# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=487 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 488 --- ## [Unable to change the default index in Winlogbeat.yaml](https://discuss.elastic.co/t/unable-to-change-the-default-index-in-winlogbeat-yaml/109528)
**Author:** [@AnithaLingam](https://discuss.elastic.co/u/AnithaLingam)\ **Replies:** 14\ **Last updated:** [December 5, 2017, 2:54pm UTC](https://discuss.elastic.co/t/unable-to-change-the-default-index-in-winlogbeat-yaml/109528 "2017-12-05T14:54:42Z")
I need to push the event logs to the existing index that we already has, but the logs are flowing to new index WInlogbeat. I tried to modify the WInlogbeat.yaml file by entering the index name but it is not working and a… --- ## [Cutom field in a metricset](https://discuss.elastic.co/t/cutom-field-in-a-metricset/110298)
**Author:** [@slaypl](https://discuss.elastic.co/u/slaypl)\ **Replies:** 2\ **Last updated:** [December 5, 2017, 1:41pm UTC](https://discuss.elastic.co/t/cutom-field-in-a-metricset/110298 "2017-12-05T13:41:07Z")
Hello there, Is there a possibility to add a custom field with a static value in a metricset? The thing that I'm interested in is adding a custom field for the cpu metricset and only to that (not for other metricsets fr… --- ## [Unable to load Heartbeat dashboards for kibana](https://discuss.elastic.co/t/unable-to-load-heartbeat-dashboards-for-kibana/110148)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 4\ **Last updated:** [December 5, 2017, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-load-heartbeat-dashboards-for-kibana/110148 "2017-12-05T13:23:20Z")
I am trying to load Heartbeat dashboards using the following configuration in heartbeat.yml setup.dashboards.enabled: true however i faced the following error D:\\gaffar\\MonitoringTool\\heartbeat-6.0.0-windows-x86\_64\>he… --- ## [Failed to parse mapping \[doc\]: Mapping definition for \[error\] has unsupported parameters](https://discuss.elastic.co/t/failed-to-parse-mapping-doc-mapping-definition-for-error-has-unsupported-parameters/109797)
**Author:** [@quanta84](https://discuss.elastic.co/u/quanta84)\ **Replies:** 2\ **Last updated:** [December 5, 2017, 7:32am UTC](https://discuss.elastic.co/t/failed-to-parse-mapping-doc-mapping-definition-for-error-has-unsupported-parameters/109797 "2017-12-05T07:32:52Z")
I have just upgraded filebeat from 5.6.4 to 6.0.0 and logs are being flooded with: 2017/11/30 16:24:23.327596 client.go:465: WARN Can not index event (status=400): {"type":"mapper\_parsing\_exception","reason":"Failed to… --- ## [FILEbeat index not showing in kibana](https://discuss.elastic.co/t/filebeat-index-not-showing-in-kibana/109966)
**Author:** [@dictus](https://discuss.elastic.co/u/dictus)\ **Replies:** 3\ **Last updated:** [December 5, 2017, 1:52am UTC](https://discuss.elastic.co/t/filebeat-index-not-showing-in-kibana/109966 "2017-12-05T01:52:31Z")
I have got this. But not able to see in kibana. and only index is kibanas default one --- ## [How to push multiple metricbeat instance from multiple machines into 1 ES instance?](https://discuss.elastic.co/t/how-to-push-multiple-metricbeat-instance-from-multiple-machines-into-1-es-instance/109752)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 3\ **Last updated:** [December 4, 2017, 4:35pm UTC](https://discuss.elastic.co/t/how-to-push-multiple-metricbeat-instance-from-multiple-machines-into-1-es-instance/109752 "2017-12-04T16:35:07Z")
how to push multiple metricbeat instance from multiple machines into 1 ES instance connected in same network.Basically need to connect 2 windows machine and monitor the system metrics of both machines using ELK stack. Fo… --- ## [Heartbeat ICMP Hosts Monitoring](https://discuss.elastic.co/t/heartbeat-icmp-hosts-monitoring/110111)
**Author:** [@dilip](https://discuss.elastic.co/u/dilip)\ **Replies:** 1\ **Last updated:** [December 4, 2017, 1:44pm UTC](https://discuss.elastic.co/t/heartbeat-icmp-hosts-monitoring/110111 "2017-12-04T13:44:03Z")
Hello Team, could you please help me in providing the Number of Hosts for ICMP Monitoring which can be Monitor from one machine. like: for one machine having heartbeat installed and we would like to monitor 1000s of… --- ## [The processors only filter part of message](https://discuss.elastic.co/t/the-processors-only-filter-part-of-message/110055)
