# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=489 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 490 --- ## [Metricbeat/mongodb leaks connections when metricbeat.config.modules.reload.enabled set to true](https://discuss.elastic.co/t/metricbeat-mongodb-leaks-connections-when-metricbeat-config-modules-reload-enabled-set-to-true/108723)
**Author:** [@david.kostal](https://discuss.elastic.co/u/david.kostal)\ **Replies:** 4\ **Last updated:** [November 26, 2017, 9:47pm UTC](https://discuss.elastic.co/t/metricbeat-mongodb-leaks-connections-when-metricbeat-config-modules-reload-enabled-set-to-true/108723 "2017-11-26T21:47:33Z")
Hi, I just enabled metricbeat's mongodb module (5.6) and suddenly our mongdb run out of file descriptors. I noticed that metricbeat keeps thousands of connections open to the mongodb. Further investigation showed that … --- ## [Problem with Filebeat sending data to logstash](https://discuss.elastic.co/t/problem-with-filebeat-sending-data-to-logstash/108733)
**Author:** [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Replies:** 6\ **Last updated:** [November 26, 2017, 8:30am UTC](https://discuss.elastic.co/t/problem-with-filebeat-sending-data-to-logstash/108733 "2017-11-26T08:30:23Z")
After I successfully made it to connect FileBeat with Logstash and Elasticsearch I am now having troubles with it, I tried to adjust my filter in Logstash and even after getting it back to the initial state I am unable t… --- ## [Multi packetbeat instances](https://discuss.elastic.co/t/multi-packetbeat-instances/109127)
**Author:** [@Aner\_Izraeli1](https://discuss.elastic.co/u/Aner_Izraeli1)\ **Replies:** 0\ **Last updated:** [November 26, 2017, 8:00am UTC](https://discuss.elastic.co/t/multi-packetbeat-instances/109127 "2017-11-26T08:00:51Z")
Hello, Im checking the possibility to use more than 1 packetbeat on the same server. many backetbeat instances in parallel. This is because a single packetbeat instance cannot keep up with large volumes of traffic on m… --- ## [Where 'INFO Register' is generated within metricbeat log file?](https://discuss.elastic.co/t/where-info-register-is-generated-within-metricbeat-log-file/108990)
**Author:** [@AmosChen](https://discuss.elastic.co/u/AmosChen)\ **Replies:** 2\ **Last updated:** [November 26, 2017, 2:50am UTC](https://discuss.elastic.co/t/where-info-register-is-generated-within-metricbeat-log-file/108990 "2017-11-26T02:50:43Z")
hi,I find the information in the metrcibeat log file,with the following content INFO Register \[ModuleFactory:\[docker, mongodb, mysql, postgresql, system\], MetricSetFactory:\[apache/status, ceph/cluster\_disk, ceph/cluster… --- ## [CRIT Exiting: Error importing Kibana dashboards: fail to import the dashboards in Kibana](https://discuss.elastic.co/t/crit-exiting-error-importing-kibana-dashboards-fail-to-import-the-dashboards-in-kibana/108956)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 3:10pm UTC](https://discuss.elastic.co/t/crit-exiting-error-importing-kibana-dashboards-fail-to-import-the-dashboards-in-kibana/108956 "2017-11-24T15:10:14Z")
I'm trying to import dashboards into Kibana and getting following: root@suey:/usr/share/metricbeat/bin# ./metricbeat -c /etc/metricbeat/metricbeat.yml setup -e 2017/11/24 03:47:30.504575 beat.go:426: INFO Home path: \[… --- ## [Filebeat 6.0 not loading the data file](https://discuss.elastic.co/t/filebeat-6-0-not-loading-the-data-file/108920)
**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 10:20am UTC](https://discuss.elastic.co/t/filebeat-6-0-not-loading-the-data-file/108920 "2017-11-24T10:20:22Z")
Hi I have recently downloaded a filbeat 6.0 and trying to load the json file . However filebeat Starts Successfully but do not load the json file to send data . Is there any extra setting I need to enable in order to a… --- ## [Metricbeat6.0 system module doesn't capture linux system process](https://discuss.elastic.co/t/metricbeat6-0-system-module-doesnt-capture-linux-system-process/108654)
**Author:** [@shiloong](https://discuss.elastic.co/u/shiloong)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 1:26am UTC](https://discuss.elastic.co/t/metricbeat6-0-system-module-doesnt-capture-linux-system-process/108654 "2017-11-24T01:26:38Z")
I'm recently use metricbeat to monitor my server；and I found as default in Linux platform metricbeat system module doesn't capture the system process there cmdline always like this \[xxxx\] ,I haven't found them from the… --- ## [CRIT Exiting: Could not start registrar: Error loading state: Error decoding states: json: cannot unmarshal object into Go value of type \[\]file](https://discuss.elastic.co/t/crit-exiting-could-not-start-registrar-error-loading-state-error-decoding-states-json-cannot-unmarshal-object-into-go-value-of-type-file/108887)
