# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=503 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 504 --- ## [Metricbeat with Jolokia integration Clarification](https://discuss.elastic.co/t/metricbeat-with-jolokia-integration-clarification/98864)
**Author:** [@Ashok\_A](https://discuss.elastic.co/u/Ashok_A)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 3:06pm UTC](https://discuss.elastic.co/t/metricbeat-with-jolokia-integration-clarification/98864 "2017-08-30T15:06:36Z")
Hi All, As part Metricbeaty 5.5.2 with Jolokia integration,we need to get the jvm merics, how to set the jolokia-jvm-1.3.7-agent.jar to linux environment/application. metricbeat.yml module: jolokia metricsets: \[“j… --- ## [Filebeat exits silently when started with sudo and sudoreplay is installed](https://discuss.elastic.co/t/filebeat-exits-silently-when-started-with-sudo-and-sudoreplay-is-installed/98873)
**Author:** [@mlucia](https://discuss.elastic.co/u/mlucia)\ **Replies:** 0\ **Last updated:** [August 30, 2017, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-exits-silently-when-started-with-sudo-and-sudoreplay-is-installed/98873 "2017-08-30T14:54:30Z")
After installing sudoreplay, filebeat (and likely the other beats) will fail silently when started with sudo, as in sudo /etc/init.d/filebeat start it will continue to run when started with the -f or --foreground flag … --- ## [Metricbeat - Docker Container stats in Mesos DCOS](https://discuss.elastic.co/t/metricbeat-docker-container-stats-in-mesos-dcos/98131)
**Author:** [@jruzicka](https://discuss.elastic.co/u/jruzicka)\ **Replies:** 7\ **Last updated:** [August 30, 2017, 2:38pm UTC](https://discuss.elastic.co/t/metricbeat-docker-container-stats-in-mesos-dcos/98131 "2017-08-30T14:38:34Z")
Does anyone have best practice for sending Elastic Docker stats from containers running in DCOS on CentOS? I’m running Elastic 5.2.2. I see some discussion with using filebeat, but i’m interested in the cpu & mem usag… --- ## [Filebeat installation not creating index in ElasticSearch](https://discuss.elastic.co/t/filebeat-installation-not-creating-index-in-elasticsearch/98735)
**Author:** [@hammertime](https://discuss.elastic.co/u/hammertime)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-installation-not-creating-index-in-elasticsearch/98735 "2017-08-30T13:12:36Z")
I have just installed Windows ElasticSearch x64 , Kibana(x86) 5.5.2 and FileBeats(x86) to my Windows 10. I should see an indice created for both Kibana and FileBeats but do not see one for FIlebeats. The ElasticSearch c… --- ## [Does the filebeat code have different interfaces to Linux and Windows?](https://discuss.elastic.co/t/does-the-filebeat-code-have-different-interfaces-to-linux-and-windows/98814)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 0\ **Last updated:** [August 30, 2017, 8:18am UTC](https://discuss.elastic.co/t/does-the-filebeat-code-have-different-interfaces-to-linux-and-windows/98814 "2017-08-30T08:18:13Z")
1, I read the filebeat source and found that filebeat Linux and Windows systems for the same treatment, so for Linux and Windows systems have different interface to achieve the distinction between the operating system 2… --- ## [Can packetbeat set the number of packets to be captured as tcpdump does?](https://discuss.elastic.co/t/can-packetbeat-set-the-number-of-packets-to-be-captured-as-tcpdump-does/98530)
