# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=5 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 6 --- ## [Filebeat - High CPU usage with kubernetes autodiscovery](https://discuss.elastic.co/t/filebeat-high-cpu-usage-with-kubernetes-autodiscovery/379605)
**Author:** [@lorenzo\_milicia](https://discuss.elastic.co/u/lorenzo_milicia)\ **Replies:** 2\ **Last updated:** [July 1, 2025, 5:02am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-usage-with-kubernetes-autodiscovery/379605 "2025-07-01T05:02:10Z")
Hello, Over the last few days I've been trying to investigate an issue I was having in our logging system running in a production environment. The system is a pretty straight forward Filebeat -\> Logstash -\> Elasticsear… --- ## [High RAM usage on kubernetes pod after migration from type container to filestream](https://discuss.elastic.co/t/high-ram-usage-on-kubernetes-pod-after-migration-from-type-container-to-filestream/379438)
**Author:** [@cubba](https://discuss.elastic.co/u/cubba)\ **Replies:** 4\ **Last updated:** [June 30, 2025, 1:33pm UTC](https://discuss.elastic.co/t/high-ram-usage-on-kubernetes-pod-after-migration-from-type-container-to-filestream/379438 "2025-06-30T13:33:10Z")
Hello, we are in a progress of migration from input: container to filestream. Filebeat is configured as daemonset on kubernetes and each filebeat pod collects logs from all applications deployed on corresponding kuber… --- ## [Request to Externalize Hardcoded Credentials from filebeat.yml](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 2\ **Last updated:** [June 30, 2025, 12:42pm UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282 "2025-06-30T12:42:08Z")
Currently, the Filebeat configuration (filebeat.yml) includes hardcoded values for the Elasticsearch and kafka host IP, username, and password. This poses a potential security risk and makes configuration changes non-sc… --- ## [Filebeat output to Kafka GSLB](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550)
**Author:** [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)\ **Replies:** 4\ **Last updated:** [June 27, 2025, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550 "2025-06-27T15:48:47Z")
We are trying to solve a problem here with filebeat agent, we want to introduce an GSLB infront of Kafka clusters. Basically we have 2 kafka clusters in 2 different zones, we want filebeat to output to kafka based on rea… --- ## [Unable to deploy Metricbeat container as a non-root user, file permissions problem](https://discuss.elastic.co/t/unable-to-deploy-metricbeat-container-as-a-non-root-user-file-permissions-problem/379451)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 2\ **Last updated:** [June 26, 2025, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-deploy-metricbeat-container-as-a-non-root-user-file-permissions-problem/379451 "2025-06-26T15:22:57Z")
I keep getting this error when trying to deploy metricbeat as a non-root user {"log.level":"info","@timestamp":"2025-06-24T19:31:08.770Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(\*Beat… --- ## [Configuring the collection of ELK stack logs using filebeat](https://discuss.elastic.co/t/configuring-the-collection-of-elk-stack-logs-using-filebeat/378392)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 3\ **Last updated:** [June 17, 2025, 7:48am UTC](https://discuss.elastic.co/t/configuring-the-collection-of-elk-stack-logs-using-filebeat/378392 "2025-06-17T07:48:30Z")
I deployed the stack in docker and ran into a log parsing problem. About the configuration: Docker - uses the default logging plugin - json. A label has also been added to the container - co.elastic.logs/module=kibana … --- ## [Metricbeat Podman Container Metrics](https://discuss.elastic.co/t/metricbeat-podman-container-metrics/379212)
**Author:** [@shabpa](https://discuss.elastic.co/u/shabpa)\ **Replies:** 0\ **Last updated:** [June 16, 2025, 3:57pm UTC](https://discuss.elastic.co/t/metricbeat-podman-container-metrics/379212 "2025-06-16T15:57:07Z")
Hi everyone, I'm currently running Metricbeat inside a Podman container, and I'm trying to collect metrics from other containers. So far, I'm successfully receiving data from the following metricsets: cpu network con… --- ## [Filebeat: Problem migration json parser from 8.17.0 to 9.0.0 with filestream](https://discuss.elastic.co/t/filebeat-problem-migration-json-parser-from-8-17-0-to-9-0-0-with-filestream/378589)
