# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=52 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 53 --- ## [Shards failures - illegal\_argument\_exception](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311)
**Author:** [@dpecak](https://discuss.elastic.co/u/dpecak)\ **Replies:** 0\ **Last updated:** [April 19, 2023, 2:03pm UTC](https://discuss.elastic.co/t/shards-failures-illegal-argument-exception/330311 "2023-04-19T14:03:17Z")
I have fresh installation of ELK stack with Filebeat and Metricbeat. When I try to open predefined dashboard (for example "\[Filebeat System\] SSH login attempts ECS"), I see many shard failures: Fielddata is disabled on … --- ## [How to customize the exported fields?](https://discuss.elastic.co/t/how-to-customize-the-exported-fields/330240)
**Author:** [@matheuscirillo](https://discuss.elastic.co/u/matheuscirillo)\ **Replies:** 0\ **Last updated:** [April 18, 2023, 4:59pm UTC](https://discuss.elastic.co/t/how-to-customize-the-exported-fields/330240 "2023-04-18T16:59:01Z")
I have a very basic filebeats.yml configuration file: filebeat: inputs: - type: filestream id: my-log-stream paths: - /path/to/application/logs/\*.log json: keys\_under\_root: true add\_err… --- ## [Add field from filebeat eventhub input parameter](https://discuss.elastic.co/t/add-field-from-filebeat-eventhub-input-parameter/330139)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 2\ **Last updated:** [April 18, 2023, 3:18pm UTC](https://discuss.elastic.co/t/add-field-from-filebeat-eventhub-input-parameter/330139 "2023-04-18T15:18:40Z")
Hello, I want to add field from filebeat eventhub input parameter. I use this input configuration: - type: azure-eventhub id: azure-eventhub-insights-activity-1 eventhub: "activity-logs" consumer\_group: "$Defaul… --- ## [Metricbeat error: failed to get docker stats: Cannot connect to the Docker daemon at unix:///run/podman/io.podman](https://discuss.elastic.co/t/metricbeat-error-failed-to-get-docker-stats-cannot-connect-to-the-docker-daemon-at-unix-run-podman-io-podman/329995)
**Author:** [@Usama\_Tariq](https://discuss.elastic.co/u/Usama_Tariq)\ **Replies:** 2\ **Last updated:** [April 18, 2023, 6:34am UTC](https://discuss.elastic.co/t/metricbeat-error-failed-to-get-docker-stats-cannot-connect-to-the-docker-daemon-at-unix-run-podman-io-podman/329995 "2023-04-18T06:34:43Z")
Hi all. I am facing an issue when trying to get docker metrics via podman. I am getting the following error: "failed to get docker stats: Cannot connect to the Docker daemon at unix:///run/podman/io.podman. Is the docke… --- ## [GRAYLOG WITH OPENSEACH](https://discuss.elastic.co/t/graylog-with-openseach/330151)
**Author:** [@jomaguca](https://discuss.elastic.co/u/jomaguca)\ **Replies:** 3\ **Last updated:** [April 18, 2023, 6:06am UTC](https://discuss.elastic.co/t/graylog-with-openseach/330151 "2023-04-18T06:06:24Z")
Hi everyone I am using graylog with opnsearsh and I have a doubt to use filebeat, metricbeat etc because what is the version on all them to use with opensearch? Best regards. --- ## [How many times (interval/period) do metrics send to elasticsearch? Where i can see these information?](https://discuss.elastic.co/t/how-many-times-interval-period-do-metrics-send-to-elasticsearch-where-i-can-see-these-information/329851)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 1\ **Last updated:** [April 18, 2023, 3:39am UTC](https://discuss.elastic.co/t/how-many-times-interval-period-do-metrics-send-to-elasticsearch-where-i-can-see-these-information/329851 "2023-04-18T03:39:34Z")
Hello community, how can i see in which interval the metrics from a cluster is sending to elasticsearch? what is this "period" in metricbeat-kubernetes.yml saying ? templates: - config: - m… --- ## [Connect: connection refused](https://discuss.elastic.co/t/connect-connection-refused/330123)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 0\ **Last updated:** [April 17, 2023, 11:55am UTC](https://discuss.elastic.co/t/connect-connection-refused/330123 "2023-04-17T11:55:20Z")