**Author:** [@moooofly](https://discuss.elastic.co/u/moooofly)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 6:14am UTC](https://discuss.elastic.co/t/can-packetbeat-set-the-number-of-packets-to-be-captured-as-tcpdump-does/98530 "2017-08-30T06:14:13Z")
Showing help of packetbeat, I find no options for setting the number of packets to be captured as tcpdump dose, is there a possibility to support this feature? Thanks in advance! % ./packetbeat --version packetbeat ver… --- ## [Winlog Beats installation with SCCM](https://discuss.elastic.co/t/winlog-beats-installation-with-sccm/98782)
**Author:** [@aerys\_targaryen](https://discuss.elastic.co/u/aerys_targaryen)\ **Replies:** 0\ **Last updated:** [August 30, 2017, 4:31am UTC](https://discuss.elastic.co/t/winlog-beats-installation-with-sccm/98782 "2017-08-30T04:31:12Z")
Hello Is it possible to install Winlog Beats for collecting windows logs from Desktops and Servers with SCCM? Because as i understand winlog beats has to be manualy configured in each host. What i mean is just intall t… --- ## [Filebeat and EC2 Tags](https://discuss.elastic.co/t/filebeat-and-ec2-tags/98737)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 2\ **Last updated:** [August 29, 2017, 9:14pm UTC](https://discuss.elastic.co/t/filebeat-and-ec2-tags/98737 "2017-08-29T21:14:36Z")
Howdy; There is a processor called “add\_cloud\_metadata” that adds 5 EC2 metadata fields, but does not appear to grab the tags. Since that is where instances user defined data is defined, would be nice if it also pulled… --- ## [Failed to parse mapping \[\_default\_\]: Mapping definition for \[error\] has unsupported parameters](https://discuss.elastic.co/t/failed-to-parse-mapping--default--mapping-definition-for-error-has-unsupported-parameters/98259)
**Author:** [@ianseyer](https://discuss.elastic.co/u/ianseyer)\ **Replies:** 4\ **Last updated:** [August 29, 2017, 8:57pm UTC](https://discuss.elastic.co/t/failed-to-parse-mapping--default--mapping-definition-for-error-has-unsupported-parameters/98259 "2017-08-29T20:57:49Z")
I am using a lightly customized installation of all 6.0.0-beta1 beats. However, When attempting to start them, they all spew this error: 2017/08/22 19:58:16.455956 client.go:465: WARN Can not index event (status=400):… --- ## [Cannot display HTTP status in kibana dash](https://discuss.elastic.co/t/cannot-display-http-status-in-kibana-dash/98576)
**Author:** [@pshah7](https://discuss.elastic.co/u/pshah7)\ **Replies:** 6\ **Last updated:** [August 29, 2017, 8:08pm UTC](https://discuss.elastic.co/t/cannot-display-http-status-in-kibana-dash/98576 "2017-08-29T20:08:37Z")
Hello, I have installed heartbeat on one of the host to monitor two URL’s but it doesn’t seems to work correctly to monitor one of that URL. Attaching heartbeat logs 2017-08-28T11:09:59-04:00 DBG Job 'http@http://X.X.… --- ## [Jolokia module for kafka](https://discuss.elastic.co/t/jolokia-module-for-kafka/98705)
**Author:** [@Richard\_Neely](https://discuss.elastic.co/u/Richard_Neely)\ **Replies:** 0\ **Last updated:** [August 29, 2017, 1:53pm UTC](https://discuss.elastic.co/t/jolokia-module-for-kafka/98705 "2017-08-29T13:53:34Z")
I have setup the jolokia module for kafka but can’t seem to get anything to work outside the default jmx mbeans. I know the data is available because i can poll it via other methods but get this for metricbeats. Running … --- ## [Where is import\_dashboards script?](https://discuss.elastic.co/t/where-is-import-dashboards-script/98698)
