# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=488 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 489 --- ## [Packetbeat memory and cpu consumption when monitoring cassandra ... continuation](https://discuss.elastic.co/t/packetbeat-memory-and-cpu-consumption-when-monitoring-cassandra-continuation/109750)
**Author:** [@chemt79](https://discuss.elastic.co/u/chemt79)\ **Replies:** 0\ **Last updated:** [November 30, 2017, 1:07pm UTC](https://discuss.elastic.co/t/packetbeat-memory-and-cpu-consumption-when-monitoring-cassandra-continuation/109750 "2017-11-30T13:07:26Z")
This is a continuation of topic Packetbeat memory and cpu consumption when monitoring cassandra I had the same problem. Packetbeat consumed a lot of memory. The problem was resolved by excluding AUTH\_SUCCESS packets. … --- ## [Metricbeat 6.0.0 Problem getting metrics from windows and linux Hosts](https://discuss.elastic.co/t/metricbeat-6-0-0-problem-getting-metrics-from-windows-and-linux-hosts/109720)
**Author:** [@Enzogan](https://discuss.elastic.co/u/Enzogan)\ **Replies:** 1\ **Last updated:** [November 30, 2017, 11:17am UTC](https://discuss.elastic.co/t/metricbeat-6-0-0-problem-getting-metrics-from-windows-and-linux-hosts/109720 "2017-11-30T11:17:30Z")
Hi, I'm testing Metricbeat 6.0.0 and i have some problem to get metrics in kibana from linux and windows hosts 1- I load the sample dashboard from the Windows Host 2- I start metricbeat from the same windows host (i'v… --- ## [ERR Kafka (topic={topic}): dropping too large message of size](https://discuss.elastic.co/t/err-kafka-topic-topic-dropping-too-large-message-of-size/109560)
**Author:** [@olololll](https://discuss.elastic.co/u/olololll)\ **Replies:** 2\ **Last updated:** [November 30, 2017, 9:03am UTC](https://discuss.elastic.co/t/err-kafka-topic-topic-dropping-too-large-message-of-size/109560 "2017-11-30T09:03:25Z")
Im using Filebeat(5.6.3) connecting to Kafka(0.10.2.1). However, i got an error as below in filebeat: \> 2017-11-29T17:12:28+08:00 ERR Kafka (topic=message): dropping too large message of large size 3038538. It means i… --- ## [What type is the "port" field in Heartbeat output?](https://discuss.elastic.co/t/what-type-is-the-port-field-in-heartbeat-output/108586)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 13\ **Last updated:** [November 30, 2017, 3:09am UTC](https://discuss.elastic.co/t/what-type-is-the-port-field-in-heartbeat-output/108586 "2017-11-30T03:09:21Z")
I think what I'm seeing is that (1) for a type HTTP monitor with the port specified in the "urls" the "port" field in the Elasticsearch document is a string (2) for a type TCP monitor with the port specified in the "po… --- ## [Can't start filebeat on client server](https://discuss.elastic.co/t/cant-start-filebeat-on-client-server/109417)
**Author:** [@Zurek](https://discuss.elastic.co/u/Zurek)\ **Replies:** 3\ **Last updated:** [November 29, 2017, 8:27pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-client-server/109417 "2017-11-29T20:27:08Z")
So i follow this tutorial https://www.linuxtechi.com/install-elk-stack-elasticsearch-logstash-kibana-centos7-rhel7/ and i have problem on client, with filebeat. \[filebeat\] \[journal\] conf yml file: https://www.dropbox… --- ## [Environment Variable](https://discuss.elastic.co/t/environment-variable/109330)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 7\ **Last updated:** [November 29, 2017, 7:57pm UTC](https://discuss.elastic.co/t/environment-variable/109330 "2017-11-29T19:57:51Z")