**Author:** [@DirkGerlach](https://discuss.elastic.co/u/DirkGerlach)\ **Replies:** 5\ **Last updated:** [June 16, 2025, 5:52am UTC](https://discuss.elastic.co/t/filebeat-problem-migration-json-parser-from-8-17-0-to-9-0-0-with-filestream/378589 "2025-06-16T05:52:25Z")
Hi there, I am new in participating in this board. As a long-time reader I found a lot of stuff here that helps my to keep running a few ECK instances. Today I am facing a huge problem in migrating filebeat from 8.17.0… --- ## [❗ Multiline Pattern Not Working in Filebeat 9.0.1 (Filestream Type Input)](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-9-0-1-filestream-type-input/378977)
**Author:** [@Ravi\_Chandran](https://discuss.elastic.co/u/Ravi_Chandran)\ **Replies:** 2\ **Last updated:** [June 15, 2025, 8:47am UTC](https://discuss.elastic.co/t/multiline-pattern-not-working-in-filebeat-9-0-1-filestream-type-input/378977 "2025-06-15T08:47:09Z")
Summary Despite attempting multiple valid multiline.pattern configurations, Filebeat v9.0.1 fails to parse multiline log entries correctly from a plain text log file located inside a container. The logs contain Python st… --- ## [Update doc in index](https://discuss.elastic.co/t/update-doc-in-index/379090)
**Author:** [@tazieviikz](https://discuss.elastic.co/u/tazieviikz)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 9:26am UTC](https://discuss.elastic.co/t/update-doc-in-index/379090 "2025-06-11T09:26:20Z")
I need help with update docs in index. Filebeat upload CSV files from disk to index FB config - type: log id: persons enabled: true paths: - /data1/Logs/Preprod/Persons/\*.csv fields: log\_type: persons o… --- ## [Can filebeat's input and output sources support the Pulsar plugin?](https://discuss.elastic.co/t/can-filebeats-input-and-output-sources-support-the-pulsar-plugin/379084)
**Author:** [@BillXiangXBB](https://discuss.elastic.co/u/BillXiangXBB)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 8:11am UTC](https://discuss.elastic.co/t/can-filebeats-input-and-output-sources-support-the-pulsar-plugin/379084 "2025-06-11T08:11:57Z")
Apache Pulsar is an open source distributed messaging middleware product, similar to Kafka. Now our projects use Pulsar to process stream data, but filebeat don't support it as an input/output source. --- ## [📌 \[Filebeat HTTPJSON\] Preserve Last Page Cursor for Next Run When Pagination Ends](https://discuss.elastic.co/t/filebeat-httpjson-preserve-last-page-cursor-for-next-run-when-pagination-ends/378501)
**Author:** [@mehrad\_ghalibafi](https://discuss.elastic.co/u/mehrad_ghalibafi)\ **Replies:** 3\ **Last updated:** [June 10, 2025, 6:51pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-preserve-last-page-cursor-for-next-run-when-pagination-ends/378501 "2025-06-10T18:51:04Z")
Hi Elastic Team, I'm using Filebeat’s httpjson input to integrate with a paginated API that uses a next field for pagination. Here's what I have working so far: :white\_check\_mark: Current Working Setup response.pagina… --- ## [Filebeat: incorrect apt repository installation documentation](https://discuss.elastic.co/t/filebeat-incorrect-apt-repository-installation-documentation/378982)
**Author:** [@tom\_letter](https://discuss.elastic.co/u/tom_letter)\ **Replies:** 2\ **Last updated:** [June 10, 2025, 7:56am UTC](https://discuss.elastic.co/t/filebeat-incorrect-apt-repository-installation-documentation/378982 "2025-06-10T07:56:23Z")
Hi, at the time of writing this, the APT repository in filebeat documentation is not working. I believe that's due to a wrong URL. I managed to fix it using the same repository and key mentioned in elasticsearch/logst… --- ## [Filebeat Azure module - mapper\_parsing\_exception for field azure.signinlogs.properties.conditional\_access\_audiences](https://discuss.elastic.co/t/filebeat-azure-module-mapper-parsing-exception-for-field-azure-signinlogs-properties-conditional-access-audiences/378904)
**Author:** [@mczajkowski](https://discuss.elastic.co/u/mczajkowski)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-mapper-parsing-exception-for-field-azure-signinlogs-properties-conditional-access-audiences/378904 "2025-06-06T15:31:01Z")
Hello It seems there was a change in the Azure Singin logs syntax since 2025-06-04. Since that date the amount of logs grabbing by our Filebeat dramatically decreased. Debug log shows it is caused by "azure.signinlogs.… --- ## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/378684)