I have a fresh elasticsearch cluster deployed on kubernetes. I have deployed metricbeat 8.7.0 and i get the following error in the logs of each metricbeat pod. Does anyone know how to resolve this issue? {"log.level":… --- ## [Frequently occurring "should have been dropped, but couldn't as state is not finished"](https://discuss.elastic.co/t/frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/330082)
**Author:** [@micmeow](https://discuss.elastic.co/u/micmeow)\ **Replies:** 1\ **Last updated:** [April 16, 2023, 8:32am UTC](https://discuss.elastic.co/t/frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/330082 "2023-04-16T08:32:13Z")
Hello. If you know how fix that, lend me your wisdom. I use filebeat to transfer logs to Logstash to Opensearch. When I checked the filebeat log, I found that the same log file transfer errors were occurring frequently… --- ## [Loading Kibana dashboards using Metricbeat through HELM charts](https://discuss.elastic.co/t/loading-kibana-dashboards-using-metricbeat-through-helm-charts/329414)
**Author:** [@RoshRagh](https://discuss.elastic.co/u/RoshRagh)\ **Replies:** 0\ **Last updated:** [April 5, 2023, 10:33am UTC](https://discuss.elastic.co/t/loading-kibana-dashboards-using-metricbeat-through-helm-charts/329414 "2023-04-05T10:33:10Z")
Hi, I am looking to load the default dashboards that come pre-built in Kibana by setting up a Kibana endpoint in metricbeat configuration. The "setup.kibana" option is not really available in the official metricbeat hel… --- ## [Drop\_fields](https://discuss.elastic.co/t/drop-fields/330045)
**Author:** [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\ **Replies:** 2\ **Last updated:** [April 15, 2023, 12:00am UTC](https://discuss.elastic.co/t/drop-fields/330045 "2023-04-15T00:00:40Z")
Hello! I've just started learning ELK and I'm having some confusion with filebeat's drop\_fields processor. My configuration: filebeat.inputs: - type: log paths: - /mnt/var/log/ovpnagent.log fields\_unde… --- ## [Filebeat Suricata Module "module suricata is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954)
**Author:** [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Replies:** 4\ **Last updated:** [April 14, 2023, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954 "2023-04-14T14:44:50Z")
I'm running filebeat 8.6.2. I initially had it grabbing /var/log/remote.log and it worked fine. Then I enabled the suricata module and set the configuration to this (excluding the output.elasticsearch section): filebe… --- ## [Filebeat (Zeek and Suricata) output to Logstash suddenly broke](https://discuss.elastic.co/t/filebeat-zeek-and-suricata-output-to-logstash-suddenly-broke/329909)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 1\ **Last updated:** [April 14, 2023, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-zeek-and-suricata-output-to-logstash-suddenly-broke/329909 "2023-04-14T13:40:17Z")
Hello, I am sending filebeat data from a network sensor that is running Zeek and Suricata to a logstash server. This server has been sending logs successfully w/o issue for over 6 months. This morning something happened… --- ## [Is possible to use Filebeat o365 plugin on "offline" data](https://discuss.elastic.co/t/is-possible-to-use-filebeat-o365-plugin-on-offline-data/329998)
**Author:** [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Replies:** 1\ **Last updated:** [April 14, 2023, 1:25pm UTC](https://discuss.elastic.co/t/is-possible-to-use-filebeat-o365-plugin-on-offline-data/329998 "2023-04-14T13:25:14Z")
Hello community! I have recently discovered o365 module for Filebeat (Office 365 module | Filebeat Reference \[8.7\] | Elastic). My question is: is it possible to use it for offline data? I'm interested to have it since… --- ## [Elastic forwarder cloudwatch log group wildcard id not working](https://discuss.elastic.co/t/elastic-forwarder-cloudwatch-log-group-wildcard-id-not-working/329987)
