# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=504 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 505 --- ## [Packetbeat performance SPAN](https://discuss.elastic.co/t/packetbeat-performance-span/98250)
**Author:** [@cmqv](https://discuss.elastic.co/u/cmqv)\ **Replies:** 0\ **Last updated:** [August 24, 2017, 2:32pm UTC](https://discuss.elastic.co/t/packetbeat-performance-span/98250 "2017-08-24T14:32:35Z")
I’d want to evaluate the use of packetbeat to pickup traffic from a SPAN port. (i have no idea what my traffic output from the SPAN port is, but i assume somewhere around 10Gbps) I assume i will compile against the pf\_… --- ## [SSL from filebeat to Kafka](https://discuss.elastic.co/t/ssl-from-filebeat-to-kafka/98105)
**Author:** [@venky1987](https://discuss.elastic.co/u/venky1987)\ **Replies:** 1\ **Last updated:** [August 24, 2017, 12:34pm UTC](https://discuss.elastic.co/t/ssl-from-filebeat-to-kafka/98105 "2017-08-24T12:34:03Z")
I could see the below note in the link: https://www.elastic.co/guide/en/beats/filebeat/current/securing-communication-elasticsearch.html For any given connection, the SSL/TLS certificates must have a subject that matche… --- ## [Add ceph cluster status to metricbeat](https://discuss.elastic.co/t/add-ceph-cluster-status-to-metricbeat/98196)
**Author:** [@elaron](https://discuss.elastic.co/u/elaron)\ **Replies:** 2\ **Last updated:** [August 24, 2017, 10:03am UTC](https://discuss.elastic.co/t/add-ceph-cluster-status-to-metricbeat/98196 "2017-08-24T10:03:29Z")
Hi, I am trying to add a cluster\_status to metricbeat’s ceph module. Here is the git URL: Cluster\_status will collect pgmap, osdmap, throughput and iops information of ceph cluster. --- ## [How does Metricbeat template looks like with the removal of Mapping types?](https://discuss.elastic.co/t/how-does-metricbeat-template-looks-like-with-the-removal-of-mapping-types/98120)
**Author:** [@Parisa](https://discuss.elastic.co/u/Parisa)\ **Replies:** 1\ **Last updated:** [August 24, 2017, 9:25am UTC](https://discuss.elastic.co/t/how-does-metricbeat-template-looks-like-with-the-removal-of-mapping-types/98120 "2017-08-24T09:25:46Z")
Hi, I was reading on elasticsearch 6 and the removal of mapping types. I was wondering how would the metricbeat template looks like in elasticsearch 6 & 7? Thanks, Parisa. --- ## [Installation on Windows server](https://discuss.elastic.co/t/installation-on-windows-server/97010)
**Author:** [@Karthikeyan\_Krishnam](https://discuss.elastic.co/u/Karthikeyan_Krishnam)\ **Replies:** 3\ **Last updated:** [August 24, 2017, 7:07am UTC](https://discuss.elastic.co/t/installation-on-windows-server/97010 "2017-08-24T07:07:28Z")
Security policy on the Windows server 2012 is not allowing the Metricbeat to be installed as a service. We could alter execution policy to “Bypass” for Process and Localmachine but could not alter for other process. aft… --- ## [Filebeat miss metadata of docker container when container stops](https://discuss.elastic.co/t/filebeat-miss-metadata-of-docker-container-when-container-stops/98037)
**Author:** [@dengqingpei](https://discuss.elastic.co/u/dengqingpei)\ **Replies:** 2\ **Last updated:** [August 24, 2017, 3:03am UTC](https://discuss.elastic.co/t/filebeat-miss-metadata-of-docker-container-when-container-stops/98037 "2017-08-24T03:03:12Z")
I am trying filebeat 6.0 beta container to collect container's stdout/stderr log. Every thing works as expected but a small problem. First, let me make a brief description about my deployment. I deploy my spring boot a… --- ## [Filebeat Metrics](https://discuss.elastic.co/t/filebeat-metrics/98127)
**Author:** [@akosmin](https://discuss.elastic.co/u/akosmin)\ **Replies:** 0\ **Last updated:** [August 23, 2017, 8:27pm UTC](https://discuss.elastic.co/t/filebeat-metrics/98127 "2017-08-23T20:27:17Z")
I know Filebeat can output metrics in its logfile but they appear to only be a subset of what is available via a GET /debug/vars when filebeat is running with -httpprof. If I am correct, I have some questions: Why a s… --- ## [PacketBeat - negative responsetime](https://discuss.elastic.co/t/packetbeat-negative-responsetime/98094)