**Author:** [@madhavsankarg](https://discuss.elastic.co/u/madhavsankarg)\ **Replies:** 2\ **Last updated:** [June 3, 2025, 12:44pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/378684 "2025-06-03T12:44:12Z")
Hi All, Hearbeat version - 8.14.1 The certificate is updated for the specific URL, still in Uptime monitor we are getting the error x509: certificate signed by unknown authority. I can confirm that the CHain of the cer… --- ## [Fleet server configuration lost](https://discuss.elastic.co/t/fleet-server-configuration-lost/378663)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 14\ **Last updated:** [May 29, 2025, 6:04pm UTC](https://discuss.elastic.co/t/fleet-server-configuration-lost/378663 "2025-05-29T18:04:07Z")
Hello, Today I set out to update elastic to version 8.18.1 which is the one available in the repositories of artifacts.elastic.co I don't know why 9.0 is not there which is supposed to be the latest but for now I will s… --- ## [Dissect processor before multiline parser](https://discuss.elastic.co/t/dissect-processor-before-multiline-parser/378578)
**Author:** [@Dano\_Logos](https://discuss.elastic.co/u/Dano_Logos)\ **Replies:** 1\ **Last updated:** [May 29, 2025, 1:10am UTC](https://discuss.elastic.co/t/dissect-processor-before-multiline-parser/378578 "2025-05-29T01:10:59Z")
Hello, I first want to filter prefixes from logs and then merge them into multiline. Currently you can do both as a single feature and also dissect after multiline, but you first can create multilines and then manipulat… --- ## [Metricbeat Kafka module won’t work with Kafka 4.0.0](https://discuss.elastic.co/t/metricbeat-kafka-module-won-t-work-with-kafka-4-0-0/378670)
**Author:** [@SeungHyun\_Roh](https://discuss.elastic.co/u/SeungHyun_Roh)\ **Replies:** 0\ **Last updated:** [May 28, 2025, 10:40pm UTC](https://discuss.elastic.co/t/metricbeat-kafka-module-won-t-work-with-kafka-4-0-0/378670 "2025-05-28T22:40:57Z")
Hello, everyone. I see this logs when trying to connect to Kafka 4.0.0 with Metricbeat 9.0.0 kafka module. Metricbeat log {"log.level":"warn","@timestamp":"2025-05-22T16:25:44.754+0900","log.logger":"kafka.partition"… --- ## [Installation filebeat on ubuntu 24 error](https://discuss.elastic.co/t/installation-filebeat-on-ubuntu-24-error/378599)
**Author:** [@fferraro87](https://discuss.elastic.co/u/fferraro87)\ **Replies:** 2\ **Last updated:** [May 27, 2025, 3:47pm UTC](https://discuss.elastic.co/t/installation-filebeat-on-ubuntu-24-error/378599 "2025-05-27T15:47:58Z")
hi i've follow that installation readme for apt because i've to install filebeat on my ubuntu 24.04 servers. But i've that error when i try to get apt update : Ign:7 https://artifacts.elastic.co/packages/9.0/apt sta… --- ## [Winlogbeat not parsing AnsiString fields correctly](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510)
**Author:** [@AltairQ](https://discuss.elastic.co/u/AltairQ)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 8:34am UTC](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510 "2025-05-27T08:34:23Z")
Hello, I'd like to draw attention to what I believe is a bug in winlogbeat v9+ parsing logic for ETW events declared with inType="win:AnsiString". Long story short, the strings are not trimmed to the null terminator. I… --- ## [Filebeat doesn't send data to output/logstash](https://discuss.elastic.co/t/filebeat-doesnt-send-data-to-output-logstash/378563)
**Author:** [@rb18](https://discuss.elastic.co/u/rb18)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 6:14am UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-data-to-output-logstash/378563 "2025-05-27T06:14:11Z")
Hello, i want to send data from filebeat (version 9.0.0) to logstash (version 9.0.0) but no matter what I try, it just doesn't work. info: filebeat and logstash both run on the same virtual machine (Windows Server 2022… --- ## [What is a JSON object?](https://discuss.elastic.co/t/what-is-a-json-object/378453)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 2\ **Last updated:** [May 23, 2025, 6:01am UTC](https://discuss.elastic.co/t/what-is-a-json-object/378453 "2025-05-23T06:01:49Z")
Hi everyone, Sorry to ask a very basic question. At first, I'm trying to find a way to parse a JSON log in filebeat with container input type. Then I found this documentation. in the description, it said it only works i… --- ## [Multiline stack trace not working](https://discuss.elastic.co/t/multiline-stack-trace-not-working/378316)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 2\ **Last updated:** [May 21, 2025, 3:54pm UTC](https://discuss.elastic.co/t/multiline-stack-trace-not-working/378316 "2025-05-21T15:54:54Z")