**Author:** [@shinoj](https://discuss.elastic.co/u/shinoj)\ **Replies:** 1\ **Last updated:** [August 29, 2017, 1:46pm UTC](https://discuss.elastic.co/t/where-is-import-dashboards-script/98698 "2017-08-29T13:46:33Z")
Hi, I am trying to import beats dashboard but cant find import\_dashboards script at https://github.com/elastic/beats/tree/master/libbeat/dashboards I was following the instructions at : https://www.elastic.co/guide/en… --- ## [Error importing URL/file: Failed to import index-pattern: : error loading /tmp/tmp401063577/beats-dashboards-5.4.0/filebeat/index-pattern/filebeat.json: couldn't load json. Error: 401 Unauthorized](https://discuss.elastic.co/t/error-importing-url-file-failed-to-import-index-pattern-error-loading-tmp-tmp401063577-beats-dashboards-5-4-0-filebeat-index-pattern-filebeat-json-couldnt-load-json-error-401-unauthorized/97461)
**Author:** [@sandy007](https://discuss.elastic.co/u/sandy007)\ **Replies:** 25\ **Last updated:** [August 29, 2017, 12:14pm UTC](https://discuss.elastic.co/t/error-importing-url-file-failed-to-import-index-pattern-error-loading-tmp-tmp401063577-beats-dashboards-5-4-0-filebeat-index-pattern-filebeat-json-couldnt-load-json-error-401-unauthorized/97461 "2017-08-29T12:14:01Z")
I have installed a new version of elk 5.5.0 alongwith xpack \>\> next i tried to configure the filebeat index its giving me below error message while importing the dashboard i am getting the below error message - Error i… --- ## [Reloading prospectors results in ERR in Filebeat 5.5.0](https://discuss.elastic.co/t/reloading-prospectors-results-in-err-in-filebeat-5-5-0/94512)
**Author:** [@dpaar](https://discuss.elastic.co/u/dpaar)\ **Replies:** 4\ **Last updated:** [August 29, 2017, 6:23am UTC](https://discuss.elastic.co/t/reloading-prospectors-results-in-err-in-filebeat-5-5-0/94512 "2017-08-29T06:23:00Z")
I'm using Filebeat 5.5.0 from https://artifacts.elastic.co/packages/5.x/apt stable main in a Docker container running ubuntu:16.04 to ship logs from Docker containers to logstash. When I start Filebeat, it correctly loa… --- ## [Beat File Output Dynamic Naming](https://discuss.elastic.co/t/beat-file-output-dynamic-naming/98583)
**Author:** [@Patrick\_Stevens](https://discuss.elastic.co/u/Patrick_Stevens)\ **Replies:** 3\ **Last updated:** [August 28, 2017, 10:34pm UTC](https://discuss.elastic.co/t/beat-file-output-dynamic-naming/98583 "2017-08-28T22:34:58Z")
Hi all, I am using the File Output functionality of Metricbeat and Winlogbeat 5.5.1, and I’d like the ability to add beat data to the output filename. Specifically the date component of the @timestamp field. Does the Be… --- ## [How can split discovery message field?](https://discuss.elastic.co/t/how-can-split-discovery-message-field/96370)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 7\ **Last updated:** [August 28, 2017, 2:53pm UTC](https://discuss.elastic.co/t/how-can-split-discovery-message-field/96370 "2017-08-28T14:53:40Z")
Elasticsearch version 5.5.1 kibana version 5.5.1 Logstash version 5.5.1 Beats version 5.5.1 my message field: message:\[INFO \] Status =\> SENT | client : \[IPDC\] | cell : \[1746710009\] | message-delivery-time : \[2017-0… --- ## [Log parsing - ampersand getting transformed to \\u0026](https://discuss.elastic.co/t/log-parsing-ampersand-getting-transformed-to-u0026/98453)
**Author:** [@raskin](https://discuss.elastic.co/u/raskin)\ **Replies:** 1\ **Last updated:** [August 28, 2017, 2:40pm UTC](https://discuss.elastic.co/t/log-parsing-ampersand-getting-transformed-to-u0026/98453 "2017-08-28T14:40:46Z")
Hi Team, We were using filebeat 2.x for quite long time. Recently we decided to upgrade to 5.5 version of ELK stack along with kafka. Filebeat -\> Kafka-cluster -\> logstash -\> ES -\> Kibana We are able to successfully c… --- ## [Filebeat can real-time collection?](https://discuss.elastic.co/t/filebeat-can-real-time-collection/98545)
