# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=492 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 493 --- ## [Ipadress shown in kibana from winlogbeats](https://discuss.elastic.co/t/ipadress-shown-in-kibana-from-winlogbeats/106365)
**Author:** [@fatmafouad\_y](https://discuss.elastic.co/u/fatmafouad_y)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 2:09pm UTC](https://discuss.elastic.co/t/ipadress-shown-in-kibana-from-winlogbeats/106365 "2017-11-06T14:09:06Z")
hello , I did prepare a logstash.conf that brings for me ip address from host (winlogbeats). but didn't reach my goal ... all my components are latest version. I need help input { beats { port =\> 5044 } } filter { … --- ## [Where to see the logs if any error occurred while restart the filebeat](https://discuss.elastic.co/t/where-to-see-the-logs-if-any-error-occurred-while-restart-the-filebeat/106492)
**Author:** [@Rajeshwari](https://discuss.elastic.co/u/Rajeshwari)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 10:48am UTC](https://discuss.elastic.co/t/where-to-see-the-logs-if-any-error-occurred-while-restart-the-filebeat/106492 "2017-11-06T10:48:45Z")
Hi, Where to see the logs if any error occurred while restart the filebeat. I have done changes in filebeat.yml and restart the filbeat service. Fileabeat service is failed due to errors in filebeat.yml. Please advise… --- ## [Certificate revocation via CLR or OCSP](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382)
**Author:** [@9nativ](https://discuss.elastic.co/u/9nativ)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 10:45am UTC](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382 "2017-11-06T10:45:29Z")
Hi, We are using Filebeat (version 5.4.2) to ship our customer's logs to logstash servers and we are testing the process of server certificate revocation. As Filebeat using golang TLS stack, we noticed that Filebeat im… --- ## [Changes in filebeat.yml not reflecting in kibana](https://discuss.elastic.co/t/changes-in-filebeat-yml-not-reflecting-in-kibana/106494)
**Author:** [@Rajeshwari](https://discuss.elastic.co/u/Rajeshwari)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 9:52am UTC](https://discuss.elastic.co/t/changes-in-filebeat-yml-not-reflecting-in-kibana/106494 "2017-11-06T09:52:34Z")
Hi, I need to map the apache logs under this folder /opt/apache/apache-tomcat-9.0.0.M26/logs/\*.log. I have change the filebeat.yml like this filebeat.modules: - module: apache2 access enabled: true var.paths:/opt/… --- ## [Can we get FileBeats to optionally ignore DeviceID in FileStateOS?](https://discuss.elastic.co/t/can-we-get-filebeats-to-optionally-ignore-deviceid-in-filestateos/105967)
**Author:** [@xrl](https://discuss.elastic.co/u/xrl)\ **Replies:** 2\ **Last updated:** [November 6, 2017, 3:22am UTC](https://discuss.elastic.co/t/can-we-get-filebeats-to-optionally-ignore-deviceid-in-filestateos/105967 "2017-11-06T03:22:51Z")
I am running a data pipeline through filebeats, running on kubernetes. One container in the kubernetes pod receives traffic and dumps it to disk, the other container is filebeat. All traffic comes in to the pod through E… --- ## [Filebeat on laptop with Win 10](https://discuss.elastic.co/t/filebeat-on-laptop-with-win-10/106378)
**Author:** [@KJ\_Wijne](https://discuss.elastic.co/u/KJ_Wijne)\ **Replies:** 0\ **Last updated:** [November 4, 2017, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-on-laptop-with-win-10/106378 "2017-11-04T15:36:54Z")
Hello to all out there, Today I was trying to install filebeat on my laptop with Windows 10. Earlier I was able to install Elasticsearch, Kibana and Logstash. My account has administrator rights and I tried: PS C:\\Pr… --- ## [Two load balanced servers send same logs to logstash. But data not update real time in kibana dashboard](https://discuss.elastic.co/t/two-load-balanced-servers-send-same-logs-to-logstash-but-data-not-update-real-time-in-kibana-dashboard/106268)
**Author:** [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Replies:** 3\ **Last updated:** [November 3, 2017, 9:03am UTC](https://discuss.elastic.co/t/two-load-balanced-servers-send-same-logs-to-logstash-but-data-not-update-real-time-in-kibana-dashboard/106268 "2017-11-03T09:03:25Z")
Hi all, DESCRIPTION I have two logs 2 send to logstash. But these two logs available in two servers due load balancing. So I send them all to centralized logstash server as follows \[image\] following is my filebeat co… --- ## [Nvidia GPU](https://discuss.elastic.co/t/nvidia-gpu/106366)
