# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=484 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 485 --- ## [Functionality of "template" field on templates?](https://discuss.elastic.co/t/functionality-of-template-field-on-templates/111808)
**Author:** [@Caladbolgll](https://discuss.elastic.co/u/Caladbolgll)\ **Replies:** 1\ **Last updated:** [December 17, 2017, 10:44am UTC](https://discuss.elastic.co/t/functionality-of-template-field-on-templates/111808 "2017-12-17T10:44:23Z")
When setting up the basic beats system, there are default templates given in the package named as \_\_\_beat.template.json or \_\_\_beat.template-es6x.json (which apparently seem to be identical) (fill \_\_\_ with one of the beat… --- ## [Beat or Metricbeat?](https://discuss.elastic.co/t/beat-or-metricbeat/111162)
**Author:** [@shanim](https://discuss.elastic.co/u/shanim)\ **Replies:** 3\ **Last updated:** [December 17, 2017, 1:50am UTC](https://discuss.elastic.co/t/beat-or-metricbeat/111162 "2017-12-17T01:50:54Z")
Hi, A noob question here. I am trying to integrate metric generated by an application that we have built with ES. We currently use filebeat to parse the statistics files generated by the application but would like to co… --- ## [Multiple passwords for redis output on filebeat](https://discuss.elastic.co/t/multiple-passwords-for-redis-output-on-filebeat/111284)
**Author:** [@aboullaite](https://discuss.elastic.co/u/aboullaite)\ **Replies:** 4\ **Last updated:** [December 15, 2017, 9:50am UTC](https://discuss.elastic.co/t/multiple-passwords-for-redis-output-on-filebeat/111284 "2017-12-15T09:50:46Z")
Hello all, I'm sending data collected by filebeats to 2 different redis, and I'm enabling load balancer! My config file look something like this: output.redis: hosts: - IP1 - IP2 password: redis\_password key: "f… --- ## [Does Winlogbeat captures previous data?](https://discuss.elastic.co/t/does-winlogbeat-captures-previous-data/111673)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 2\ **Last updated:** [December 15, 2017, 1:31am UTC](https://discuss.elastic.co/t/does-winlogbeat-captures-previous-data/111673 "2017-12-15T01:31:49Z")
Hello! I just want to ask if winlogbeat also sends/collect previous data before it was installed? Like for example I just install the winlogbeat in my machine today, does it also collect all the data in windows event l… --- ## [Non-registered extract\_field processor](https://discuss.elastic.co/t/non-registered-extract-field-processor/111448)
**Author:** [@MasterCarl](https://discuss.elastic.co/u/MasterCarl)\ **Replies:** 2\ **Last updated:** [December 14, 2017, 9:28pm UTC](https://discuss.elastic.co/t/non-registered-extract-field-processor/111448 "2017-12-14T21:28:53Z")
I just discovered the extract\_field processor, which can be used e.g. to extract application instance IDs from log file paths. It might just need some documentation. However, it is not registered. This one won't be regi… --- ## [Kibana Customize Message](https://discuss.elastic.co/t/kibana-customize-message/111501)
**Author:** [@Suman\_Reddy1](https://discuss.elastic.co/u/Suman_Reddy1)\ **Replies:** 1\ **Last updated:** [December 14, 2017, 7:13pm UTC](https://discuss.elastic.co/t/kibana-customize-message/111501 "2017-12-14T19:13:04Z")
I am a newbie to ELK so, Please bear with me, I am using ELK with Filebeat for logging purpose. I am able to post logs and they are appearing in Kibana dicover. Now in the discover pane, I see lot of logs which is good… --- ## [\[Metricbeat System\] Containers overview Dashboard issues](https://discuss.elastic.co/t/metricbeat-system-containers-overview-dashboard-issues/110547)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 11\ **Last updated:** [December 14, 2017, 4:46pm UTC](https://discuss.elastic.co/t/metricbeat-system-containers-overview-dashboard-issues/110547 "2017-12-14T16:46:34Z")
I'm using Elastic stack version 6.0 and while accessing \[Metricbeat System\] Containers overview Dashboard I found few issues: Container CPU usage \[Metricbeat System\] Container Block IO \[Metricbeat System\] Shows Contai… --- ## [Sensible increase of load average since using metricbeat with docker](https://discuss.elastic.co/t/sensible-increase-of-load-average-since-using-metricbeat-with-docker/110874)