**Author:** [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Replies:** 0\ **Last updated:** [August 23, 2017, 2:08pm UTC](https://discuss.elastic.co/t/packetbeat-negative-responsetime/98094 "2017-08-23T14:08:57Z")
Hi, I’ve installed packetbeat Version 5.5.2 on a mysql node and I get negative responsetime in Kibana. My config (simplified) is the following: #================================== Flows ===============================… --- ## [Winlogbeat logging.level does not level properly](https://discuss.elastic.co/t/winlogbeat-logging-level-does-not-level-properly/98036)
**Author:** [@g4nj4wizard](https://discuss.elastic.co/u/g4nj4wizard)\ **Replies:** 2\ **Last updated:** [August 23, 2017, 1:55pm UTC](https://discuss.elastic.co/t/winlogbeat-logging-level-does-not-level-properly/98036 "2017-08-23T13:55:14Z")
Hello everyone, i’ve set logging.level to warning. So this should only collect events with level = critical, error, warning. But i am still receiving a massive amount of Information messages. I already restarted the se… --- ## [A question about Winlogbeat configuration](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 4\ **Last updated:** [August 23, 2017, 12:29pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050 "2017-08-23T12:29:30Z")
Hello. If I like below diagram: Winlogbeat -\> Logstash -\> Elasticsearch -\> Kibana Then in Winlogbeat configuration I must set both Logstash and Elasticsearch servers? Thank you. --- ## [Failed to publish events caused by EOF](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof/98067)
**Author:** [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\ **Replies:** 1\ **Last updated:** [August 23, 2017, 12:08pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-caused-by-eof/98067 "2017-08-23T12:08:45Z")
Hi all, I am trying to send log files from filebeat (5.5.1) to logstash-docker-elk (repo) (5.3.0) but here’s what I am getting in filebeat: 2017-08-23T13:20:57+02:00 INFO Metrics logging every 30s 2017-08-23T13:20:57+02… --- ## [Prometheus Metricbeat non-beta?](https://discuss.elastic.co/t/prometheus-metricbeat-non-beta/97484)
**Author:** [@gregsh](https://discuss.elastic.co/u/gregsh)\ **Replies:** 5\ **Last updated:** [August 23, 2017, 11:28am UTC](https://discuss.elastic.co/t/prometheus-metricbeat-non-beta/97484 "2017-08-23T11:28:11Z")
Anyone know when the Metricbeat Prometheus addon will be out of beta? Or at least support basic metrics from Prometheus like CPU/Memory? Thanks --- ## [More compact JSON output for module Windows perfmon](https://discuss.elastic.co/t/more-compact-json-output-for-module-windows-perfmon/97242)
**Author:** [@githubmui\_mui](https://discuss.elastic.co/u/githubmui_mui)\ **Replies:** 4\ **Last updated:** [August 22, 2017, 2:54pm UTC](https://discuss.elastic.co/t/more-compact-json-output-for-module-windows-perfmon/97242 "2017-08-22T14:54:32Z")
Hi, is there a way to make the JSON output (e.g. via file output) less redunant? I am searching for a windows module configuration to write all performance counters e.g. of category “memory” into one single JSON record… --- ## [How to read log json array format with filebeat](https://discuss.elastic.co/t/how-to-read-log-json-array-format-with-filebeat/96220)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 10\ **Last updated:** [August 23, 2017, 2:36am UTC](https://discuss.elastic.co/t/how-to-read-log-json-array-format-with-filebeat/96220 "2017-08-23T02:36:42Z")
I have many log look like (json array) This is raw log \[{"CreationTime":"2017-06-17T06:28:56","Id":"77bf08c6-5bb9-4333-a394-03f181d7250a","Operation":"UserLoggedIn","OrganizationId":"4ebc33361-871a-44c5-93a5-60eb59091… --- ## [Using filebeat and logstash](https://discuss.elastic.co/t/using-filebeat-and-logstash/97952)
**Author:** [@pzkr](https://discuss.elastic.co/u/pzkr)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 5:36pm UTC](https://discuss.elastic.co/t/using-filebeat-and-logstash/97952 "2017-08-22T17:36:38Z")
i intend to use filebeat for making multiline events into a sequence of events and then use logstash grok patterns to create index and filter data. while when i use only logstash the index is created in a manner i want … --- ## ["event\_id:" can't work properly! (solved: config indentation)](https://discuss.elastic.co/t/event-id-cant-work-properly-solved-config-indentation/97924)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 1\ **Last updated:** [August 22, 2017, 2:21pm UTC](https://discuss.elastic.co/t/event-id-cant-work-properly-solved-config-indentation/97924 "2017-08-22T14:21:31Z")