**Author:** [@David\_Montgomery](https://discuss.elastic.co/u/David_Montgomery)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 8:38pm UTC](https://discuss.elastic.co/t/crit-exiting-could-not-start-registrar-error-loading-state-error-decoding-states-json-cannot-unmarshal-object-into-go-value-of-type-file/108887 "2017-11-23T20:38:58Z")
Why? Writing to log to AWS Es as a service. ES..whats the deal? What does that mean? How do I ship to ES using file beat on 16.04? filebeat: prospectors: - paths: - "/tmp/upload.log" - "/var/log/nginx/access.lo… --- ## [Filebeat Logstash scaling](https://discuss.elastic.co/t/filebeat-logstash-scaling/108872)
**Author:** [@ntviet18](https://discuss.elastic.co/u/ntviet18)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 8:27pm UTC](https://discuss.elastic.co/t/filebeat-logstash-scaling/108872 "2017-11-23T20:27:40Z")
I have a BELK cluster in Kubernetes. Recently I need to scale number of my Logstash instances. However, Filebeats just keep pushing logs to the older instances. How long will it take for Filebeats to detects the new inst… --- ## [Filebeat is not running after ELK setup in ubuntu machine](https://discuss.elastic.co/t/filebeat-is-not-running-after-elk-setup-in-ubuntu-machine/108663)
**Author:** [@anujjain0801](https://discuss.elastic.co/u/anujjain0801)\ **Replies:** 8\ **Last updated:** [November 23, 2017, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-is-not-running-after-elk-setup-in-ubuntu-machine/108663 "2017-11-23T14:22:07Z")
Hi Team, Recently I started setting up ELK in one of the ubuntu machines and Filebeat in someother machine using the https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-… --- ## [Not Able to load template manually for logstach!](https://discuss.elastic.co/t/not-able-to-load-template-manually-for-logstach/108543)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 8\ **Last updated:** [November 23, 2017, 11:13am UTC](https://discuss.elastic.co/t/not-able-to-load-template-manually-for-logstach/108543 "2017-11-23T11:13:12Z")
Hi All , I am not able to load template manually from filebeat as i am using logstach as outpout . getting below error :- ./filebeat -setup filebeat.template.json Exiting: Dashboard loading requested but the Elastic… --- ## [Journalbeat + monitoring API](https://discuss.elastic.co/t/journalbeat-monitoring-api/108718)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 9:50am UTC](https://discuss.elastic.co/t/journalbeat-monitoring-api/108718 "2017-11-23T09:50:51Z")
I am installing Jouralbeat on my server and I see I can specify journalbeat configuration to monitor specific systemd services. I have a house build API, which logs to a unique log file, under /var/log. Is it possible t… --- ## [Filebeat stops forwarding logs to Logstash after setting max harvesters](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700)
**Author:** [@ntviet18](https://discuss.elastic.co/u/ntviet18)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700 "2017-11-23T09:49:42Z")
Due to some resource limitations I have to set maximum number of Filebeat harvesters. But after that change there are no more logs forwarded to Logstash. Here are some logs from Filebeat 2017/11/22 11:13:56.421773 pro… --- ## [Filebeat config prospectors not working in 6.0](https://discuss.elastic.co/t/filebeat-config-prospectors-not-working-in-6-0/108007)
**Author:** [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\ **Replies:** 6\ **Last updated:** [November 23, 2017, 9:47am UTC](https://discuss.elastic.co/t/filebeat-config-prospectors-not-working-in-6-0/108007 "2017-11-23T09:47:36Z")
Hey everybody, So I upgraded filebeat to version 6.0.0 and I saw this message in the logs: WARN DEPRECATED: config\_dir is deprecated. Use filebeat.config.prospectors instead. Will be removed in version: 7.0.0 So I wen… --- ## [Metricbeat not loading Kube-state-metrics metrices](https://discuss.elastic.co/t/metricbeat-not-loading-kube-state-metrics-metrices/108736)