Hi All, I am trying to make the configuration automate through environment variable described below https://www.elastic.co/guide/en/beats/libbeat/6.0/config-file-format-env-vars.html but same is not working . please… --- ## [Filebeat / Send Logs](https://discuss.elastic.co/t/filebeat-send-logs/107923)
**Author:** [@rudee](https://discuss.elastic.co/u/rudee)\ **Replies:** 4\ **Last updated:** [November 29, 2017, 5:16pm UTC](https://discuss.elastic.co/t/filebeat-send-logs/107923 "2017-11-29T17:16:26Z")
Hi I am very new to Elastic and I have set up a lab, with componenets from the 5.6.4 stack (ElasticSearch/LogStash/Kibana/FileBeat) I have set up a node with FileBeat and can see the logs in Kibana. My question is, I … --- ## [Packetbeat.yml with\_vlans cannot work?](https://discuss.elastic.co/t/packetbeat-yml-with-vlans-cannot-work/109340)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 3\ **Last updated:** [November 29, 2017, 2:35pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans-cannot-work/109340 "2017-11-29T14:35:10Z")
Hello there, I will greatly appreciate help in making packetbeats work. I have add the option "with\_vlans" , but still not show vlan in my document How do I enable the option to packetbeat with\_vlans? my packetbeat… --- ## [Applying configuration to all prospectors](https://discuss.elastic.co/t/applying-configuration-to-all-prospectors/109431)
**Author:** [@vkurup](https://discuss.elastic.co/u/vkurup)\ **Replies:** 4\ **Last updated:** [November 29, 2017, 2:29pm UTC](https://discuss.elastic.co/t/applying-configuration-to-all-prospectors/109431 "2017-11-29T14:29:46Z")
Is it possible to apply configuration to 'all' prospectors? For example, I know i can set up 2 prospectors with multiline configuration like this: filebeat.prospectors: - input\_type: log paths: - /var/log/sy… --- ## [Filebeat 6.0 Multiline issue](https://discuss.elastic.co/t/filebeat-6-0-multiline-issue/109408)
**Author:** [@Oldo](https://discuss.elastic.co/u/Oldo)\ **Replies:** 16\ **Last updated:** [November 29, 2017, 2:15pm UTC](https://discuss.elastic.co/t/filebeat-6-0-multiline-issue/109408 "2017-11-29T14:15:07Z")
Hello. I use multiline in filebeat prospectors for procesing error messages with python trace. Example: - paths: - "/var/log/heat/\*.log" exclude\_lines: \['DEBUG'\] fields: service: heat … --- ## [Unable to get visualize data from postgres fusing metricbeat](https://discuss.elastic.co/t/unable-to-get-visualize-data-from-postgres-fusing-metricbeat/107760)
**Author:** [@Dinesh\_Senthil\_Kumar](https://discuss.elastic.co/u/Dinesh_Senthil_Kumar)\ **Replies:** 7\ **Last updated:** [November 29, 2017, 11:45am UTC](https://discuss.elastic.co/t/unable-to-get-visualize-data-from-postgres-fusing-metricbeat/107760 "2017-11-29T11:45:14Z")
Hi, i am using elk 5.6, i have installed elasticsearch and kibana successfully. i have configured metric beat , i am able to get all cpu metrics but am not gettign any metrics regrding postgres. while the metric beat… --- ## [Metricbeat visual builder uses wildcard for index](https://discuss.elastic.co/t/metricbeat-visual-builder-uses-wildcard-for-index/109463)
**Author:** [@evanb](https://discuss.elastic.co/u/evanb)\ **Replies:** 2\ **Last updated:** [November 29, 2017, 4:19am UTC](https://discuss.elastic.co/t/metricbeat-visual-builder-uses-wildcard-for-index/109463 "2017-11-29T04:19:55Z")
All of the visualizations imported for metricbeat that were Visual Builder visualizations used the wildcard () as the index. This made the dashboards very slow to load, I changed them to be metricbeat- and get a signifi… --- ## [What’s the means about this params in the metricbeat log file?](https://discuss.elastic.co/t/what-s-the-means-about-this-params-in-the-metricbeat-log-file/108999)
