# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=501 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 502 --- ## [Postgresql Module Missing Field Errors](https://discuss.elastic.co/t/postgresql-module-missing-field-errors/100097)
**Author:** [@kwojcicki](https://discuss.elastic.co/u/kwojcicki)\ **Replies:** 3\ **Last updated:** [September 12, 2017, 3:10pm UTC](https://discuss.elastic.co/t/postgresql-module-missing-field-errors/100097 "2017-09-12T15:10:53Z")
Using PostgreSQL with dockerimage: library/postgres:9.5-alpine my metricbeat container (5.5.0) spits out the following errors: 2017/09/11 16:41:56.911310 schema.go:38: ERR Error on field 'query\_start': Error converting … --- ## ["Check file" timer and "send events" delay](https://discuss.elastic.co/t/check-file-timer-and-send-events-delay/100061)
**Author:** [@trabakoulas](https://discuss.elastic.co/u/trabakoulas)\ **Replies:** 10\ **Last updated:** [September 12, 2017, 2:38pm UTC](https://discuss.elastic.co/t/check-file-timer-and-send-events-delay/100061 "2017-09-12T14:38:55Z")
Hello, I have two general questions. I'm using the Filebeat to send logs to Logstash. I notice that when I change a file (that is monitored by the Filebeat), the event is published with a delay of ~5-6 seconds. Is this … --- ## [Sync.go:85: ERR Failed to publish events caused by: EOF](https://discuss.elastic.co/t/sync-go-85-err-failed-to-publish-events-caused-by-eof/99435)
**Author:** [@ISPHOST](https://discuss.elastic.co/u/ISPHOST)\ **Replies:** 10\ **Last updated:** [September 12, 2017, 12:30pm UTC](https://discuss.elastic.co/t/sync-go-85-err-failed-to-publish-events-caused-by-eof/99435 "2017-09-12T12:30:06Z")
Hello. I am using Elasticsearch, Logstash, Kibana Docker images and have some troubles. Error in the filebeat container: 2017/09/05 13:10:36.973731 tls.go:200: WARN SSL/TLS verifications disabled. 2017/09/05 13:10:41.… --- ## [Problem with FileBeat and Windows Server 2012 R2](https://discuss.elastic.co/t/problem-with-filebeat-and-windows-server-2012-r2/100029)
**Author:** [@Jack37](https://discuss.elastic.co/u/Jack37)\ **Replies:** 6\ **Last updated:** [September 12, 2017, 7:20am UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-windows-server-2012-r2/100029 "2017-09-12T07:20:45Z")
Hi All, I have a problem with FileBeat and Windows Server 2012 R2 I use FileBeat to read remote IIS logs from 4 webservers; in the windows event viewer's I have this error: {Delayed Write Failed} Windows was unable to… --- ## [Metricbeat is frequently coming down](https://discuss.elastic.co/t/metricbeat-is-frequently-coming-down/99671)
**Author:** [@kiranilla](https://discuss.elastic.co/u/kiranilla)\ **Replies:** 2\ **Last updated:** [September 12, 2017, 7:07am UTC](https://discuss.elastic.co/t/metricbeat-is-frequently-coming-down/99671 "2017-09-12T07:07:06Z")
HI, The Metricbeat has been installed in Linux box(RHEL), once it installed and configured, it was working fine without any issues, but it was observed that for every 15days the metricbeat is getting down frequently not… --- ## [How file beat handles the case if log files were replaced?](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152)
**Author:** [@padmajav9](https://discuss.elastic.co/u/padmajav9)\ **Replies:** 1\ **Last updated:** [September 12, 2017, 5:36am UTC](https://discuss.elastic.co/t/how-file-beat-handles-the-case-if-log-files-were-replaced/100152 "2017-09-12T05:36:04Z")
Hi, In my project, i have a requirement where we download logs from the devices on an hourly basis, unzip and push to elastic search. After every download, we are replacing the existing files. is file beat keep track o… --- ## [Can custom created logs from Logstash be shipped to ES using Filebeat?](https://discuss.elastic.co/t/can-custom-created-logs-from-logstash-be-shipped-to-es-using-filebeat/100117)
