# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=493 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 494 --- ## [\[BUG\] Incorrect disk usage statistics](https://discuss.elastic.co/t/bug-incorrect-disk-usage-statistics/103207)
**Author:** [@hogarthj](https://discuss.elastic.co/u/hogarthj)\ **Replies:** 2\ **Last updated:** [November 1, 2017, 8:06pm UTC](https://discuss.elastic.co/t/bug-incorrect-disk-usage-statistics/103207 "2017-11-01T20:06:18Z")
Using metricbeat-5.6.0-1 on RHEL6 with a 5.6 ELK stack, The metrics returned for system.filesystem.used.pct are incorrect. The sigar go library returns the raw results of statfs and the metricbeat code just turns that … --- ## [How to Monitor particular process and file system disk space through metricbeat](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909)
**Author:** [@udareddy](https://discuss.elastic.co/u/udareddy)\ **Replies:** 3\ **Last updated:** [November 1, 2017, 7:33pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909 "2017-11-01T19:33:48Z")
Hi All, I am happy that we have very good forum to discuss and help each other on ELK stack, and am very new to ELK stack integrations but I have good knowledge on Splunk integration. I am seeking help on below requir… --- ## [Filebeat - json - elastic search - decoding time stamps](https://discuss.elastic.co/t/filebeat-json-elastic-search-decoding-time-stamps/105970)
**Author:** [@motamedi791](https://discuss.elastic.co/u/motamedi791)\ **Replies:** 1\ **Last updated:** [November 1, 2017, 12:05pm UTC](https://discuss.elastic.co/t/filebeat-json-elastic-search-decoding-time-stamps/105970 "2017-11-01T12:05:34Z")
I have setup the filebeat to forward json logfiles to the elasticsearch server. Here is my filebeat configuration: filebeat.prospectors: - input\_type: log paths: - /data/log/1.log json.keys\_under\_root: true js… --- ## ["Drop\_event" does not work](https://discuss.elastic.co/t/drop-event-does-not-work/105755)
**Author:** [@AmosChen](https://discuss.elastic.co/u/AmosChen)\ **Replies:** 4\ **Last updated:** [November 1, 2017, 2:20am UTC](https://discuss.elastic.co/t/drop-event-does-not-work/105755 "2017-11-01T02:20:00Z")
Hello I have a filter in my metricbeat.yml,part of the config file like this: - module: system metricsets: \[network\] enabled: true filters: - drop\_event.when.equals.system.network.name: lo I want to drop the… --- ## [Filebeat and missing logs](https://discuss.elastic.co/t/filebeat-and-missing-logs/105809)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 1\ **Last updated:** [October 31, 2017, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-and-missing-logs/105809 "2017-10-31T15:48:09Z")
We are trying to deploy Filebeat to a steaming pile of Beanstalk instances. In our case, different instances have different applications, and perhaps different logs to monitor. The process for automating a per-app c… --- ## [Heartbeat Status logged to /var/log/messages](https://discuss.elastic.co/t/heartbeat-status-logged-to-var-log-messages/105756)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 5\ **Last updated:** [October 30, 2017, 3:09pm UTC](https://discuss.elastic.co/t/heartbeat-status-logged-to-var-log-messages/105756 "2017-10-30T15:09:15Z")
Heartbeat is configured in Redhat and status logs for each URL that heartbeat validates sends the log information to /var/log/messages. This file is growing like anything. Is there a way to stop/suppress logging the hear… --- ## [Filebeat can't pull to lofstash with x-pack](https://discuss.elastic.co/t/filebeat-cant-pull-to-lofstash-with-x-pack/104487)
**Author:** [@Dees7](https://discuss.elastic.co/u/Dees7)\ **Replies:** 7\ **Last updated:** [October 30, 2017, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-cant-pull-to-lofstash-with-x-pack/104487 "2017-10-30T12:50:55Z")
I installed x-pack to elastic, logstash, kibana and now filebeat can't sent to logstash: ERR Connecting error publishing events (retrying): read tcp 192.168.100.2:54230-\>192.168.100.2:5044: i/o timeout I configure fil… --- ## [How to list modules](https://discuss.elastic.co/t/how-to-list-modules/105727)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [October 30, 2017, 9:52am UTC](https://discuss.elastic.co/t/how-to-list-modules/105727 "2017-10-30T09:52:19Z")