**Author:** [@AmosChen](https://discuss.elastic.co/u/AmosChen)\ **Replies:** 6\ **Last updated:** [November 29, 2017, 3:39am UTC](https://discuss.elastic.co/t/what-s-the-means-about-this-params-in-the-metricbeat-log-file/108999 "2017-11-29T03:39:14Z")
Hi, We run some metricbeat in our machines. And collect the run log every 10 mins. After check the log at /etc/log/metricbeat, we feel puzzled. And we don't find any document about it. One log record like followed: f… --- ## [fileBeat isn't harvesting the logs from the last path's](https://discuss.elastic.co/t/filebeat-isnt-harvesting-the-logs-from-the-last-paths/106841)
**Author:** [@shaked571](https://discuss.elastic.co/u/shaked571)\ **Replies:** 8\ **Last updated:** [November 29, 2017, 3:20am UTC](https://discuss.elastic.co/t/filebeat-isnt-harvesting-the-logs-from-the-last-paths/106841 "2017-11-29T03:20:34Z")
We are using ELK for controlling our program logs. In our FileBeat config we are harvesting from 30 different paths which contains files that updates every second (it updates every second only in the prod's machines - i… --- ## [Filebeat (5.5 with modules) fails to start when ES is down](https://discuss.elastic.co/t/filebeat-5-5-with-modules-fails-to-start-when-es-is-down/109429)
**Author:** [@rodche](https://discuss.elastic.co/u/rodche)\ **Replies:** 1\ **Last updated:** [November 29, 2017, 2:53am UTC](https://discuss.elastic.co/t/filebeat-5-5-with-modules-fails-to-start-when-es-is-down/109429 "2017-11-29T02:53:58Z")
I simply copied here the same question (unanswered, auto-closed): Whenever I use modules like syslog or nginx, I can’t get filebeat to start, if elasticsearch isn’t up and running. I get: " CRIT Exiting: Error creating … --- ## [Is the winlogbeat 6 template backwards compatible to 5.x?](https://discuss.elastic.co/t/is-the-winlogbeat-6-template-backwards-compatible-to-5-x/108594)
**Author:** [@kwslavens](https://discuss.elastic.co/u/kwslavens)\ **Replies:** 3\ **Last updated:** [November 29, 2017, 2:27am UTC](https://discuss.elastic.co/t/is-the-winlogbeat-6-template-backwards-compatible-to-5-x/108594 "2017-11-29T02:27:16Z")
Is it possible to feed winlogbeat 5.x agents to a index using a 6.0.0 template? Is the template backwards compatible? Here is the problem, with the way the new winlogbeat agents break out the templates into separate nam… --- ## [Metricbeat index missing field format](https://discuss.elastic.co/t/metricbeat-index-missing-field-format/108934)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 3\ **Last updated:** [November 29, 2017, 2:04am UTC](https://discuss.elastic.co/t/metricbeat-index-missing-field-format/108934 "2017-11-29T02:04:48Z")
Hi, I have metricbeat 5.4 deployed on multiple sources and data is being sent to ES as follows: Source (beat) \> Kafka \> LS 5.4 \> ES 5.4 (the index name is metricbeat-\* the default) My issue is for example any ".pct" o… --- ## [Json file from filebeat to Logstash and then to elasticsearch](https://discuss.elastic.co/t/json-file-from-filebeat-to-logstash-and-then-to-elasticsearch/108039)
**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\ **Replies:** 12\ **Last updated:** [November 29, 2017, 1:57am UTC](https://discuss.elastic.co/t/json-file-from-filebeat-to-logstash-and-then-to-elasticsearch/108039 "2017-11-29T01:57:17Z")
Hi I am few in setting filbeat, wondering i can get some advise . I am trying to ingested inventory data which is produced following json fileformat . { "\_meta": { "hostvars": { "host1": { "foreman": { "architectu… --- ## [Can't creat a Template](https://discuss.elastic.co/t/cant-creat-a-template/109010)