**Author:** [@manya12](https://discuss.elastic.co/u/manya12)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 3:01pm UTC](https://discuss.elastic.co/t/metricbeat-not-loading-kube-state-metrics-metrices/108736 "2017-11-22T15:01:15Z")
Hi Team, This is my kubernetes.yml in /etc/metricbeat/modules.d/ Node metrics, from kubelet: module: kubernetes metricsets: node system pod container volume period: 10s hosts: \["localhost:10255"\] State metrics … --- ## ["make collect" for beat based on metricbeat overwrite some configs](https://discuss.elastic.co/t/make-collect-for-beat-based-on-metricbeat-overwrite-some-configs/108518)
**Author:** [@shino](https://discuss.elastic.co/u/shino)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 11:45pm UTC](https://discuss.elastic.co/t/make-collect-for-beat-based-on-metricbeat-overwrite-some-configs/108518 "2017-11-21T23:45:09Z")
Hi there, I created a beat based on metricbeat by following "Creating a Beat based on Metricbeat | Beats Developer Guide \[6.0\] | Elastic" https://www.elastic.co/guide/en/beats/devguide/6.0/creating-beat-from-metricbeat… --- ## [Pass file attributes with filebeat](https://discuss.elastic.co/t/pass-file-attributes-with-filebeat/108509)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 11:33pm UTC](https://discuss.elastic.co/t/pass-file-attributes-with-filebeat/108509 "2017-11-21T23:33:54Z")
Hi is there any way that I can ship the file's attributes (metadata) with the events in it ? I'm talking about attributes that I get from the getfattr command To add it like a field to each event in it or something ? --- ## [Mongodb/Postgres etc modules and password management](https://discuss.elastic.co/t/mongodb-postgres-etc-modules-and-password-management/108336)
**Author:** [@amit\_oren](https://discuss.elastic.co/u/amit_oren)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 10:49pm UTC](https://discuss.elastic.co/t/mongodb-postgres-etc-modules-and-password-management/108336 "2017-11-21T22:49:49Z")
Hello, I was wondering what are the best practices for password management of these modules and git. i don't want to save these as plaintext in github - that's a very bad practice. Is there any way to have them as secr… --- ## [Filebeat: how to pass file properties to Logstash?](https://discuss.elastic.co/t/filebeat-how-to-pass-file-properties-to-logstash/108289)
**Author:** [@Asaf\_Shabat](https://discuss.elastic.co/u/Asaf_Shabat)\ **Replies:** 5\ **Last updated:** [November 21, 2017, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-how-to-pass-file-properties-to-logstash/108289 "2017-11-21T22:45:34Z")
Hello, How can I read a file property (file.log) which holds a key value, for example: \[image\] I want to pass the "user.comment" value to Logstash via Filebeat and to show it inside Kibana. Thanks! --- ## [How do i collect logs from IBM SAN controller, SAN Directors, San storage arrays](https://discuss.elastic.co/t/how-do-i-collect-logs-from-ibm-san-controller-san-directors-san-storage-arrays/108161)
**Author:** [@eamonn](https://discuss.elastic.co/u/eamonn)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 10:40pm UTC](https://discuss.elastic.co/t/how-do-i-collect-logs-from-ibm-san-controller-san-directors-san-storage-arrays/108161 "2017-11-21T22:40:37Z")
Continuing the discussion from Collecting Storage metrics and logs into ELK stack: I need to collect log files from IBM SAN controller, SAN Directors, and San storage arrays and send them to log-stash. I am at the des… --- ## [Coupling Filebeat prospector with Logstash pipeline](https://discuss.elastic.co/t/coupling-filebeat-prospector-with-logstash-pipeline/108349)
**Author:** [@dba](https://discuss.elastic.co/u/dba)\ **Replies:** 3\ **Last updated:** [November 21, 2017, 12:38pm UTC](https://discuss.elastic.co/t/coupling-filebeat-prospector-with-logstash-pipeline/108349 "2017-11-21T12:38:26Z")
Hi We are moving to ELK 6.0 and are very pleased that we can now define filebeat prospectors and logstash pipelines in their own files. This makes it easier for our teams to create and deploy their own configurations (a… --- ## [Can metricbeat save events to a local file for a while in case logstash or elasticsearch has problem](https://discuss.elastic.co/t/can-metricbeat-save-events-to-a-local-file-for-a-while-in-case-logstash-or-elasticsearch-has-problem/108507)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 2\ **Last updated:** [November 21, 2017, 12:26pm UTC](https://discuss.elastic.co/t/can-metricbeat-save-events-to-a-local-file-for-a-while-in-case-logstash-or-elasticsearch-has-problem/108507 "2017-11-21T12:26:44Z")