**Author:** [@Augustus1995](https://discuss.elastic.co/u/Augustus1995)\ **Replies:** 3\ **Last updated:** [December 4, 2017, 1:31pm UTC](https://discuss.elastic.co/t/the-processors-only-filter-part-of-message/110055 "2017-12-04T13:31:27Z")
Hi, i want to use filebeat send message to elasticsearch directly. And i use processors as a filter to drop some useless fields. But when i check message from kibana only half messages drop fields. And i only run one fil… --- ## [Can't use two ports and 2 types logs using beats](https://discuss.elastic.co/t/cant-use-two-ports-and-2-types-logs-using-beats/109136)
**Author:** [@arye](https://discuss.elastic.co/u/arye)\ **Replies:** 9\ **Last updated:** [December 4, 2017, 1:28pm UTC](https://discuss.elastic.co/t/cant-use-two-ports-and-2-types-logs-using-beats/109136 "2017-12-04T13:28:10Z")
Hi All, I have configured two conf files using the followings: input { beats { port =\> 5044 type =\> "logbeat\_general" } } input { beats { port =\> 5045 type =\> "openlogtst" } } And configured the output conf… --- ## [Winlogbeat failed to start](https://discuss.elastic.co/t/winlogbeat-failed-to-start/109880)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 4\ **Last updated:** [December 4, 2017, 10:14am UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-start/109880 "2017-12-04T10:14:06Z")
Hi there, I'm trying to install winlogbeat 5.6.4 x64 on windows server 2012,but failed to start it,error as follows: PS C:\\winlogbeat-5.6.4\> Start-Service -DisplayName “winlogbeat” -Verbose VERBOSE: Performing the ope… --- ## [ERR Unknown state \<41\> for process with pid 31139](https://discuss.elastic.co/t/err-unknown-state-41-for-process-with-pid-31139/110069)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [December 4, 2017, 5:24am UTC](https://discuss.elastic.co/t/err-unknown-state-41-for-process-with-pid-31139/110069 "2017-12-04T05:24:20Z")
I'm using Metricbeat 6.0 on Debian 9 (stretch) and I toggled redis.disabled in modules.d sub directory and adjusted hosts variable, followed by restarting metricbeat.service and now I'm seeing following error root@app11… --- ## [INFO File was truncated. Begin reading file from offset 0:](https://discuss.elastic.co/t/info-file-was-truncated-begin-reading-file-from-offset-0/109956)
**Author:** [@willsc](https://discuss.elastic.co/u/willsc)\ **Replies:** 1\ **Last updated:** [December 4, 2017, 5:20am UTC](https://discuss.elastic.co/t/info-file-was-truncated-begin-reading-file-from-offset-0/109956 "2017-12-04T05:20:11Z")
Seeing a disproportionate number of these messages " INFO File was truncated. Begin reading file from offset 0:" in /var/log/filebeats . Curiously complete files are being processed needlessly again. Log ingestion is ha… --- ## [FileBeat not harvesting logs](https://discuss.elastic.co/t/filebeat-not-harvesting-logs/109854)
**Author:** [@david2](https://discuss.elastic.co/u/david2)\ **Replies:** 4\ **Last updated:** [December 4, 2017, 2:15am UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-logs/109854 "2017-12-04T02:15:39Z")
Hi, I am using filebeat and in particular the apache module to send the logs to ElasticSearch and it doesn't appear that the logs are being sent to ElasticSearch and are not appearing in Kibana. I have followed this pa… --- ## [Failed to start filebeat. Ubuntu 16.04](https://discuss.elastic.co/t/failed-to-start-filebeat-ubuntu-16-04/109520)
**Author:** [@purpleturtle99](https://discuss.elastic.co/u/purpleturtle99)\ **Replies:** 7\ **Last updated:** [December 3, 2017, 7:44am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-ubuntu-16-04/109520 "2017-12-03T07:44:46Z")
When I run: sudo systemctl status filebeat on my Ubuntu16.04 client I get the following error: Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: Active: failed (Result: exit-code) since Wed… --- ## [Tagging event logs in Winlogbeat in order to filter in Logstash](https://discuss.elastic.co/t/tagging-event-logs-in-winlogbeat-in-order-to-filter-in-logstash/109471)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 4\ **Last updated:** [December 2, 2017, 10:00pm UTC](https://discuss.elastic.co/t/tagging-event-logs-in-winlogbeat-in-order-to-filter-in-logstash/109471 "2017-12-02T22:00:15Z")
hello what would the solution be in winlogbeat.yml to this example from filelogbeat below i want to do special filtering on powershell logs and thus tag them or similar once it get to logstash here is my config from wi… --- ## [Fields merging in 6.0 differs from 5.x](https://discuss.elastic.co/t/fields-merging-in-6-0-differs-from-5-x/109838)