**Author:** [@nsteinmetz](https://discuss.elastic.co/u/nsteinmetz)\ **Replies:** 10\ **Last updated:** [December 14, 2017, 3:52pm UTC](https://discuss.elastic.co/t/sensible-increase-of-load-average-since-using-metricbeat-with-docker/110874 "2017-12-14T15:52:30Z")
Hi there, As soon as I deployed metricbeat using the following rules (https://logz.io/blog/docker-metricbeat/), load average started to raise significantly. I only have on my server (4 CPU, 4Go RAM) : 37 containers f… --- ## [Upgrade 5.1.2 to 6.0.1 neccessary?](https://discuss.elastic.co/t/upgrade-5-1-2-to-6-0-1-neccessary/111723)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [December 14, 2017, 2:32pm UTC](https://discuss.elastic.co/t/upgrade-5-1-2-to-6-0-1-neccessary/111723 "2017-12-14T14:32:11Z")
Hi, I am working on an update of elastic stack from 5.1.2 to 6.0.1. Is it needed to update filebeat to 6.0.1? Filebeat is sending to logstash in my case. Logstash is deleting the type field. For me it looks as if it w… --- ## [Exclude messages with Strings](https://discuss.elastic.co/t/exclude-messages-with-strings/111668)
**Author:** [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\ **Replies:** 2\ **Last updated:** [December 14, 2017, 12:06pm UTC](https://discuss.elastic.co/t/exclude-messages-with-strings/111668 "2017-12-14T12:06:10Z")
Hello, I'm using Filebeat version 1.3 I want to ignore all LOG messages with Strings 'test' 'Test' Does 1.3 support drop\_event? If so, the below (sample)configuration doesn't work. processors: drop\_event: when: re… --- ## [Monitoring docker logs, container can no longer be removed](https://discuss.elastic.co/t/monitoring-docker-logs-container-can-no-longer-be-removed/111494)
**Author:** [@Jordi\_Jansen](https://discuss.elastic.co/u/Jordi_Jansen)\ **Replies:** 3\ **Last updated:** [December 14, 2017, 12:02pm UTC](https://discuss.elastic.co/t/monitoring-docker-logs-container-can-no-longer-be-removed/111494 "2017-12-14T12:02:36Z")
Hi, I've read several blog posts and dicussions on this forum for collecting the docker json logs using filebeat. I've come up with the following config: filebeat.prospectors: - input\_type: log paths: - /var/lib/dock… --- ## [Issue with Metricbeat Docker Container](https://discuss.elastic.co/t/issue-with-metricbeat-docker-container/109525)
**Author:** [@rehan](https://discuss.elastic.co/u/rehan)\ **Replies:** 3\ **Last updated:** [December 14, 2017, 10:49am UTC](https://discuss.elastic.co/t/issue-with-metricbeat-docker-container/109525 "2017-12-14T10:49:22Z")
Hi, I am using metricbeat and I want to use metricbeat agent as docker container. I followed the link provided by elastic.co.. https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-docker.html This docum… --- ## [Filebeats logs -\> aws elb of logstash](https://discuss.elastic.co/t/filebeats-logs-aws-elb-of-logstash/111367)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 4\ **Last updated:** [December 14, 2017, 10:41am UTC](https://discuss.elastic.co/t/filebeats-logs-aws-elb-of-logstash/111367 "2017-12-14T10:41:38Z")
Hi, Using AWS elb for logstash server (3 nodes of EC2 instances), but I am getting client is unable to connect. filebeat.log 2017-12-12T14:55:06Z ERR Failed to publish events caused by: client is not connected 2017-12… --- ## [No results found for none of filebeat modules in Kibana Dashboard](https://discuss.elastic.co/t/no-results-found-for-none-of-filebeat-modules-in-kibana-dashboard/111343)
**Author:** [@yan](https://discuss.elastic.co/u/yan)\ **Replies:** 5\ **Last updated:** [December 14, 2017, 9:06am UTC](https://discuss.elastic.co/t/no-results-found-for-none-of-filebeat-modules-in-kibana-dashboard/111343 "2017-12-14T09:06:26Z")
Hello all, I am using Kibana-elasticsearch-filebeat 6.0.0. After the installation and configuration I manage to enter Kibana and I can perfectly see all the desired logs in the "Discover" tab. But, for some reason I can… --- ## [Filebeat to logstash problem to parse json message](https://discuss.elastic.co/t/filebeat-to-logstash-problem-to-parse-json-message/111642)