**Author:** [@NandhaKrishna](https://discuss.elastic.co/u/NandhaKrishna)\ **Replies:** 4\ **Last updated:** [September 11, 2017, 8:06pm UTC](https://discuss.elastic.co/t/can-custom-created-logs-from-logstash-be-shipped-to-es-using-filebeat/100117 "2017-09-11T20:06:36Z")
I'm not able to GROK a custom log from logstash to ES using FIlebeat. Everytime i create a grok im only able to see the fields that are default in Filebeat. The fields that I grok from the message are not seen. --- ## [Filebeat appears to drop files randomly](https://discuss.elastic.co/t/filebeat-appears-to-drop-files-randomly/99463)
**Author:** [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\ **Replies:** 7\ **Last updated:** [September 11, 2017, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-appears-to-drop-files-randomly/99463 "2017-09-11T12:46:34Z")
Hello, I am running filebeat on a server where my script is offloading messages from a queue as a individual files for filebeat to consume. The setup works fine, but every now and then i see the no. of files doesn’t ma… --- ## [PacketBeat with general TCP/UDP response time data?](https://discuss.elastic.co/t/packetbeat-with-general-tcp-udp-response-time-data/98916)
**Author:** [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Replies:** 2\ **Last updated:** [September 11, 2017, 11:53am UTC](https://discuss.elastic.co/t/packetbeat-with-general-tcp-udp-response-time-data/98916 "2017-09-11T11:53:38Z")
Is it possible to configure packetbeat to monitor the response time of traffic that is being transmitted over tcp or udp, no matter what the layer 7 protocol is? For example, I have an application that transmits data ov… --- ## [Exiting: error initializing publisher: Error loading template /tmp/my\_beat.template.json: open /tmp/my\_beat.template.json: no such file or directory](https://discuss.elastic.co/t/exiting-error-initializing-publisher-error-loading-template-tmp-my-beat-template-json-open-tmp-my-beat-template-json-no-such-file-or-directory/99992)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 0\ **Last updated:** [September 11, 2017, 3:46am UTC](https://discuss.elastic.co/t/exiting-error-initializing-publisher-error-loading-template-tmp-my-beat-template-json-open-tmp-my-beat-template-json-no-such-file-or-directory/99992 "2017-09-11T03:46:09Z")
I created my own beats 5.4.3, written on the IDE after the completion of the above errors; 1, I check the source code found after the path is Unpack () function set to / tmp, but the source seems to have no relevant set… --- ## [Get Data from prometheus monitored systems](https://discuss.elastic.co/t/get-data-from-prometheus-monitored-systems/99940)
**Author:** [@TheReal1604](https://discuss.elastic.co/u/TheReal1604)\ **Replies:** 1\ **Last updated:** [September 10, 2017, 12:25pm UTC](https://discuss.elastic.co/t/get-data-from-prometheus-monitored-systems/99940 "2017-09-10T12:25:31Z")
Hi, i found already this thread which is mentioning what i want to do, but i get no clue how to do it. Can we receiver metrics from prometheus monitored systems via the /metrics http api from prometheus? Which requireme… --- ## [Pull Windows logs remotely via Winlogbeat](https://discuss.elastic.co/t/pull-windows-logs-remotely-via-winlogbeat/99550)