**Author:** [@jcatana](https://discuss.elastic.co/u/jcatana)\ **Replies:** 0\ **Last updated:** [November 3, 2017, 9:58pm UTC](https://discuss.elastic.co/t/nvidia-gpu/106366 "2017-11-03T21:58:10Z")
Will Nvidia GPU Beat ever be merged into metricbeat as a module? --- ## [Dynamic Root Field](https://discuss.elastic.co/t/dynamic-root-field/105595)
**Author:** [@jcatana](https://discuss.elastic.co/u/jcatana)\ **Replies:** 9\ **Last updated:** [November 3, 2017, 9:54pm UTC](https://discuss.elastic.co/t/dynamic-root-field/105595 "2017-11-03T21:54:30Z")
How could I modify a beat to apply a dynamic root field to all events? For instance, I want to modify metricbeat and apply a set of tags for changing ongoing events to every metric that is collected so I can correlate o… --- ## [Filebeat JSON message](https://discuss.elastic.co/t/filebeat-json-message/106349)
**Author:** [@darrenthomas](https://discuss.elastic.co/u/darrenthomas)\ **Replies:** 2\ **Last updated:** [November 3, 2017, 7:00pm UTC](https://discuss.elastic.co/t/filebeat-json-message/106349 "2017-11-03T19:00:36Z")
Hi, I'm trying to get a basic Fliebeat example working and I am unable to get the message contents decomposed as JSON. I'll try and explain. I have a simple Node application writing to a log file. The log file output… --- ## [Event Log Record Number Tracking](https://discuss.elastic.co/t/event-log-record-number-tracking/106245)
**Author:** [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)\ **Replies:** 6\ **Last updated:** [November 3, 2017, 2:30pm UTC](https://discuss.elastic.co/t/event-log-record-number-tracking/106245 "2017-11-03T14:30:48Z")
Hi, For Winlogbeat there is a file in c:\\ProgramData\\Winlogbeat.winlogbeat.yml that shows you the last record sent to Elasticsearch from the machine. I noticed that if you delete this file it will not resend the events … --- ## [Monitor Kubernetes Cluster](https://discuss.elastic.co/t/monitor-kubernetes-cluster/106062)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 5\ **Last updated:** [November 3, 2017, 12:04pm UTC](https://discuss.elastic.co/t/monitor-kubernetes-cluster/106062 "2017-11-03T12:04:00Z")
Hi, I want monitor Kubernetes cluster in GCP, maybe look like sematext ( performance, audit ....) Can you tell me how i can or give me some suggestion Thanks ! \[image\] --- ## [Filebeat doesn't ignore .gz file when harvester file](https://discuss.elastic.co/t/filebeat-doesnt-ignore-gz-file-when-harvester-file/106263)
**Author:** [@vuxuanlai](https://discuss.elastic.co/u/vuxuanlai)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 11:26am UTC](https://discuss.elastic.co/t/filebeat-doesnt-ignore-gz-file-when-harvester-file/106263 "2017-11-03T11:26:12Z")
Hi there, I just want read log from specific file, exclude all .gz files and this is my filebeat.yml: - input\_type: log paths: - /var/log/glusterfs/\* document\_type: glusterfs exclude\_lines: \['^\[\[:blank:\]\]|^… --- ## [Can Filebeat send plain text instead of JSON](https://discuss.elastic.co/t/can-filebeat-send-plain-text-instead-of-json/106272)
**Author:** [@jmcjmcjmc](https://discuss.elastic.co/u/jmcjmcjmc)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 11:22am UTC](https://discuss.elastic.co/t/can-filebeat-send-plain-text-instead-of-json/106272 "2017-11-03T11:22:36Z")
Filebeat currently wraps all message in logfile in JSON format. Is it possible to ask it send the message as is? --- ## [Problem to connect filebeat to logstash (no route to host)](https://discuss.elastic.co/t/problem-to-connect-filebeat-to-logstash-no-route-to-host/106262)
**Author:** [@alexandre\_29](https://discuss.elastic.co/u/alexandre_29)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 1:18am UTC](https://discuss.elastic.co/t/problem-to-connect-filebeat-to-logstash-no-route-to-host/106262 "2017-11-03T01:18:13Z")
Hello, At first, sorry for my english because, i'm french :slight\_smile: I follow a tutorial to install ELK at this adress : https://www.howtoforge.com/tutorial/how-to-install-elastic-stack-on-centos-7/ I just have t… --- ## [Filebeat Nginx Module - Nginx log has a non default format](https://discuss.elastic.co/t/filebeat-nginx-module-nginx-log-has-a-non-default-format/106212)