**Author:** [@Fabio\_Scoppetta](https://discuss.elastic.co/u/Fabio_Scoppetta)\ **Replies:** 6\ **Last updated:** [December 13, 2017, 9:58pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-problem-to-parse-json-message/111642 "2017-12-13T21:58:51Z")
Hello I am trying to parse json logs in filebeat and send to elastic without logstash If a have message like in below works fine: {"@timestamp":"2017-12-11T19:52:51.262-02:00","@version":1,"message":"foo","logger\_name"… --- ## [Filebeat is harvesting the same log over and over](https://discuss.elastic.co/t/filebeat-is-harvesting-the-same-log-over-and-over/109746)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 7\ **Last updated:** [December 13, 2017, 8:56pm UTC](https://discuss.elastic.co/t/filebeat-is-harvesting-the-same-log-over-and-over/109746 "2017-12-13T20:56:19Z")
Hi everyone, 2 days ago i did an upgrade from Logstash and Filebeat from 5.6.x to 6.0, then i got some fun time with index\_templates and document\_type, but after that, i found the strange behavior of Filebeat. i only c… --- ## [How to send all the content of the files as well as the creation time?](https://discuss.elastic.co/t/how-to-send-all-the-content-of-the-files-as-well-as-the-creation-time/110160)
**Author:** [@anthony-o](https://discuss.elastic.co/u/anthony-o)\ **Replies:** 2\ **Last updated:** [December 13, 2017, 7:15pm UTC](https://discuss.elastic.co/t/how-to-send-all-the-content-of-the-files-as-well-as-the-creation-time/110160 "2017-12-13T19:15:08Z")
I would like to configure Filebeat so it would send the whole content of all files of a specific folder (the log files appear in this folder, one file per new event). I have some problems configuring this use case becau… --- ## [Monitoring our office Cisco router](https://discuss.elastic.co/t/monitoring-our-office-cisco-router/111304)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 4\ **Last updated:** [December 13, 2017, 5:09pm UTC](https://discuss.elastic.co/t/monitoring-our-office-cisco-router/111304 "2017-12-13T17:09:02Z")
Hi, Which beats agents can i install on my PC to get metrics/logs of our office router? then view these metrics on Kibana to check the uptime and downtime of our internet --- ## [CombinedApacheLog pattern where request is without parameters](https://discuss.elastic.co/t/combinedapachelog-pattern-where-request-is-without-parameters/110383)
**Author:** [@Ronald\_Haring](https://discuss.elastic.co/u/Ronald_Haring)\ **Replies:** 7\ **Last updated:** [December 13, 2017, 3:13pm UTC](https://discuss.elastic.co/t/combinedapachelog-pattern-where-request-is-without-parameters/110383 "2017-12-13T15:13:51Z")
Hello i have set up a filebeat es and kibana stack but in the kibana/es i can see that the request contains parameters making it hard to collect all data on a specific url, i did find the URIPATH parameter but dont know … --- ## [INFO Non-zero metrics in the last 30s](https://discuss.elastic.co/t/info-non-zero-metrics-in-the-last-30s/111484)
**Author:** [@sujithattinad](https://discuss.elastic.co/u/sujithattinad)\ **Replies:** 1\ **Last updated:** [December 13, 2017, 9:43am UTC](https://discuss.elastic.co/t/info-non-zero-metrics-in-the-last-30s/111484 "2017-12-13T09:43:18Z")
Hi, I'm new to ELK and need to do log forwarding for my Kafka logs. After did all the configuration i just run the below command ./filebeat -e -c /etc/filebeat/filebeat.yml -d "\*" i got response like below 2017/… --- ## [Name new filebeat index based on time from log](https://discuss.elastic.co/t/name-new-filebeat-index-based-on-time-from-log/111514)
**Author:** [@sukeshss](https://discuss.elastic.co/u/sukeshss)\ **Replies:** 1\ **Last updated:** [December 13, 2017, 9:44am UTC](https://discuss.elastic.co/t/name-new-filebeat-index-based-on-time-from-log/111514 "2017-12-13T09:44:20Z")
How I can name the index created by filebeat based on the time from the log file. Can we use date filter in filebeat configuration like logstash. --- ## [Filebeat won't stop with SIGTERM if the --once flag is used,](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009)
**Author:** [@Sheng\_Song](https://discuss.elastic.co/u/Sheng_Song)\ **Replies:** 2\ **Last updated:** [December 13, 2017, 8:22am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009 "2017-12-13T08:22:35Z")
Hi, As described in title, my filebeat instance running with --once does not exit with SIGTERM. it does exit if without --once. Here is my simple yml: filebeat.prospectors: - input\_type: log paths: - /xxx close\_e… --- ## [Filebeat Docker Container can't read host log files due to permissions](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952)