**Author:** [@netdata](https://discuss.elastic.co/u/netdata)\ **Replies:** 2\ **Last updated:** [August 28, 2017, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-can-real-time-collection/98545 "2017-08-28T14:31:38Z")
i set some parm but i can’t realize real-time collection --- ## [Topbeat is now part of Metricbeat](https://discuss.elastic.co/t/topbeat-is-now-part-of-metricbeat/98535)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [August 28, 2017, 10:03am UTC](https://discuss.elastic.co/t/topbeat-is-now-part-of-metricbeat/98535 "2017-08-28T10:03:00Z")
Topbeat has been integrated into Metricbeat! This means you can now just install Metricbeat and enable the system module, and you get the same functionality but in an easier to manage format :slight\_smile: This categor… --- ## [Metricbeat 6.0.0-beta1 config reload issue](https://discuss.elastic.co/t/metricbeat-6-0-0-beta1-config-reload-issue/98234)
**Author:** [@randude](https://discuss.elastic.co/u/randude)\ **Replies:** 5\ **Last updated:** [August 27, 2017, 8:03am UTC](https://discuss.elastic.co/t/metricbeat-6-0-0-beta1-config-reload-issue/98234 "2017-08-27T08:03:41Z")
Hi, I enabled this feature and tried several things. I changed one of the modules from false to true and then tried to add a new module altogether. In both cases, nothing was written to log to confirm that the reload … --- ## [Config sending log](https://discuss.elastic.co/t/config-sending-log/98431)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 1\ **Last updated:** [August 26, 2017, 9:48am UTC](https://discuss.elastic.co/t/config-sending-log/98431 "2017-08-26T09:48:54Z")
Hi experts. I have config filebeat to collect logfile but now i have a task that writing log file not in my process. I have to write log directly in Redis like following My API sending log to Redis -\> Logstash -\> ES … --- ## [Timestamps are getting merged when ingesting old data using filebeat](https://discuss.elastic.co/t/timestamps-are-getting-merged-when-ingesting-old-data-using-filebeat/97975)
**Author:** [@Manikanth\_Reddy](https://discuss.elastic.co/u/Manikanth_Reddy)\ **Replies:** 8\ **Last updated:** [August 25, 2017, 8:32pm UTC](https://discuss.elastic.co/t/timestamps-are-getting-merged-when-ingesting-old-data-using-filebeat/97975 "2017-08-25T20:32:34Z")
vmstat Log File 1: Fri Mar 17 15:00:37 CDT 2017 kthr memory page disk faults cpu r b w swap free re mf pi po fr de sr m0 m1 m2 m3 in sy cs us sy id 3 0 0 113340 8… --- ## [Is there a way to set up Kafka message format in AVRO instead of JSON?](https://discuss.elastic.co/t/is-there-a-way-to-set-up-kafka-message-format-in-avro-instead-of-json/98133)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 3\ **Last updated:** [August 25, 2017, 8:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-set-up-kafka-message-format-in-avro-instead-of-json/98133 "2017-08-25T20:14:25Z")
I set up Filebeat send outputs to Kafka. I would like the kafka messages are in Avro format instead of JSON format. I am wondering what is the easiest way to achieve this if possible? thanks! yan --- ## [Filebeat and Modules when ES Down](https://discuss.elastic.co/t/filebeat-and-modules-when-es-down/98410)
**Author:** [@ElasticChris](https://discuss.elastic.co/u/ElasticChris)\ **Replies:** 0\ **Last updated:** [August 25, 2017, 7:31pm UTC](https://discuss.elastic.co/t/filebeat-and-modules-when-es-down/98410 "2017-08-25T19:31:40Z")
Whenever I use modules like syslog or nginx, I can’t get filebeat to start, if elasticsearch isn’t up and running. I get: " CRIT Exiting: Error creating ES client: Couldn’t connect to any of the configured Elasticsearch… --- ## [Configuring heartbeat hosts list](https://discuss.elastic.co/t/configuring-heartbeat-hosts-list/98390)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 2\ **Last updated:** [August 25, 2017, 3:33pm UTC](https://discuss.elastic.co/t/configuring-heartbeat-hosts-list/98390 "2017-08-25T15:33:56Z")