Hi, I'm looking at the documentation here: https://www.elastic.co/guide/en/beats/metricbeat/master/configuration-metricbeat.html#enable-modules-d-configs When I try to list modules as outlined I get this error: metri… --- ## [Unable to parse files to logstash](https://discuss.elastic.co/t/unable-to-parse-files-to-logstash/105514)
**Author:** [@Shaswata\_Bisi](https://discuss.elastic.co/u/Shaswata_Bisi)\ **Replies:** 4\ **Last updated:** [October 30, 2017, 7:12am UTC](https://discuss.elastic.co/t/unable-to-parse-files-to-logstash/105514 "2017-10-30T07:12:43Z")
hi. I am new to elastic search. I tried to send log files through file beat into the logstash but I am not getting any outcome in the console. my configuration file is as follows input { beats { host =\> "10.53.56.98" … --- ## [Hi i'm having trouble with this filebeat.yml configuration](https://discuss.elastic.co/t/hi-im-having-trouble-with-this-filebeat-yml-configuration/105325)
**Author:** [@Shakirah](https://discuss.elastic.co/u/Shakirah)\ **Replies:** 1\ **Last updated:** [October 26, 2017, 11:45am UTC](https://discuss.elastic.co/t/hi-im-having-trouble-with-this-filebeat-yml-configuration/105325 "2017-10-26T11:45:14Z")
i'm having this kind of error and i don't have any other solutions anymore on how to fix this things up. Kindly please help me Error Initialising publisher: beat.go:161: CRIT No outputs are defined. Please define one un… --- ## [From filebeat to logstash](https://discuss.elastic.co/t/from-filebeat-to-logstash/105695)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 2:00am UTC](https://discuss.elastic.co/t/from-filebeat-to-logstash/105695 "2017-10-30T02:00:28Z")
Filebeat send data to logstash; 1、how to test filebeat send rate? 2、How to test filebeat when sent all the data? --- ## [How to install on Pfsense](https://discuss.elastic.co/t/how-to-install-on-pfsense/105672)
**Author:** [@YoLoster](https://discuss.elastic.co/u/YoLoster)\ **Replies:** 5\ **Last updated:** [October 29, 2017, 8:48pm UTC](https://discuss.elastic.co/t/how-to-install-on-pfsense/105672 "2017-10-29T20:48:05Z")
Hi there, I want to start using my Pfsense box to get logs to a ELK instance. I'm following this tutorial: https://blog.reboost.net/suricata-on-pfsense-to-elk-stack/ It states that I need to download the latest build (… --- ## [Unable to limit records using process.include\_top\_n](https://discuss.elastic.co/t/unable-to-limit-records-using-process-include-top-n/105558)
**Author:** [@safehouse](https://discuss.elastic.co/u/safehouse)\ **Replies:** 5\ **Last updated:** [October 27, 2017, 7:18pm UTC](https://discuss.elastic.co/t/unable-to-limit-records-using-process-include-top-n/105558 "2017-10-27T19:18:40Z")
I want to limit the records sent from metricbeat using the process.include\_top\_n set of options. However, wither I can't figure out the correct setup (likely) or it's not working as expected on my systems. Any help or gu… --- ## [Suggestion improving filebeat performance](https://discuss.elastic.co/t/suggestion-improving-filebeat-performance/105508)
**Author:** [@max\_dodo](https://discuss.elastic.co/u/max_dodo)\ **Replies:** 2\ **Last updated:** [October 27, 2017, 3:29pm UTC](https://discuss.elastic.co/t/suggestion-improving-filebeat-performance/105508 "2017-10-27T15:29:44Z")
My ELK setup goes like : Filebeats --\> Logstash(ingest nodes) --\> Elasticsearch ( master + Datanodes ) --\> Kibana Recently we are observing a huge amount of delay in logfile ingestion ( 4 ~ 5 hr) . From the capacity p… --- ## [Parse json with filebeat](https://discuss.elastic.co/t/parse-json-with-filebeat/105292)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 7\ **Last updated:** [October 27, 2017, 2:08pm UTC](https://discuss.elastic.co/t/parse-json-with-filebeat/105292 "2017-10-27T14:08:19Z")
please assist with this config using Filebeat -\> Elasticsearch , My Json is not being decomposed. other fields are populating correctly, i want the message to be decomposed as well filebeat.prospectors: - input… --- ## [Three types of WARN/ERRORs in filebeat logs](https://discuss.elastic.co/t/three-types-of-warn-errors-in-filebeat-logs/105136)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 10\ **Last updated:** [October 27, 2017, 1:56pm UTC](https://discuss.elastic.co/t/three-types-of-warn-errors-in-filebeat-logs/105136 "2017-10-27T13:56:24Z")