**Author:** [@claflico](https://discuss.elastic.co/u/claflico)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-docker-container-cant-read-host-log-files-due-to-permissions/110952 "2017-12-12T16:07:41Z")
Trying to setup an ELK:6.0.1 stack and \*beat:6.0.1 via CentOS 7, Docker 17.09, & Rancher 1.6.12 for a presentation I'm giving this week at a DevOps MeetUp. Am trying to set everything up without having to create custom i… --- ## [Metricbeat Perfmon metrics monitroing](https://discuss.elastic.co/t/metricbeat-perfmon-metrics-monitroing/110697)
**Author:** [@dilip](https://discuss.elastic.co/u/dilip)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 3:11pm UTC](https://discuss.elastic.co/t/metricbeat-perfmon-metrics-monitroing/110697 "2017-12-12T15:11:52Z")
Hello Team, could you please help me in providing the information on Metricbeat Perfmon Counter. can metricbeat monitor all the Counters available in Perfmon like-MS SQL Server Metrics/Exchange server metrics/IIS Count… --- ## [Kafka Integration Between Filebeat and Logstash](https://discuss.elastic.co/t/kafka-integration-between-filebeat-and-logstash/110799)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 7\ **Last updated:** [December 12, 2017, 12:07pm UTC](https://discuss.elastic.co/t/kafka-integration-between-filebeat-and-logstash/110799 "2017-12-12T12:07:48Z")
Hi All, I want to integrate KAFKA between Filebeat and Logstash . My ELK stack is ready but to have more stability , i need this . Please help me in configuring the same . If anyone has DOCS for the same , Please do… --- ## [Get %{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]} index](https://discuss.elastic.co/t/get-metadata-beat-metadata-version-index/110281)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 11:51am UTC](https://discuss.elastic.co/t/get-metadata-beat-metadata-version-index/110281 "2017-12-12T11:51:49Z")
I upgraded from 5.6.3 to 6.0 and i have two question: Need upgrade all beat to 6.0 ? v5.6.x conflict with ES 6.0.0? I got %{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-2017-37 in index name. Flow data : beat -\> LS forw… --- ## [Unable to see logs when sending through Logstash](https://discuss.elastic.co/t/unable-to-see-logs-when-sending-through-logstash/110687)
**Author:** [@fab](https://discuss.elastic.co/u/fab)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 11:12am UTC](https://discuss.elastic.co/t/unable-to-see-logs-when-sending-through-logstash/110687 "2017-12-12T11:12:34Z")
Hi, i'm trying to send windows logs through winlogbeat directly to logstash. Everything is done locally from Windows 10 to a VM with Centos 7. winlogbeat.yml file in windows output.logstash: hosts: \["192.168.88.129:50… --- ## [Filebeat fail to start](https://discuss.elastic.co/t/filebeat-fail-to-start/111305)
**Author:** [@teejayuu](https://discuss.elastic.co/u/teejayuu)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 11:03am UTC](https://discuss.elastic.co/t/filebeat-fail-to-start/111305 "2017-12-12T11:03:45Z")
Trying to ingest IIS logs to logstash. Have installed filebeat 5.3.2 on an IIS server and modified filebeat.yml as below: ###################### Filebeat Configuration Example ######################### # This file is … --- ## [AKAMAI =\> Filebeat =\> Logstash](https://discuss.elastic.co/t/akamai-filebeat-logstash/110801)
**Author:** [@Haenschen](https://discuss.elastic.co/u/Haenschen)\ **Replies:** 6\ **Last updated:** [December 12, 2017, 10:42am UTC](https://discuss.elastic.co/t/akamai-filebeat-logstash/110801 "2017-12-12T10:42:08Z")
Hi folks, I'm going to include our Akamai Logfiles in our Elastic Stack. I'm syncing the compressed logs via rsync to a local storage. There are only compressed (gzip) files. As I read, there were some issues using Logs… --- ## [ERR Failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/err-failed-to-publish-events-temporary-bulk-send-failure/111265)
**Author:** [@Pan\_Wang](https://discuss.elastic.co/u/Pan_Wang)\ **Replies:** 5\ **Last updated:** [December 12, 2017, 9:40am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-temporary-bulk-send-failure/111265 "2017-12-12T09:40:04Z")
filebeat version 6.0.1 Elasticsearch version 5.6.2 Filebeat has 40，Elasticsearch has 4. filebeat.yml: filebeat.registry\_file: /home/work/data/registry filebeat.config.prospectors: enabled: true path: configs/\*.y… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=483) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=485)