**Author:** [@tehmoon](https://discuss.elastic.co/u/tehmoon)\ **Replies:** 3\ **Last updated:** [December 1, 2017, 10:19pm UTC](https://discuss.elastic.co/t/fields-merging-in-6-0-differs-from-5-x/109838 "2017-12-01T22:19:33Z")
Hi! I was in the process of upgrade my filebeats from 5.6 to 6.0. But it broke my logstash pipeline. The reason is -- I think -- a bug in the merging fields process of the fields option in the yaml config file. My conf… --- ## [Filebeat's docker metadata watcher losing container from its list somehow](https://discuss.elastic.co/t/filebeats-docker-metadata-watcher-losing-container-from-its-list-somehow/109897)
**Author:** [@benben](https://discuss.elastic.co/u/benben)\ **Replies:** 5\ **Last updated:** [December 1, 2017, 3:15pm UTC](https://discuss.elastic.co/t/filebeats-docker-metadata-watcher-losing-container-from-its-list-somehow/109897 "2017-12-01T15:15:36Z")
After some random time, the watcher looses some(?) active containers. In the log you can see that filebeat is still reading correctly from docker logs but then says, it cannot find the container with add\_docker\_metadata.… --- ## [Exclude\_files doesn't work?](https://discuss.elastic.co/t/exclude-files-doesnt-work/109799)
**Author:** [@przemolb](https://discuss.elastic.co/u/przemolb)\ **Replies:** 3\ **Last updated:** [December 1, 2017, 10:56am UTC](https://discuss.elastic.co/t/exclude-files-doesnt-work/109799 "2017-12-01T10:56:51Z")
Hi, I have the following in my filebeat.yml (5.6): ... exclude\_files: \['.gz$', 'btmp\*', 'btmp$'\] ... but filebeat says in its logs: 2017-11-30T17:03:07Z INFO Harvester started for file: /var/log/wtmp 2017-11-30T17:… --- ## [Exiting: 1 error: 1 error: missing required field accessing '0.perfmon.counters'](https://discuss.elastic.co/t/exiting-1-error-1-error-missing-required-field-accessing-0-perfmon-counters/109641)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [December 1, 2017, 10:51am UTC](https://discuss.elastic.co/t/exiting-1-error-1-error-missing-required-field-accessing-0-perfmon-counters/109641 "2017-12-01T10:51:10Z")
I trying to use metricbeat 6.0.0 (windows64) C:\\Program Files\\metricbeat\>metricbeat.exe test config Config OK C:\\Program Files\\metricbeat\>metricbeat.exe test output elasticsearch: http://elasticsearch.xxxxx.local:9200.… --- ## [Modules.go Filebeat 5.6 - CentOS](https://discuss.elastic.co/t/modules-go-filebeat-5-6-centos/109721)
**Author:** [@lara](https://discuss.elastic.co/u/lara)\ **Replies:** 4\ **Last updated:** [December 1, 2017, 9:21am UTC](https://discuss.elastic.co/t/modules-go-filebeat-5-6-centos/109721 "2017-12-01T09:21:35Z")
Error in loading the modules. Filebeat 5.6 + CentOS ----error context----- 2017/11/30 09:21:42.132800 beat.go:297: INFO Home path: \[/usr/share/filebeat/bin\] Config path: \[/etc/filebeat\] Data path: \[/usr/share/filebeat… --- ## [Struggling with Multiline](https://discuss.elastic.co/t/struggling-with-multiline/109357)
**Author:** [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Replies:** 10\ **Last updated:** [December 1, 2017, 7:00am UTC](https://discuss.elastic.co/t/struggling-with-multiline/109357 "2017-12-01T07:00:10Z")
Good morning, I'm (still) facing some problems with the filebeat multiline feature. My filebeat.yml is the following: prospectors: - paths: - /tmp/multiline\*.log input\_type: log … --- ## [Filebeat is not able to parse json from files where \\n separated json lines (events) are written. It sometimes misses the records and sometimes gives error when traffic is high](https://discuss.elastic.co/t/filebeat-is-not-able-to-parse-json-from-files-where-n-separated-json-lines-events-are-written-it-sometimes-misses-the-records-and-sometimes-gives-error-when-traffic-is-high/107155)
**Author:** [@Aman\_Sehgal](https://discuss.elastic.co/u/Aman_Sehgal)\ **Replies:** 14\ **Last updated:** [December 1, 2017, 5:00am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-parse-json-from-files-where-n-separated-json-lines-events-are-written-it-sometimes-misses-the-records-and-sometimes-gives-error-when-traffic-is-high/107155 "2017-12-01T05:00:40Z")
I am using BELK stack for Log Analytics. versions: ES-5.1.1 is on AWS service Logstash-5.3.0, filebeat-5.3.0 and kibana-5.1.1 filebeat is running on the server where cdrs are generated. Logstash is running on separa… --- ## [Performance tunning](https://discuss.elastic.co/t/performance-tunning/108295)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 17\ **Last updated:** [December 1, 2017, 2:05am UTC](https://discuss.elastic.co/t/performance-tunning/108295 "2017-12-01T02:05:05Z")