**Author:** [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\ **Replies:** 3\ **Last updated:** [November 29, 2017, 1:54am UTC](https://discuss.elastic.co/t/cant-creat-a-template/109010 "2017-11-29T01:54:09Z")
Hi, After two days trying basic stuff y can' t do that Filebeat and Kibana read my data log and split in my JSON fields to use the Kibana visualization tools, using the 5.6.4 version (last x32 bits version) Our logs ar… --- ## [ERR Failed to connect: Connection marked as failed because the onConnect callback failed](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed/109468)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 6\ **Last updated:** [November 28, 2017, 9:09pm UTC](https://discuss.elastic.co/t/err-failed-to-connect-connection-marked-as-failed-because-the-onconnect-callback-failed/109468 "2017-11-28T21:09:43Z")
My environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.4 (Maipo) # rpm -q elasticsearch filebeat elasticsearch-6.0.0-1.noarch filebeat-6.0.0-1.x86\_64 # I keep getting following error ins… --- ## [Metricbeat: postgresql (module); kibana: dashboard and/or visualize is missing?](https://discuss.elastic.co/t/metricbeat-postgresql-module-kibana-dashboard-and-or-visualize-is-missing/109436)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 9\ **Last updated:** [November 28, 2017, 8:52pm UTC](https://discuss.elastic.co/t/metricbeat-postgresql-module-kibana-dashboard-and-or-visualize-is-missing/109436 "2017-11-28T20:52:20Z")
I renamed postgresql.yml.disabled to postgresql.yml inside of /etc/metricbeat/modules.d/ directory, followed by restarting of metricbeat.service per following: PostgreSQL Module | Metricbeat Reference \[6.0\] | Elastic I… --- ## [Filebeat 6 + Apache2 module : fields not exported to Logstash](https://discuss.elastic.co/t/filebeat-6-apache2-module-fields-not-exported-to-logstash/109402)
**Author:** [@michaelbouvy](https://discuss.elastic.co/u/michaelbouvy)\ **Replies:** 4\ **Last updated:** [November 28, 2017, 4:44pm UTC](https://discuss.elastic.co/t/filebeat-6-apache2-module-fields-not-exported-to-logstash/109402 "2017-11-28T16:44:48Z")
Hi Everyone, I have recently a full Beats 6 + ELK 6 stack : Filebeat + Metricbeat agents on 2 servers, ELK on another one. I've configured both Metricbeat and Filebeat the same way to send data to Logstash over TLS, an… --- ## [Winlogbeat.exe setup --dashboards (FAILED)](https://discuss.elastic.co/t/winlogbeat-exe-setup-dashboards-failed/109416)
**Author:** [@cdra](https://discuss.elastic.co/u/cdra)\ **Replies:** 0\ **Last updated:** [November 28, 2017, 2:41pm UTC](https://discuss.elastic.co/t/winlogbeat-exe-setup-dashboards-failed/109416 "2017-11-28T14:41:21Z")
setup.kibana: host: "ZVDESELK1.xxxxxx.xxx.xx:5601" protocol: "https" username: admin password: admin output.elasticsearch: hosts: \["ZVDESELK1.xxxxx.xxx.xx:9200"\] protocol: "https" username: admin password: admin … --- ## [Filebeat + Kafka error](https://discuss.elastic.co/t/filebeat-kafka-error/109361)
**Author:** [@kamandohl](https://discuss.elastic.co/u/kamandohl)\ **Replies:** 1\ **Last updated:** [November 28, 2017, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-kafka-error/109361 "2017-11-28T14:39:50Z")
I have Googled enough, but unable to find the error I am currently seeing. Filebeat - 5.6.4 and 6.0.0 Kafka - 10.1 2017/11/27 13:10:03.602226 log.go:16: WARN kafka message: Initializing new client 2017/11/27 13:10:0… --- ## [Firewall Configuration for winlogbeat](https://discuss.elastic.co/t/firewall-configuration-for-winlogbeat/109377)