**Author:** [@sukeshss](https://discuss.elastic.co/u/sukeshss)\ **Replies:** 1\ **Last updated:** [September 9, 2017, 3:15pm UTC](https://discuss.elastic.co/t/pull-windows-logs-remotely-via-winlogbeat/99550 "2017-09-09T15:15:23Z")
How we can configure Winlogbeat to pull Windows Eventlogs remotely --- ## [Beats ignores configuration yml](https://discuss.elastic.co/t/beats-ignores-configuration-yml/99644)
**Author:** [@Search9212](https://discuss.elastic.co/u/Search9212)\ **Replies:** 6\ **Last updated:** [September 8, 2017, 8:11pm UTC](https://discuss.elastic.co/t/beats-ignores-configuration-yml/99644 "2017-09-08T20:11:41Z")
My yml file validates and specifically uses a non-default logging directory along with other settings. The logs are put in the default locations along with other unexpected default behavior given my yml. Any ideas? f… --- ## [ELK 6.x \[beat\] cannot import templates in kibana](https://discuss.elastic.co/t/elk-6-x-beat-cannot-import-templates-in-kibana/99806)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 3\ **Last updated:** [September 8, 2017, 7:50pm UTC](https://discuss.elastic.co/t/elk-6-x-beat-cannot-import-templates-in-kibana/99806 "2017-09-08T19:50:27Z")
Hi all, just testing elk 6. When I try to import the metricbeat dashboards like ./metricbeat setup -c /etc/metricbeat/metricbeat.yml I just get: Loaded index template Exiting: Error importing Kibana dashboards: f… --- ## [Filebeat is not connecting logstash after the upgrade](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736)
**Author:** [@harish.g](https://discuss.elastic.co/u/harish.g)\ **Replies:** 3\ **Last updated:** [September 8, 2017, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-is-not-connecting-logstash-after-the-upgrade/99736 "2017-09-08T12:30:16Z")
We are using filbeat version 5.\* which is not able to connect to logstash version 5.\* after the upgrade . During the previous version of file beat 1.\* and logstash is 2.\* able to establish the connection but after the … --- ## [Beats(Metricbeat and Filebeat) support for VMware ESXi Host](https://discuss.elastic.co/t/beats-metricbeat-and-filebeat-support-for-vmware-esxi-host/99826)
**Author:** [@Vishnu\_Murty](https://discuss.elastic.co/u/Vishnu_Murty)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 12:23pm UTC](https://discuss.elastic.co/t/beats-metricbeat-and-filebeat-support-for-vmware-esxi-host/99826 "2017-09-08T12:23:42Z")
Hey, all. I want to get logs and OS performance metrics from VMware hosts into elasticsearch. I have tried the Beats(Metricbeat and Filebeat), but i am getting segmentaion fault error upon starting the beats. Has anyon… --- ## [Shows invalid json on error](https://discuss.elastic.co/t/shows-invalid-json-on-error/99723)
**Author:** [@ntviet18](https://discuss.elastic.co/u/ntviet18)\ **Replies:** 1\ **Last updated:** [September 8, 2017, 11:32am UTC](https://discuss.elastic.co/t/shows-invalid-json-on-error/99723 "2017-09-08T11:32:12Z")
I am using Filebeat ELK integration. When Filebeat failed to parse a json object, it leaves only an error of type json\_error=Error decoding JSON: invalid character '{' after array element How can I show the original ob… --- ## [K8s deployment failed as security pre-required?](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610)
**Author:** [@Yveseirean](https://discuss.elastic.co/u/Yveseirean)\ **Replies:** 3\ **Last updated:** [September 8, 2017, 10:14am UTC](https://discuss.elastic.co/t/k8s-deployment-failed-as-security-pre-required/99610 "2017-09-08T10:14:47Z")
deployment in kubernetes without configuration met errors: panic: standard\_init\_linux.go:178: exec user process caused "operation not permitted" \[recovered\] panic: standard\_init\_linux.go:178: exec user process c… --- ## [Module processor being cached?](https://discuss.elastic.co/t/module-processor-being-cached/99604)