filebeat.inputs: - type: filestream enabled: true paths: - /var/tmp/javatest/simplejava.log json.keys\_under\_root: true json.add\_error\_key: false json.ignore\_decoding\_error: true json.overwrite\_keys: true … --- ## [Filebeat filestream: Duplicate ingestion after "key with no value" in log.json registry file](https://discuss.elastic.co/t/filebeat-filestream-duplicate-ingestion-after-key-with-no-value-in-log-json-registry-file/378377)
**Author:** [@anpama](https://discuss.elastic.co/u/anpama)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 9:18am UTC](https://discuss.elastic.co/t/filebeat-filestream-duplicate-ingestion-after-key-with-no-value-in-log-json-registry-file/378377 "2025-05-21T09:18:54Z")
Hi everyone, I'm seeing a duplicate ingestion issue with Filebeat 8.14 using the filestream input and default settings. For some files, Filebeat suddenly starts reading the whole file again, leading to duplicate events. … --- ## [Filebeat: add\_docker\_metadata doesn't always work](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339)
**Author:** [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\ **Replies:** 0\ **Last updated:** [May 20, 2025, 11:49am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339 "2025-05-20T11:49:12Z")
I have filebeat running directly on my OS and it's ingesting Docker log files from /var/log/docker/containers/\*/\*-json.log: filebeat: # List of inputs. inputs: - type: filestream id: container paths:… --- ## [Filebeat multi line pattern not working](https://discuss.elastic.co/t/filebeat-multi-line-pattern-not-working/378301)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 6\ **Last updated:** [May 20, 2025, 8:29am UTC](https://discuss.elastic.co/t/filebeat-multi-line-pattern-not-working/378301 "2025-05-20T08:29:18Z")
Following is the multiline pattern config we have used. - type: filestream # Unique ID among all inputs, an ID is required. id: testfile # Change to true to enable this input configuration. enabled: true # … --- ## [Questions about Filebeat Input Handling, QoS, and Overload Protection](https://discuss.elastic.co/t/questions-about-filebeat-input-handling-qos-and-overload-protection/378210)
**Author:** [@vnovotny98](https://discuss.elastic.co/u/vnovotny98)\ **Replies:** 0\ **Last updated:** [May 16, 2025, 7:45am UTC](https://discuss.elastic.co/t/questions-about-filebeat-input-handling-qos-and-overload-protection/378210 "2025-05-16T07:45:37Z")
Hello, I'm trying to get a better understanding of how Filebeat handles multiple inputs, especially in high-volume scenarios. 1. Input Consumption Behavior If Filebeat is reading from multiple log files—some high-volu… --- ## [How to prevent appending date.ndjson to the parsed output file](https://discuss.elastic.co/t/how-to-prevent-appending-date-ndjson-to-the-parsed-output-file/378204)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 0\ **Last updated:** [May 15, 2025, 9:14pm UTC](https://discuss.elastic.co/t/how-to-prevent-appending-date-ndjson-to-the-parsed-output-file/378204 "2025-05-15T21:14:46Z")
How can I prevent filebeat from adding a "date.ndjson" to the outputfile I specify ? Is this possible output.file: path: "/tmp/filebeat" filename: filebeat.log ls /tmp/filebeat/filebeat.log\* /tmp/filebeat/filebeat.… --- ## [Delayed shutdown of filebeat only after finished processing log files](https://discuss.elastic.co/t/delayed-shutdown-of-filebeat-only-after-finished-processing-log-files/378188)
**Author:** [@durera](https://discuss.elastic.co/u/durera)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 3:20pm UTC](https://discuss.elastic.co/t/delayed-shutdown-of-filebeat-only-after-finished-processing-log-files/378188 "2025-05-15T15:20:41Z")
I've not been able to find any reference to this in the docs, maybe it doesn't exist, or maybe my searchfu is failing me: is there a way to instruct filebeat to shutdown only after it's caught up with all the log files i… --- ## [Output file not created](https://discuss.elastic.co/t/output-file-not-created/378155)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 11:12am UTC](https://discuss.elastic.co/t/output-file-not-created/378155 "2025-05-15T11:12:52Z")
Is there something wrong with my filebeat.yml file ? I am reading from one directory and copying it to another but it fails to create the file . I am not sending it to logstash or elastic . Version - filebeat version 8.… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=4) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=6)