Dear ESers, I have a question, with ELK solution, We don't deploy a queuing system like rabbitMQ/redis/kafaka to hold the events yet. if the shipper side(metricbeat) recognized logstash/elasticsearch has problem, can… --- ## [How to add a new field ？](https://discuss.elastic.co/t/how-to-add-a-new-field/108491)
**Author:** [@Yi\_Ge](https://discuss.elastic.co/u/Yi_Ge)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 12:24pm UTC](https://discuss.elastic.co/t/how-to-add-a-new-field/108491 "2017-11-21T12:24:58Z")
I tried to add a new field for mysql protocol when run make test，I got an error： \[image\] Can anybody help？ --- ## [Multiline in filebeat](https://discuss.elastic.co/t/multiline-in-filebeat/107879)
**Author:** [@Manasa](https://discuss.elastic.co/u/Manasa)\ **Replies:** 2\ **Last updated:** [November 21, 2017, 2:50am UTC](https://discuss.elastic.co/t/multiline-in-filebeat/107879 "2017-11-21T02:50:20Z")
Multiline is clubbing unmatched lines to another event. Please let me know how I can exclude those lines. I want only the XML in the output. Example log file line1 line2 \ inside the xml1 inside the xml1-abc \<… --- ## [New field to filebeat.tempalte.default.json](https://discuss.elastic.co/t/new-field-to-filebeat-tempalte-default-json/104285)
**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Replies:** 5\ **Last updated:** [November 20, 2017, 11:11pm UTC](https://discuss.elastic.co/t/new-field-to-filebeat-tempalte-default-json/104285 "2017-11-20T23:11:24Z")
Hi guys, i am new to elk architecture and trying to understand how can i add extra fields to my default filebeat.tempalte.default.json search pattern that i loaded on ELK server by executing: curl -XPUT 'http://localhos… --- ## [Log4j w/ Filebeats + Logstash - best practice(s)?](https://discuss.elastic.co/t/log4j-w-filebeats-logstash-best-practice-s/108171)
**Author:** [@seanleblanc](https://discuss.elastic.co/u/seanleblanc)\ **Replies:** 1\ **Last updated:** [November 20, 2017, 10:53pm UTC](https://discuss.elastic.co/t/log4j-w-filebeats-logstash-best-practice-s/108171 "2017-11-20T22:53:02Z")
I have just set up an ELK stack (on Centos 6.7). I have Filebeat set up to harvest files from an application server, but I'm trying to figure out what the current best practices are for shipping/parsing/searching on log4… --- ## [Cannot read Security logs](https://discuss.elastic.co/t/cannot-read-security-logs/107842)
**Author:** [@robert-blankenship](https://discuss.elastic.co/u/robert-blankenship)\ **Replies:** 14\ **Last updated:** [November 20, 2017, 10:47pm UTC](https://discuss.elastic.co/t/cannot-read-security-logs/107842 "2017-11-20T22:47:59Z")
When I right click winlogbeat executable and select Run As Administrator, I get the following message in the log file: WARN EventLog\[Security\] Open() error. No events will be read from this source. Accessis denied." I… --- ## [Debugging event publishing](https://discuss.elastic.co/t/debugging-event-publishing/108298)
**Author:** [@Nir\_Varon](https://discuss.elastic.co/u/Nir_Varon)\ **Replies:** 1\ **Last updated:** [November 20, 2017, 8:02pm UTC](https://discuss.elastic.co/t/debugging-event-publishing/108298 "2017-11-20T20:02:22Z")
I would like to index 2 Json files (one event line per file) directly to Elastic. Here is my Filebeat configuraion: filebeat.modules: filebeat.prospectors: - input\_type: log paths: encoding: utf-8 fields: documen… --- ## [Metricbeat not loading in ES indices](https://discuss.elastic.co/t/metricbeat-not-loading-in-es-indices/108274)
**Author:** [@Alaric](https://discuss.elastic.co/u/Alaric)\ **Replies:** 8\ **Last updated:** [November 20, 2017, 7:05pm UTC](https://discuss.elastic.co/t/metricbeat-not-loading-in-es-indices/108274 "2017-11-20T19:05:25Z")
I end up here after several hours of pain. I setup a Elasticsearch / Kibana (no Logstash) installation to monitor RAM/CPU/and so on on a ubuntu VM. I installed metricbeat but I do not manage to have the MB indice loade… --- ## [Not all metricsets events are captured](https://discuss.elastic.co/t/not-all-metricsets-events-are-captured/107089)
**Author:** [@Vishnu59](https://discuss.elastic.co/u/Vishnu59)\ **Replies:** 6\ **Last updated:** [November 20, 2017, 4:44pm UTC](https://discuss.elastic.co/t/not-all-metricsets-events-are-captured/107089 "2017-11-20T16:44:40Z")
Hi There, We are using metricbeat, logstash and ElasticSearch combination to gather system metrics. Last night we had an issue with a VM where CPU utilization pegged up to 100% and that in turn had some kind of affect o… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=488) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=490)