**Author:** [@danimaiochi](https://discuss.elastic.co/u/danimaiochi)\ **Replies:** 4\ **Last updated:** [September 8, 2017, 10:13am UTC](https://discuss.elastic.co/t/module-processor-being-cached/99604 "2017-09-08T10:13:44Z")
Hi! I’m developing a new module for filebeat that I’m calling ruby. I noticed that my pipeline keeps using the same processor pattern it was configured on the first version. this is the first version of my module: "p… --- ## [Error initializing processors](https://discuss.elastic.co/t/error-initializing-processors/99247)
**Author:** [@BeerRider](https://discuss.elastic.co/u/BeerRider)\ **Replies:** 8\ **Last updated:** [September 8, 2017, 9:18am UTC](https://discuss.elastic.co/t/error-initializing-processors/99247 "2017-09-08T09:18:30Z")
Hello. I'm trying to make filebeat send logs excluding some messages. Config: filebeat.prospectors: - input\_type: log document\_type: exchange paths: - d:\\Program Files\\Exchange Server 2013\\Trans… --- ## [How does filebeat traverse a path](https://discuss.elastic.co/t/how-does-filebeat-traverse-a-path/99038)
**Author:** [@hburnswell](https://discuss.elastic.co/u/hburnswell)\ **Replies:** 1\ **Last updated:** [September 1, 2017, 8:18pm UTC](https://discuss.elastic.co/t/how-does-filebeat-traverse-a-path/99038 "2017-09-01T20:18:49Z")
Hi All, I'm curious about how filebeat behaves on a given path. My goal is to ingest IIS logs as filebeat -\> logstash -\> elasticsearch. The IIS log directory has log files going back to Jan 2016 (1 per day). I am usi… --- ## [Packet decode failed](https://discuss.elastic.co/t/packet-decode-failed/99590)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 1\ **Last updated:** [September 7, 2017, 11:00am UTC](https://discuss.elastic.co/t/packet-decode-failed/99590 "2017-09-07T11:00:57Z")
Hi, On starting the packetbeat binary I get the following error. 2017-09-07T11:12:15+08:00 INFO Non-zero metrics in the last 30s: dns.unmatched\_requests=2801 dns.unmatched\_responses=2216 http.unmatched\_responses=508… --- ## [V6.0.0-beta2 http module mapping trouble](https://discuss.elastic.co/t/v6-0-0-beta2-http-module-mapping-trouble/99703)
**Author:** [@Sylvain\_Mougenot](https://discuss.elastic.co/u/Sylvain_Mougenot)\ **Replies:** 3\ **Last updated:** [September 7, 2017, 10:35am UTC](https://discuss.elastic.co/t/v6-0-0-beta2-http-module-mapping-trouble/99703 "2017-09-07T10:35:40Z")
I’m trying to collect metrics from Dorpwizard metrics. Those are exposed by the REST API as Json. I tryed dropwizard module for metrics but it seams not to fetch any datas. Then switched to http module for metrics but… --- ## [How to get access time of filename and set it in every log message?](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378)
**Author:** [@chros425](https://discuss.elastic.co/u/chros425)\ **Replies:** 4\ **Last updated:** [September 7, 2017, 3:28am UTC](https://discuss.elastic.co/t/how-to-get-access-time-of-filename-and-set-it-in-every-log-message/99378 "2017-09-07T03:28:06Z")
We need to sort message in Web, but the log messages are in different log files，so we want get the access time of log file ,then use the access time and offset to sort log message in different log files. How to it with f… --- ## [Can't get filebeat to work properly on any port other than 9200](https://discuss.elastic.co/t/cant-get-filebeat-to-work-properly-on-any-port-other-than-9200/99499)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 9\ **Last updated:** [September 6, 2017, 6:56pm UTC](https://discuss.elastic.co/t/cant-get-filebeat-to-work-properly-on-any-port-other-than-9200/99499 "2017-09-06T18:56:37Z")