**Author:** [@rahul01](https://discuss.elastic.co/u/rahul01)\ **Replies:** 3\ **Last updated:** [November 28, 2017, 2:10pm UTC](https://discuss.elastic.co/t/firewall-configuration-for-winlogbeat/109377 "2017-11-28T14:10:22Z")
Hello, I'm using winlogbeat 6.0 and output to kafka on 10001 port. So how does winlogbeat works in firewall? Do I need to create inbound rule or outbound rule in windows server 2012 client? --- ## [Install Filebeat on the client side](https://discuss.elastic.co/t/install-filebeat-on-the-client-side/109113)
**Author:** [@joaoantoniopereira](https://discuss.elastic.co/u/joaoantoniopereira)\ **Replies:** 6\ **Last updated:** [November 28, 2017, 1:44pm UTC](https://discuss.elastic.co/t/install-filebeat-on-the-client-side/109113 "2017-11-28T13:44:54Z")
Hi! I am using the Log (server) -\> Filebeat (server) -\> Logstash (client) -\>Elasticsearch (client) pipeline. Is it possible to install Filebeat on the client side to collect logs from the server? If not is there a sim… --- ## [Filebeat for auditd events](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410)
**Author:** [@bm\_rec](https://discuss.elastic.co/u/bm_rec)\ **Replies:** 4\ **Last updated:** [November 28, 2017, 10:59am UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410 "2017-11-28T10:59:39Z")
Hello! Could you help me with my issue? I need to get security events from auditd. I've updated filebeat from 5.3.2 to 5.6.4 to 6.0.0. Filebeat worked via audisp-simplify. I want to exclude audisp-simplify from the syst… --- ## [Filebeat is not closig the file descriptor once the file is deleted/renamed](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-once-the-file-is-deleted-renamed/104077)
**Author:** [@swethamahesh](https://discuss.elastic.co/u/swethamahesh)\ **Replies:** 26\ **Last updated:** [November 27, 2017, 4:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-closig-the-file-descriptor-once-the-file-is-deleted-renamed/104077 "2017-11-27T04:53:01Z")
filebeat is not closing the file descriptor incase of file is been removed/rotated with version 5.5 and due to which disk usage is full 14327 0 lrwx------ 1 xxx xxx 64 Oct 13 13:23 /proc/1079/fd/7 -\>… --- ## [Webhdfs output in Filebeat](https://discuss.elastic.co/t/webhdfs-output-in-filebeat/109146)
**Author:** [@tivvit](https://discuss.elastic.co/u/tivvit)\ **Replies:** 1\ **Last updated:** [November 27, 2017, 12:18am UTC](https://discuss.elastic.co/t/webhdfs-output-in-filebeat/109146 "2017-11-27T00:18:37Z")
Hi, are you open to the idea of webhdfs output for Filebeat? Something like https://www.elastic.co/guide/en/logstash/current/plugins-outputs-webhdfs.html for Logstash. I am willing to work on that but I want to know i… --- ## [\[BUG\] system/memory report same used and actual used bytes and percent](https://discuss.elastic.co/t/bug-system-memory-report-same-used-and-actual-used-bytes-and-percent/106119)
**Author:** [@PChou](https://discuss.elastic.co/u/PChou)\ **Replies:** 2\ **Last updated:** [November 26, 2017, 10:35pm UTC](https://discuss.elastic.co/t/bug-system-memory-report-same-used-and-actual-used-bytes-and-percent/106119 "2017-11-26T22:35:31Z")
branch: master version: 6.0.0-alpha2+ platform: linux metricbeat report same memory.used and memory.acutal.used since the underline gosigar includes a bug, at this commit : Our team create a pull request to fix th… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=487) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=489)