The list of hosts that Heartbeat polls is configured in the “hosts” list in heartbeat.yml. If I’ve got lots of hosts, and hosts come and go, and there are databases of them elsewhere, is it possible to get Heartbeat to … --- ## [Drop network events](https://discuss.elastic.co/t/drop-network-events/98032)
**Author:** [@muratungor](https://discuss.elastic.co/u/muratungor)\ **Replies:** 5\ **Last updated:** [August 25, 2017, 1:03pm UTC](https://discuss.elastic.co/t/drop-network-events/98032 "2017-08-25T13:03:37Z")
Hello I have 2 filter in my metricbeat.yml Blockquote filters: drop\_event.when.equals.system.network.name: lo drop\_event.when.regexp.mount\_point: '^/(automnt|tmp|boot|net|misc|/var/lib|sys|cgroup|proc|dev|etc|host|… --- ## [Beats 6.x does not require Kibana for importing dashboards](https://discuss.elastic.co/t/beats-6-x-does-not-require-kibana-for-importing-dashboards/98072)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 2\ **Last updated:** [August 25, 2017, 10:30am UTC](https://discuss.elastic.co/t/beats-6-x-does-not-require-kibana-for-importing-dashboards/98072 "2017-08-25T10:30:38Z")
Hello. I am testing beats 6.0. According to documentation (and source codes) it should require Kibana to load dashboards. But it loads dashboards without Kibana well (no Kibana is running on localhost:5601 …). Is it OK, … --- ## [Add\_kubernetes\_metadata should work in "/var/log/containers"](https://discuss.elastic.co/t/add-kubernetes-metadata-should-work-in-var-log-containers/97945)
**Author:** [@Sven\_Woltmann](https://discuss.elastic.co/u/Sven_Woltmann)\ **Replies:** 7\ **Last updated:** [August 25, 2017, 8:31am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-should-work-in-var-log-containers/97945 "2017-08-25T08:31:44Z")
I'm following up on this topic: The "add\_kubernetes\_metadata" processor works only if logs are read from /var/lib/docker/containers/\*/\*.log, it doesn't work with logs from /var/log/containers/\*.log. This is caused by … --- ## [FileBeat Not starting due to config in yml file](https://discuss.elastic.co/t/filebeat-not-starting-due-to-config-in-yml-file/97876)
**Author:** [@aditya\_soni](https://discuss.elastic.co/u/aditya_soni)\ **Replies:** 14\ **Last updated:** [August 25, 2017, 6:17am UTC](https://discuss.elastic.co/t/filebeat-not-starting-due-to-config-in-yml-file/97876 "2017-08-25T06:17:23Z")
HI experts, This is my filebeat.yml file … i am getting error :1053 whenever i am starting filebeat service. may be some mistake i am doing in this file, please correct me where i am wrong. ###################### Fi… --- ## [Filebeat nginx grok error](https://discuss.elastic.co/t/filebeat-nginx-grok-error/98298)
**Author:** [@jvanhoose](https://discuss.elastic.co/u/jvanhoose)\ **Replies:** 0\ **Last updated:** [August 24, 2017, 10:26pm UTC](https://discuss.elastic.co/t/filebeat-nginx-grok-error/98298 "2017-08-24T22:26:47Z")
We are getting a strange grok error using the nginx module in filebeat 5.5.2. The server config is: /etc/filebeat/filebeat.yml: filebeat: nginx filebeat module modules: module: nginx access: enabled: true var.pip… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=502) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=504)