I have a problem that is driving me crazy. I set up a POC for ELK and configured filebeat to send our logs via loghost:9200, the same port that logstash is listening to. That was fine for the test but now I want to use g… --- ## [How to get information about packet loss](https://discuss.elastic.co/t/how-to-get-information-about-packet-loss/99613)
**Author:** [@Christian\_H](https://discuss.elastic.co/u/Christian_H)\ **Replies:** 0\ **Last updated:** [September 6, 2017, 4:16pm UTC](https://discuss.elastic.co/t/how-to-get-information-about-packet-loss/99613 "2017-09-06T16:16:41Z")
I use elastalert and want to get an alert at around 1% packet loss. To test this am forcing a packet loss of 3% on my system using the command: tc qdisc adddev eth0 root netem loss 3% && sleep 100 && tc qdisc change de… --- ## [Getting connection refused error while trying to send log file from filebeat to elasticsearch in different server.( Modified elasticsearch port to 9201)](https://discuss.elastic.co/t/getting-connection-refused-error-while-trying-to-send-log-file-from-filebeat-to-elasticsearch-in-different-server-modified-elasticsearch-port-to-9201/97264)
**Author:** [@Jeemi\_Sinha](https://discuss.elastic.co/u/Jeemi_Sinha)\ **Replies:** 24\ **Last updated:** [September 6, 2017, 12:33pm UTC](https://discuss.elastic.co/t/getting-connection-refused-error-while-trying-to-send-log-file-from-filebeat-to-elasticsearch-in-different-server-modified-elasticsearch-port-to-9201/97264 "2017-09-06T12:33:08Z")
2017-08-16T08:46:52-04:00 ERR Connecting error publishing events (retrying): Get http://x.x.x.x:9201: dial tcp x.x.x.x:9201: getsockopt: connection refused 2017-08-16T08:47:17-04:00 INFO No non-zero metrics in the last … --- ## [Logstash input beat super low ingestion rate](https://discuss.elastic.co/t/logstash-input-beat-super-low-ingestion-rate/99483)
**Author:** [@Geez](https://discuss.elastic.co/u/Geez)\ **Replies:** 1\ **Last updated:** [September 6, 2017, 11:34am UTC](https://discuss.elastic.co/t/logstash-input-beat-super-low-ingestion-rate/99483 "2017-09-06T11:34:26Z")
Hello, Hope y’all having a good day! Really need some assistance regarding some performance issues on our logging pipeline. In a nutshell, we have this common setup: \[journalbeat\] \> \[logstash\] \> \[elasticsearch\] Whil… --- ## [401 Unauthorized Error](https://discuss.elastic.co/t/401-unauthorized-error/99460)
**Author:** [@Ratnakar\_Sadasyula](https://discuss.elastic.co/u/Ratnakar_Sadasyula)\ **Replies:** 1\ **Last updated:** [September 6, 2017, 11:12am UTC](https://discuss.elastic.co/t/401-unauthorized-error/99460 "2017-09-06T11:12:36Z")
Hi I installed MetricBeat 5.5.x on Windows along with ElasticSearch 5.5.2, I started ElasticSearch and MetricBeat, confirmed it is running with localhost:9200 I also started MetricBeat, however in the log file this i… --- ## [Loading configmap in k8s has error "exec metricbeat no found"](https://discuss.elastic.co/t/loading-configmap-in-k8s-has-error-exec-metricbeat-no-found/99434)
**Author:** [@Yveseirean](https://discuss.elastic.co/u/Yveseirean)\ **Replies:** 3\ **Last updated:** [September 6, 2017, 11:09am UTC](https://discuss.elastic.co/t/loading-configmap-in-k8s-has-error-exec-metricbeat-no-found/99434 "2017-09-06T11:09:57Z")
I deployed the metricbeat docker on kubernetes, the metricbeat.yml is in configmap. When the pod starts, came across an CrashLoopBackOff error: "/usr/local/bin/docker-entrypoint: line 8: exec: metricbeat: not found" th… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=500) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=502)