https://discuss.elastic.co/t/conditional-topics-not-work-since-document-type-is-deprecated-how-to-use-type-in-kafka-ouput/109499)
**Author:** [@oldcodeoberyn](https://discuss.elastic.co/u/oldcodeoberyn)\ **Replies:** 9\ **Last updated:** [December 19, 2017, 3:06pm UTC](https://discuss.elastic.co/t/conditional-topics-not-work-since-document-type-is-deprecated-how-to-use-type-in-kafka-ouput/109499 "2017-12-19T15:06:20Z")
anyway, this %{\[type\]} is still valid in the filebeat 6.0.0 docs. but it is not working in program. and when I use fields it is also not working for topics, e.g: filebeat.prospectors: ... fields: log\_topic: test1 ..… --- ## [Azure redis - password in yml file](https://discuss.elastic.co/t/azure-redis-password-in-yml-file/112362)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 1\ **Last updated:** [December 19, 2017, 2:31pm UTC](https://discuss.elastic.co/t/azure-redis-password-in-yml-file/112362 "2017-12-19T14:31:18Z")
Dear all, I could successfully set azure redis as output of filebeat. But I have some concerns in keeping password plain text in .yml file. Though ssl.enabled is set to true' and the n/w transmission is secured - keepin… --- ## [Unable to parse JSON logs through filebeat prospector](https://discuss.elastic.co/t/unable-to-parse-json-logs-through-filebeat-prospector/111980)
**Author:** [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Replies:** 2\ **Last updated:** [December 19, 2017, 6:56am UTC](https://discuss.elastic.co/t/unable-to-parse-json-logs-through-filebeat-prospector/111980 "2017-12-19T06:56:48Z")
I'm trying to parse multiline JSON logs into elasticsearch using filebeat. { "took": 95, "timed\_out": false, "\_shards": { "total": 85, "successful": 85, "skipped": 0, "failed": 0 }, "hits": { … --- ## [Filebeat 6.1 can't store log output to file](https://discuss.elastic.co/t/filebeat-6-1-cant-store-log-output-to-file/112349)
**Author:** [@vuxuanlai](https://discuss.elastic.co/u/vuxuanlai)\ **Replies:** 2\ **Last updated:** [December 19, 2017, 5:51am UTC](https://discuss.elastic.co/t/filebeat-6-1-cant-store-log-output-to-file/112349 "2017-12-19T05:51:14Z")
Hi there, When i run filebeat 6.1 with command: ./filebeat -e -c filebeat.yml -d "publish" I got the events which pushed to ES but i can't get filebeat log output. Could plz help me? My filebeat config as below: fi… --- ## [Metricbeat setup failed](https://discuss.elastic.co/t/metricbeat-setup-failed/112142)
**Author:** [@Rezaa](https://discuss.elastic.co/u/Rezaa)\ **Replies:** 3\ **Last updated:** [December 19, 2017, 5:23am UTC](https://discuss.elastic.co/t/metricbeat-setup-failed/112142 "2017-12-19T05:23:49Z")
Hi I have installed elastic search and metricbeat 6.0 installed. But when I try to run setup i get following error want to connect to port 443. there is no program listening on port 443, and I have no such a port in my… --- ## [The filebeat service failed to start due to the following error: The pipe has been ended](https://discuss.elastic.co/t/the-filebeat-service-failed-to-start-due-to-the-following-error-the-pipe-has-been-ended/112139)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 1\ **Last updated:** [December 19, 2017, 5:21am UTC](https://discuss.elastic.co/t/the-filebeat-service-failed-to-start-due-to-the-following-error-the-pipe-has-been-ended/112139 "2017-12-19T05:21:43Z")
I installed filebeat on windows pc. Upon checking on the event viewer, I got an error which is: The filebeat service failed to start due to the following error: The pipe has been ended. I also search in the internet … --- ## [Modify field name based on the some condition like field"s value](https://discuss.elastic.co/t/modify-field-name-based-on-the-some-condition-like-field-s-value/111852)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 1\ **Last updated:** [December 19, 2017, 5:06am UTC](https://discuss.elastic.co/t/modify-field-name-based-on-the-some-condition-like-field-s-value/111852 "2017-12-19T05:06:59Z")
Hi, This might be very simple or very tricky. Because I am not sure. Spring boot with logstash logback encoder. Filebeat to ES (Without Logstash ) Generates logs in JSON for our application which we are writing in J… --- ## [Handeling log rotation](https://discuss.elastic.co/t/handeling-log-rotation/109660)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 6\ **Last updated:** [December 18, 2017, 4:18pm UTC](https://discuss.elastic.co/t/handeling-log-rotation/109660 "2017-12-18T16:18:29Z")