Hi, Filebeat experts, we encountered three types of errors, copied below. I am wondering anyone could shed light on under what scenario each error would happen? is the warning or error serious? e.g., whether the error… --- ## [Can someone explain Beats Architecture?](https://discuss.elastic.co/t/can-someone-explain-beats-architecture/105249)
**Author:** [@cmpsoares](https://discuss.elastic.co/u/cmpsoares)\ **Replies:** 3\ **Last updated:** [October 27, 2017, 1:03pm UTC](https://discuss.elastic.co/t/can-someone-explain-beats-architecture/105249 "2017-10-27T13:03:27Z")
Hello, We're analysing the Beats for custom beat developments, and I was wondering if someone can explain the architecture under the hood? I remember to see a diagram of it (from an old version) but was not able to fin… --- ## [Why does filebeat only need cert and metricbeat need key, ca and cert? \[RESOLVED\]](https://discuss.elastic.co/t/why-does-filebeat-only-need-cert-and-metricbeat-need-key-ca-and-cert-resolved/104214)
**Author:** [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Replies:** 6\ **Last updated:** [October 27, 2017, 12:52pm UTC](https://discuss.elastic.co/t/why-does-filebeat-only-need-cert-and-metricbeat-need-key-ca-and-cert-resolved/104214 "2017-10-27T12:52:22Z")
I am quite new to the whole ELK stack, and i just managed to set up both filebeat and metricbeat to connect to a remote ELK stack. All v6.0.0-rc1 The SSL setup got me a bit confused, and I am left with the question: Wh… --- ## [Mac hostname showing as "localhost"](https://discuss.elastic.co/t/mac-hostname-showing-as-localhost/105465)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 1\ **Last updated:** [October 26, 2017, 11:01pm UTC](https://discuss.elastic.co/t/mac-hostname-showing-as-localhost/105465 "2017-10-26T23:01:15Z")
I've been running into an interesting issue and it sounds like in the past there was a similar challenge running a beat on a mac. In my case this is filebeat, but the symptom is the same as @DPattee reported here: I'm… --- ## [Loading Index Template of Filebeat into Elasticsearch in Windows](https://discuss.elastic.co/t/loading-index-template-of-filebeat-into-elasticsearch-in-windows/105241)
**Author:** [@Mahmood\_Shehab](https://discuss.elastic.co/u/Mahmood_Shehab)\ **Replies:** 3\ **Last updated:** [October 26, 2017, 12:39pm UTC](https://discuss.elastic.co/t/loading-index-template-of-filebeat-into-elasticsearch-in-windows/105241 "2017-10-26T12:39:31Z")
Following the guide in this link to add a filebeat-template. I got the this error: \[1\] Then, I added -Credential switch in to PS command followed by the elastic username: \[2\] Powershell accepted the command and promp… --- ## [Filebeat docker image build failure](https://discuss.elastic.co/t/filebeat-docker-image-build-failure/104967)
**Author:** [@4xy](https://discuss.elastic.co/u/4xy)\ **Replies:** 3\ **Last updated:** [October 26, 2017, 11:09am UTC](https://discuss.elastic.co/t/filebeat-docker-image-build-failure/104967 "2017-10-26T11:09:27Z")
I tried to build filebeat docker container image from this repo GitHub - elastic/beats-docker: Official Beats Docker images. I ended up with this. Step 4 : RUN curl -Lso - https://artifacts.elastic.co/downloads/beats… --- ## [Adding a GPS entry in custom field in config file](https://discuss.elastic.co/t/adding-a-gps-entry-in-custom-field-in-config-file/105125)
**Author:** [@lnac98](https://discuss.elastic.co/u/lnac98)\ **Replies:** 9\ **Last updated:** [October 25, 2017, 8:45pm UTC](https://discuss.elastic.co/t/adding-a-gps-entry-in-custom-field-in-config-file/105125 "2017-10-25T20:45:07Z")
Hello, everyone. New to Beats, and to the entire ELK stack so forgive me if this is an easy one (although nothing has shown up on my searches). I need to add some static data into Elasticsearch from Filebeats and I am … --- ## [Elasticsearch not creating index for the filebeat data](https://discuss.elastic.co/t/elasticsearch-not-creating-index-for-the-filebeat-data/105114)