**Author:** [@system](https://discuss.elastic.co/u/system)\ **Replies:** 2\ **Last updated:** [November 3, 2017, 12:32am UTC](https://discuss.elastic.co/t/filebeat-nginx-module-nginx-log-has-a-non-default-format/106212 "2017-11-03T00:32:58Z")
Hi can I find out what my options are if my nginx logs are not in the default format? I could send the logs from filebeat to logstash and have logstash parse the message there but wasn't sure if that was the right soluti… --- ## [Nginx module and keyword fields](https://discuss.elastic.co/t/nginx-module-and-keyword-fields/103277)
**Author:** [@aarongorka](https://discuss.elastic.co/u/aarongorka)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 11:24pm UTC](https://discuss.elastic.co/t/nginx-module-and-keyword-fields/103277 "2017-11-02T23:24:11Z")
The Nginx module for Filebeat seems to ship most fields as keywords, as indicated here: https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-nginx.html It makes it really difficult to do some more usefu… --- ## [Parse a log line and send only 1st 2 levels](https://discuss.elastic.co/t/parse-a-log-line-and-send-only-1st-2-levels/106238)
**Author:** [@pgokhale10](https://discuss.elastic.co/u/pgokhale10)\ **Replies:** 5\ **Last updated:** [November 2, 2017, 11:08pm UTC](https://discuss.elastic.co/t/parse-a-log-line-and-send-only-1st-2-levels/106238 "2017-11-02T23:08:49Z")
Hi, Lets says my log looks like this: IP - - \[24/Oct/2017:08:11:46 +0000\] "GET /X/Y/Z/ABCD HTTP/1.1" 200 1225 "www.x.com?query=&abcd" "Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.… --- ## [Filebeat: Variables in Output Hosts Doesn't Work](https://discuss.elastic.co/t/filebeat-variables-in-output-hosts-doesnt-work/106226)
**Author:** [@derekcal](https://discuss.elastic.co/u/derekcal)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 9:16pm UTC](https://discuss.elastic.co/t/filebeat-variables-in-output-hosts-doesnt-work/106226 "2017-11-02T21:16:40Z")
Is there a way to include variables in output hosts? For example filebeat.yml filebeat: config\_dir: "/var/filebeat/conf.d" output.kafka: hosts: "%{\[fields.mybrokers\]}" topic: "%{\[fields.mytopic\]}" conf.d/myc… --- ## [Command "filebeat modules list" doesn't work on Ubuntu](https://discuss.elastic.co/t/command-filebeat-modules-list-doesnt-work-on-ubuntu/106124)
**Author:** [@Mark\_Clarke](https://discuss.elastic.co/u/Mark_Clarke)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 6:48pm UTC](https://discuss.elastic.co/t/command-filebeat-modules-list-doesnt-work-on-ubuntu/106124 "2017-11-02T18:48:28Z")
Hi there, Maybe I am missing something but the docs say running "./filebeat module list" should output a list of modules. I have tried the following on Ubunut but the system just "hangs". I.e Nothing outputted to the co… --- ## [Filebeat stops sending json logs midway. Version: 6.0.0-rc1](https://discuss.elastic.co/t/filebeat-stops-sending-json-logs-midway-version-6-0-0-rc1/105885)
**Author:** [@rohit-smpx](https://discuss.elastic.co/u/rohit-smpx)\ **Replies:** 7\ **Last updated:** [November 2, 2017, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-json-logs-midway-version-6-0-0-rc1/105885 "2017-11-02T12:58:55Z")
I have some test logs in json format. The number of entries are 900+ in the file I'm testing. After a fresh installation, Filebeat starts sending the logs but after some time (a few minute) starts giving this err: ERR … --- ## [Max\_bytes and multilines](https://discuss.elastic.co/t/max-bytes-and-multilines/105884)
**Author:** [@vkakhnych](https://discuss.elastic.co/u/vkakhnych)\ **Replies:** 6\ **Last updated:** [November 2, 2017, 12:28pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884 "2017-11-02T12:28:33Z")
max\_bytes works fine on input messages but after applying multiline filter all new line bytes in original message replacing by two printable bytes: \\n and we get a little larger size of message that we send further. Is i… --- ## [Docker unix socket i/o timeout error despite correctly working](https://discuss.elastic.co/t/docker-unix-socket-i-o-timeout-error-despite-correctly-working/103333)