Hi, running on 5.6.2 My topology is as follows. 3 Filebeat agents on 3 servers. 1 Logstash instance. 3 Elastic data nodes. Looking through the Kibana monitoring, Logstash indicates it's receiving about 1,500 events … --- ## [Metricbeat fsstat values are too high](https://discuss.elastic.co/t/metricbeat-fsstat-values-are-too-high/107453)
**Author:** [@vkurup](https://discuss.elastic.co/u/vkurup)\ **Replies:** 7\ **Last updated:** [November 30, 2017, 11:37pm UTC](https://discuss.elastic.co/t/metricbeat-fsstat-values-are-too-high/107453 "2017-11-30T23:37:31Z")
Hi, I'm new to the ELK stack and enjoying it so far. I'm running metricbeat on multiple servers and the fsstat.total\_size.total value is correct on all of them except for one server which happens to be the only one runni… --- ## [Needed building (configure,make and makeinstall ) steps for Filebeat from source on AIX](https://discuss.elastic.co/t/needed-building-configure-make-and-makeinstall-steps-for-filebeat-from-source-on-aix/109764)
**Author:** [@Ritesh\_Sharma](https://discuss.elastic.co/u/Ritesh_Sharma)\ **Replies:** 1\ **Last updated:** [November 30, 2017, 10:08pm UTC](https://discuss.elastic.co/t/needed-building-configure-make-and-makeinstall-steps-for-filebeat-from-source-on-aix/109764 "2017-11-30T22:08:28Z")
Hi Team, I am trying to fetch logs from my AIX source machines , since Filebeats is not supported officially on AIX but still i wanted to give it a try on AIX machines and hence decided to build its source from gccgo ; … --- ## [Event Caching?](https://discuss.elastic.co/t/event-caching/109668)
**Author:** [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Replies:** 8\ **Last updated:** [November 30, 2017, 7:06pm UTC](https://discuss.elastic.co/t/event-caching/109668 "2017-11-30T19:06:09Z")
Brand new to beats and really loving it so far. Just getting starting with optimizations and am not seeing anything for any type of event caching. I see the parameters for retries on publishing events: # The number of t… --- ## [Document\_type is being ignored](https://discuss.elastic.co/t/document-type-is-being-ignored/109667)
**Author:** [@Vivek\_Menon](https://discuss.elastic.co/u/Vivek_Menon)\ **Replies:** 4\ **Last updated:** [November 30, 2017, 6:29pm UTC](https://discuss.elastic.co/t/document-type-is-being-ignored/109667 "2017-11-30T18:29:03Z")
I am new to file beat. I am using filebeat to forward logs to logstash, from where it gets forwarded to elastic search. I am using version 6.0 for all of them. The problem I am having is that even if I set document\_typ… --- ## [How to auto start filebeat on RHEL65](https://discuss.elastic.co/t/how-to-auto-start-filebeat-on-rhel65/109693)
**Author:** [@rudee](https://discuss.elastic.co/u/rudee)\ **Replies:** 2\ **Last updated:** [November 30, 2017, 5:09pm UTC](https://discuss.elastic.co/t/how-to-auto-start-filebeat-on-rhel65/109693 "2017-11-30T17:09:14Z")
Hi does anyone know how to auto start the filebeat service on RHEL65? --- ## [Log archiving - Difference between ES vs LS](https://discuss.elastic.co/t/log-archiving-difference-between-es-vs-ls/109792)
**Author:** [@minidan](https://discuss.elastic.co/u/minidan)\ **Replies:** 4\ **Last updated:** [November 30, 2017, 5:00pm UTC](https://discuss.elastic.co/t/log-archiving-difference-between-es-vs-ls/109792 "2017-11-30T17:00:54Z")
Hi, I'm brand new to this and learning as I go slowly. I've setup a ELK stack to store windows event logs, which had been working successfully. I'm unclear on one point though, at present I am sending direct from winbe… --- ## [Winlogbeat Output to Kafka not Refreshing](https://discuss.elastic.co/t/winlogbeat-output-to-kafka-not-refreshing/109623)
**Author:** [@Ratnakar\_Sadasyula](https://discuss.elastic.co/u/Ratnakar_Sadasyula)\ **Replies:** 1\ **Last updated:** [November 29, 2017, 6:53pm UTC](https://discuss.elastic.co/t/winlogbeat-output-to-kafka-not-refreshing/109623 "2017-11-29T18:53:59Z")
Hi I am sending Winglogbeat Data from my System to Kafka. I find that on starting the Winlogbeat, it initially sends the data in interval of 5 minutes, 2-3 times, and then it just does not update further. I have tried… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=486) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=488)