**Author:** [@Jospaul](https://discuss.elastic.co/u/Jospaul)\ **Replies:** 1\ **Last updated:** [October 25, 2017, 8:08pm UTC](https://discuss.elastic.co/t/elasticsearch-not-creating-index-for-the-filebeat-data/105114 "2017-10-25T20:08:15Z")
I am trying to send some log files to elastic search directly using filebeat. I am not getting any errors in filebeat or elasticsearch. Below is the filebeat config: \[image\] filebeat log: 2017-10-24T13:39:05-05:00 I… --- ## [6.0.0-rc1: json.overwrite\_keys not working with @timestamp](https://discuss.elastic.co/t/6-0-0-rc1-json-overwrite-keys-not-working-with-timestamp/105189)
**Author:** [@friesoft](https://discuss.elastic.co/u/friesoft)\ **Replies:** 7\ **Last updated:** [October 25, 2017, 8:01pm UTC](https://discuss.elastic.co/t/6-0-0-rc1-json-overwrite-keys-not-working-with-timestamp/105189 "2017-10-25T20:01:00Z")
Hi, we are trying to forward all json messages in a log file to logstash using Filebeat, but the timestamps are already off on the Filebeat side. With 5.0.1 it is working, with 6.0.0-rc1 we get duplicate @timestamp fiel… --- ## [Filebeat - Error connecting to publish events](https://discuss.elastic.co/t/filebeat-error-connecting-to-publish-events/105120)
**Author:** [@Speedman](https://discuss.elastic.co/u/Speedman)\ **Replies:** 6\ **Last updated:** [October 25, 2017, 7:51pm UTC](https://discuss.elastic.co/t/filebeat-error-connecting-to-publish-events/105120 "2017-10-25T19:51:40Z")
Hi all. Trying to get a new ELK stack set up. I have two servers, one Linux with Filebeat running on it, and one Windows with Elasticsearch, Kibana, and X-Pack running on it. The servers are sitting on the same network s… --- ## [Packetbeat memory and cpu consumption when monitoring cassandra](https://discuss.elastic.co/t/packetbeat-memory-and-cpu-consumption-when-monitoring-cassandra/105210)
**Author:** [@chris060986](https://discuss.elastic.co/u/chris060986)\ **Replies:** 4\ **Last updated:** [October 25, 2017, 2:33pm UTC](https://discuss.elastic.co/t/packetbeat-memory-and-cpu-consumption-when-monitoring-cassandra/105210 "2017-10-25T14:33:47Z")
Hi, I have problems when I try to monitor cassandra with packetbeat, the cpu usage is round about 99.9 % and memory usage is increasing up to 90% of the available memory. The setup is the following: There is a network… --- ## [Questions about windows logins with winlogbeat](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 3\ **Last updated:** [October 25, 2017, 2:23pm UTC](https://discuss.elastic.co/t/questions-about-windows-logins-with-winlogbeat/104639 "2017-10-25T14:23:40Z")
Looking at https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat I think I'm good except for ... Saved "field" parameter is now invalid. Please select a new field. \[image\] Any suggestions? --- ## [Filebeat issue on windows](https://discuss.elastic.co/t/filebeat-issue-on-windows/104929)
**Author:** [@Paris\_Bangrazi](https://discuss.elastic.co/u/Paris_Bangrazi)\ **Replies:** 3\ **Last updated:** [October 25, 2017, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-issue-on-windows/104929 "2017-10-25T13:53:42Z")
Hi, I'm having an issue with filebeat on windowsXP, the same file is loaded several times, and it causes duplicated rows. any advices? Thanks Paris Filebeat.yml filebeat.prospectors: - input\_type: log paths: - … --- ## [Filebeat recovery from ES disconnect](https://discuss.elastic.co/t/filebeat-recovery-from-es-disconnect/105143)
**Author:** [@ChaosMTA](https://discuss.elastic.co/u/ChaosMTA)\ **Replies:** 1\ **Last updated:** [October 25, 2017, 12:48pm UTC](https://discuss.elastic.co/t/filebeat-recovery-from-es-disconnect/105143 "2017-10-25T12:48:35Z")
Hi there, I wasn't able to find much information in the documentation about how Filebeat reacts when the elasticsearch output server is unavailable for a period of time. Does it give up on any logs it tries to send? A… --- ## [Failed to start filebeat service on centos 7](https://discuss.elastic.co/t/failed-to-start-filebeat-service-on-centos-7/105027)
**Author:** [@curious1](https://discuss.elastic.co/u/curious1)\ **Replies:** 2\ **Last updated:** [October 25, 2017, 12:41pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-service-on-centos-7/105027 "2017-10-25T12:41:36Z")
I am running rails application on this server and i want to forward rails logs to logstash installed on another centos server . I have added logstasher gem for json formatted logs. But when i do sudo service filebeat st… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=492) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=494)