Hello. I like to configure "Winlogbeat" for filter my Event ID. I added below line to my config file: - name: Security event\_id: 4663,4660 But when I want to start service then I got below error: How can I solve … --- ## [Beats\>LS\>ES vs LS-file\>ES (Performance)](https://discuss.elastic.co/t/beats-ls-es-vs-ls-file-es-performance/97877)
**Author:** [@mytzusky](https://discuss.elastic.co/u/mytzusky)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 8:33am UTC](https://discuss.elastic.co/t/beats-ls-es-vs-ls-file-es-performance/97877 "2017-08-22T08:33:36Z")
Hi, I’m new here and already read a lot about ELK but can’t understand this. What is the best way to read file logs, extract some fields, and send to Elastic search, is the performance better when Filebeat’s sending t… --- ## [Metricbeat to Logstash on a remote server not working](https://discuss.elastic.co/t/metricbeat-to-logstash-on-a-remote-server-not-working/97904)
**Author:** [@Syed\_Washfi\_Ahmad](https://discuss.elastic.co/u/Syed_Washfi_Ahmad)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 12:31pm UTC](https://discuss.elastic.co/t/metricbeat-to-logstash-on-a-remote-server-not-working/97904 "2017-08-22T12:31:47Z")
I am new to elastic stack . I am trying to send metrics from one pc to another remote server using Metricbeat and logstash. Below are my configuration files, metricbeat.yml\*\*\*\*\* metricbeat.modules: #-----------------… --- ## [Filebeat locking files (Access Denied)](https://discuss.elastic.co/t/filebeat-locking-files-access-denied/97900)
**Author:** [@Claus\_Nielsen](https://discuss.elastic.co/u/Claus_Nielsen)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 11:45am UTC](https://discuss.elastic.co/t/filebeat-locking-files-access-denied/97900 "2017-08-22T11:45:58Z")
We are currently using filebeat 5.4.1 in our build environment The logs we are collecting are getting generated by the build software then removed after a build finishes. We are currently seeing a lot of access denied wh… --- ## [File Beat Not Starting](https://discuss.elastic.co/t/file-beat-not-starting/97874)
**Author:** [@aditya\_soni](https://discuss.elastic.co/u/aditya_soni)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 8:26am UTC](https://discuss.elastic.co/t/file-beat-not-starting/97874 "2017-08-22T08:26:38Z")
\###################### Filebeat Configuration Example ######################### This file is an example configuration file highlighting only the most common options. The filebeat.full.yml file from the same directory co… --- ## [Help for analysis databases](https://discuss.elastic.co/t/help-for-analysis-databases/97708)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 3\ **Last updated:** [August 22, 2017, 2:05am UTC](https://discuss.elastic.co/t/help-for-analysis-databases/97708 "2017-08-22T02:05:58Z")
Hi experts I’m now have to control 4 type of db: Redis, MySQL, Memcached and Elasticsearch. (Live/die, Methods, respontime, queries, … ) I start with MySQL and there are 3 dashboard sample from filebeat, metricbeat and… --- ## [Unable to post a message to Kafka](https://discuss.elastic.co/t/unable-to-post-a-message-to-kafka/97684)
**Author:** [@arieltk](https://discuss.elastic.co/u/arieltk)\ **Replies:** 2\ **Last updated:** [August 21, 2017, 12:08pm UTC](https://discuss.elastic.co/t/unable-to-post-a-message-to-kafka/97684 "2017-08-21T12:08:22Z")
Hi all, I am unable to post a message to Kafka from filebeat if the topic do not already exists in Kafka. The error I see is “WARN kafka message: client/metadata found some partitions to be leaderless”. I am not able t… --- ## [Can't get Filebeat to work](https://discuss.elastic.co/t/cant-get-filebeat-to-work/97740)