**Author:** [@kwaio](https://discuss.elastic.co/u/kwaio)\ **Replies:** 7\ **Last updated:** [November 2, 2017, 8:43am UTC](https://discuss.elastic.co/t/docker-unix-socket-i-o-timeout-error-despite-correctly-working/103333 "2017-11-02T08:43:31Z")
OS: CentOS 7, kernel 3.10 Docker version : 1.12.6 Elastic version : 5.6.2 Metricbeat version : 5.6.2 Hi, I'm trying to run metricbeat as a docker container to monitor other docker containers. As I don't have the sa… --- ## [Filebeat auto stop without kill](https://discuss.elastic.co/t/filebeat-auto-stop-without-kill/106133)
**Author:** [@Jay\_Dabhi](https://discuss.elastic.co/u/Jay_Dabhi)\ **Replies:** 1\ **Last updated:** [November 2, 2017, 8:04am UTC](https://discuss.elastic.co/t/filebeat-auto-stop-without-kill/106133 "2017-11-02T08:04:54Z")
Hi, I have observed that filebeat runs forever after ingestion of all logs. Is there any way through which filebeat will auto stop after the all logs are ingested? --- ## [MS Office 365 beat](https://discuss.elastic.co/t/ms-office-365-beat/105860)
**Author:** [@saif](https://discuss.elastic.co/u/saif)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 7:57am UTC](https://discuss.elastic.co/t/ms-office-365-beat/105860 "2017-11-02T07:57:15Z")
Hello, I'm trying to find a scenario to get logs(audit, security) from Office365. O365 have an API called : Office365 Management Logs so how to collect these logs and send it to logstash via filebeat i resume O365 A… --- ## [Configuration indices in Filebeat.yaml](https://discuss.elastic.co/t/configuration-indices-in-filebeat-yaml/105636)
**Author:** [@YaroslavN](https://discuss.elastic.co/u/YaroslavN)\ **Replies:** 4\ **Last updated:** [November 2, 2017, 7:30am UTC](https://discuss.elastic.co/t/configuration-indices-in-filebeat-yaml/105636 "2017-11-02T07:30:33Z")
Hi, I try to setup different index names depends on types specified in different file prospectors. For example: - input\_type: log paths: - /path\_to\_log/application1.log fields: type: "application1" field… --- ## [Filebeat's module using Logstash](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049)
**Author:** [@Elezium](https://discuss.elastic.co/u/Elezium)\ **Replies:** 5\ **Last updated:** [November 2, 2017, 2:11am UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049 "2017-11-02T02:11:42Z")
Hi, I'm facing issue with Filebeat's module and Logstash, If I use FileBeat and set the output to Elastic Search, everything seems to run fine. But if I output to LogStash, I do see the data in Elasticsearch but they … --- ## [Filebeat & Logstash with intermediate CA (cert chain) Issues](https://discuss.elastic.co/t/filebeat-logstash-with-intermediate-ca-cert-chain-issues/105675)
**Author:** [@Mark\_Clarke](https://discuss.elastic.co/u/Mark_Clarke)\ **Replies:** 4\ **Last updated:** [November 1, 2017, 9:50pm UTC](https://discuss.elastic.co/t/filebeat-logstash-with-intermediate-ca-cert-chain-issues/105675 "2017-11-01T21:50:57Z")
Hi all, I have an intermediate CA sign the certs for the filebeat client. I have entered the chain file in logstash configuration for the filebeat input stanza in the certificates-authorities entry. input { beats { … --- ## [Install Filebeat on Solaris 10](https://discuss.elastic.co/t/install-filebeat-on-solaris-10/106085)
**Author:** [@wako85](https://discuss.elastic.co/u/wako85)\ **Replies:** 5\ **Last updated:** [November 1, 2017, 8:16pm UTC](https://discuss.elastic.co/t/install-filebeat-on-solaris-10/106085 "2017-11-01T20:16:23Z")
Hello, Has anyone been able to install filebeat on solaris10 and 11? Kindly share how this has been done please Thanks, Wako --- ## [How to use Filebeat pipelines for both source and dest GeoIP](https://discuss.elastic.co/t/how-to-use-filebeat-pipelines-for-both-source-and-dest-geoip/105891)
**Author:** [@Clueless](https://discuss.elastic.co/u/Clueless)\ **Replies:** 2\ **Last updated:** [November 1, 2017, 1:20pm UTC](https://discuss.elastic.co/t/how-to-use-filebeat-pipelines-for-both-source-and-dest-geoip/105891 "2017-11-01T13:20:55Z")
I am ingesting network data, and trying to get both the destination and source IP address to populate as geoips. I am able to get one of them to work while using Filebeat pipeline, and elasticsearch's GeoIP plugin, but n… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=491) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=493)