Hi, using 5.6.2 filebeat.prospectors: - input\_type: log paths: - /var/lib/mesos/slave/slaves/\*/frameworks/\*/executors/\*/runs/latest/stdout - /var/lib/mesos/slave/slaves/\*/frameworks/\*/executors/\*/runs/latest/s… --- ## [Winlogbeat running on Windows Event Collector - logs use the collector name instead of log sources](https://discuss.elastic.co/t/winlogbeat-running-on-windows-event-collector-logs-use-the-collector-name-instead-of-log-sources/111806)
**Author:** [@mike.harlan](https://discuss.elastic.co/u/mike.harlan)\ **Replies:** 7\ **Last updated:** [December 18, 2017, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-running-on-windows-event-collector-logs-use-the-collector-name-instead-of-log-sources/111806 "2017-12-18T14:56:12Z")
I've been searching for a little bit without luck so hopefully I'm not duplicating: I'm running Windows Event Forwarding =\> Windows Event Collector to collect logs from endpoints, while viewing the logs in Kibana - the … --- ## [How to filter log level with json in filebeat](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211)
**Author:** [@847e01e784615435d38b](https://discuss.elastic.co/u/847e01e784615435d38b)\ **Replies:** 1\ **Last updated:** [December 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/how-to-filter-log-level-with-json-in-filebeat/112211 "2017-12-18T14:39:33Z")
Continuing the discussion from Parse JSON data with filebeat: --- ## [Shiping logs from kubernetes to elasticsearch using beats - get: "clusterroles.rbac.authorization.k8s.io "filebeat" is forbidden: attempt to grant extra privileges"](https://discuss.elastic.co/t/shiping-logs-from-kubernetes-to-elasticsearch-using-beats-get-clusterroles-rbac-authorization-k8s-io-filebeat-is-forbidden-attempt-to-grant-extra-privileges/112135)
**Author:** [@dinaWork](https://discuss.elastic.co/u/dinaWork)\ **Replies:** 3\ **Last updated:** [December 18, 2017, 1:46pm UTC](https://discuss.elastic.co/t/shiping-logs-from-kubernetes-to-elasticsearch-using-beats-get-clusterroles-rbac-authorization-k8s-io-filebeat-is-forbidden-attempt-to-grant-extra-privileges/112135 "2017-12-18T13:46:24Z")
following https://www.elastic.co/guide/en/beats/filebeat/6.1/running-on-kubernetes.html and the following post: curl -L -O https://raw.githubusercontent.com/elastic/beats/6.0/deploy/kubernetes/filebeat-kubernetes.y… --- ## [Is filebeat a cluster concept?](https://discuss.elastic.co/t/is-filebeat-a-cluster-concept/111938)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [December 18, 2017, 12:08pm UTC](https://discuss.elastic.co/t/is-filebeat-a-cluster-concept/111938 "2017-12-18T12:08:27Z")
As title, I am looking for a load balancer to receive data(netflow) and push the data to logstash or directly to elasticsearch. Is there any suggestion? thank u in advance! --- ## [Drop\_fields and the beats.name/.hostname/.version fields](https://discuss.elastic.co/t/drop-fields-and-the-beats-name-hostname-version-fields/111450)
**Author:** [@geckofish](https://discuss.elastic.co/u/geckofish)\ **Replies:** 5\ **Last updated:** [December 18, 2017, 6:02am UTC](https://discuss.elastic.co/t/drop-fields-and-the-beats-name-hostname-version-fields/111450 "2017-12-18T06:02:28Z")
Hi There, I'm using Metricbeat, Elastic Search and Kibana to create system overview dashboards of about 45 Linux boxes. I'm trying to keep the data to the necessities, so I'm stripping out as much data as possible usin… --- ## [Filebeat on "Docker for AWS" fails to start](https://discuss.elastic.co/t/filebeat-on-docker-for-aws-fails-to-start/110345)
**Author:** [@shazChaudhry](https://discuss.elastic.co/u/shazChaudhry)\ **Replies:** 5\ **Last updated:** [December 17, 2017, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-for-aws-fails-to-start/110345 "2017-12-17T21:25:16Z")
My Elastic stack version is at 6.0.0; ELK + Filebeat + Metricbeat running in docker swarm mode; Docker host machines are all ubuntu/xenial64. I have configured filebeat as described in this blog by Carlos Pérez-Aradro… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=482) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=484)