**Author:** [@alque](https://discuss.elastic.co/u/alque)\ **Replies:** 0\ **Last updated:** [August 21, 2017, 9:47am UTC](https://discuss.elastic.co/t/cant-get-filebeat-to-work/97740 "2017-08-21T09:47:55Z")
Hi, Colleagues! I have installed ELK in Windows and it was all good, until I changed my filebeats configuration to test some stuff. Now I cant get it to work again. The structure is FB \> LS \> ES \> K My FB configuratio… --- ## [Heartbeat Query - Problem with Websites Security Certificate](https://discuss.elastic.co/t/heartbeat-query-problem-with-websites-security-certificate/97191)
**Author:** [@r4z0rw1r3666](https://discuss.elastic.co/u/r4z0rw1r3666)\ **Replies:** 4\ **Last updated:** [August 21, 2017, 12:42am UTC](https://discuss.elastic.co/t/heartbeat-query-problem-with-websites-security-certificate/97191 "2017-08-21T00:42:52Z")
Hello, I’ve configured heartbeat to connect to a https wsdl endpoint, however there is a problem with the website security certificate, causing failures. As a test, I have put ssl.verification\_mode: none into the monit… --- ## [PacketBeat: unable to compile tcp example](https://discuss.elastic.co/t/packetbeat-unable-to-compile-tcp-example/97690)
**Author:** [@firmitas](https://discuss.elastic.co/u/firmitas)\ **Replies:** 2\ **Last updated:** [August 20, 2017, 7:56pm UTC](https://discuss.elastic.co/t/packetbeat-unable-to-compile-tcp-example/97690 "2017-08-20T19:56:43Z")
Hi, I’m trying to write my own packetbeat, so I’m generating a tcp protocol base on “create\_tcp\_protocol.py”. And when I’m trying to compile the new packetbeat I get the next error: protos/mybeat/pub.go:15: undefined:… --- ## [Use packetbeat without root](https://discuss.elastic.co/t/use-packetbeat-without-root/97679)
**Author:** [@twitoomer](https://discuss.elastic.co/u/twitoomer)\ **Replies:** 1\ **Last updated:** [August 20, 2017, 6:58pm UTC](https://discuss.elastic.co/t/use-packetbeat-without-root/97679 "2017-08-20T18:58:08Z")
Hi, In my company, the Linux based servers are restricted and we don’t have root privileges, therefore, I cannot start Packetbeat. The error I get is: Error creating sniffer: any: You don’t have permission to capture on… --- ## [Duplicate entries](https://discuss.elastic.co/t/duplicate-entries/97627)
**Author:** [@grandchamp](https://discuss.elastic.co/u/grandchamp)\ **Replies:** 2\ **Last updated:** [August 20, 2017, 5:49pm UTC](https://discuss.elastic.co/t/duplicate-entries/97627 "2017-08-20T17:49:07Z")
Hi. I was using ELK running on a Windows environment, but i had changed it to Linux running on Docker. On Windows, it was running fine without duplicating entries collected from filebeat. So far, my scenario is: 1 - … --- ## [How to install packagebeat in AIX](https://discuss.elastic.co/t/how-to-install-packagebeat-in-aix/97671)
**Author:** [@fenggnay](https://discuss.elastic.co/u/fenggnay)\ **Replies:** 1\ **Last updated:** [August 20, 2017, 5:02pm UTC](https://discuss.elastic.co/t/how-to-install-packagebeat-in-aix/97671 "2017-08-20T17:02:03Z")
Install package for linux doesn’t used in IBM AIX server.how to set environment for compress beat. --- ## [Filebeat command not found](https://discuss.elastic.co/t/filebeat-command-not-found/97686)
**Author:** [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\ **Replies:** 1\ **Last updated:** [August 20, 2017, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-command-not-found/97686 "2017-08-20T15:34:15Z")
Hi there, I am using Ubuntu with the latest filebeat version, to start filebeat I run sudo /etc/init.d/filebeat start and I get \[ ok \] Starting filebeat (via systemctl): filebeat.service. Then I want to run filebeat -c … --- ## [Environment variable in filebeat](https://discuss.elastic.co/t/environment-variable-in-filebeat/97579)
**Author:** [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)\ **Replies:** 2\ **Last updated:** [August 20, 2017, 1:09am UTC](https://discuss.elastic.co/t/environment-variable-in-filebeat/97579 "2017-08-20T01:09:54Z")
Hello everyone, Filebeat version: 5.5 I used environment variable in filebeat config, but it report the error as following: filebeat2017/08/18 12:34:40.994010 beat.go:339: CRIT Exiting: error loading config file: yam… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=503) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=505)