**Author:** [@dchocoboo](https://discuss.elastic.co/u/dchocoboo)\ **Replies:** 0\ **Last updated:** [April 14, 2023, 9:35am UTC](https://discuss.elastic.co/t/elastic-forwarder-cloudwatch-log-group-wildcard-id-not-working/329987 "2023-04-14T09:35:01Z")
i'm trying to simplify my config.yaml based on this tutorial currently if i put this in my config - type: "cloudwatch-logs" id: "arn:aws:logs:ap-southeast-1:xxxxxxxxxx:log-group:\*:\*" outputs: - type: "el… --- ## [Ls there a processor in filebeat same as a prune filter in logstash?](https://discuss.elastic.co/t/ls-there-a-processor-in-filebeat-same-as-a-prune-filter-in-logstash/329940)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [April 13, 2023, 3:25pm UTC](https://discuss.elastic.co/t/ls-there-a-processor-in-filebeat-same-as-a-prune-filter-in-logstash/329940 "2023-04-13T15:25:05Z")
Hello. I want to get only specific fields in filebeat data. I know there is a prune filter in logstash config file but which one is same thing in filebeat config file processor? I used include\_fields processor, but it … --- ## [Loss of logs when using filebeat 8.4.3 with autodiscover feature is enabled](https://discuss.elastic.co/t/loss-of-logs-when-using-filebeat-8-4-3-with-autodiscover-feature-is-enabled/329918)
**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\ **Replies:** 0\ **Last updated:** [April 13, 2023, 10:17am UTC](https://discuss.elastic.co/t/loss-of-logs-when-using-filebeat-8-4-3-with-autodiscover-feature-is-enabled/329918 "2023-04-13T10:17:17Z")
When configured filebeat with autodiscover feature enabled I could observe some loss of logs with version 8.4.3 filebeat. Is it an expected behaviour or any ongoing ticket on this issue..? Could someone help here.. --- ## [Should we use filebeat include\_lines to pre-filter messages before sent it to logstash?](https://discuss.elastic.co/t/should-we-use-filebeat-include-lines-to-pre-filter-messages-before-sent-it-to-logstash/329914)
**Author:** [@atline](https://discuss.elastic.co/u/atline)\ **Replies:** 0\ **Last updated:** [April 13, 2023, 9:28am UTC](https://discuss.elastic.co/t/should-we-use-filebeat-include-lines-to-pre-filter-messages-before-sent-it-to-logstash/329914 "2023-04-13T09:28:53Z")
Usually in logstash we could use next to filter messages: filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:logtime}.\*\] %{NOTSPACE:device}: place acquired by %{NOTSPACE:user}" … --- ## [Heartbeat to monitor same service installed in mutiple server and check status in which server up or down?,](https://discuss.elastic.co/t/heartbeat-to-monitor-same-service-installed-in-mutiple-server-and-check-status-in-which-server-up-or-down/329434)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [April 13, 2023, 2:33am UTC](https://discuss.elastic.co/t/heartbeat-to-monitor-same-service-installed-in-mutiple-server-and-check-status-in-which-server-up-or-down/329434 "2023-04-13T02:33:22Z")
Hello All, I'm facing one issue I've configured below http.yml and with config what is happening is that: I have same service installed in multiple servers, ex: abc service on server A,B,C,similarly others also. Now s… --- ## [Filebeat v.8 can't fetch the EOF with input type filestream](https://discuss.elastic.co/t/filebeat-v-8-cant-fetch-the-eof-with-input-type-filestream/329877)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 0\ **Last updated:** [April 13, 2023, 1:46am UTC](https://discuss.elastic.co/t/filebeat-v-8-cant-fetch-the-eof-with-input-type-filestream/329877 "2023-04-13T01:46:21Z")
Hi. In Filebeat v.7.3.2, it used to send the EOF in its logs. However, in Filebeat v.8.6.2, it does not send EOF and cant fetch the end of the file reached. What I changed is the input type log to filestream only. fil… --- ## [Where is “End Of File reached” message in Filebeat logs in v.8?](https://discuss.elastic.co/t/where-is-end-of-file-reached-message-in-filebeat-logs-in-v-8/329161)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 1\ **Last updated:** [April 13, 2023, 1:31am UTC](https://discuss.elastic.co/t/where-is-end-of-file-reached-message-in-filebeat-logs-in-v-8/329161 "2023-04-13T01:31:13Z")
My app finishes the connection to Filebeat when the message "End Of File reached" comes out from Filebeat(v.7) logs. However in Filebeat v.8, I can't find the eof message. Does v.8 Filebeat send the message like v.7 use… --- ## [Winlogbeat wrong values](https://discuss.elastic.co/t/winlogbeat-wrong-values/326070)
**Author:** [@objectprogr](https://discuss.elastic.co/u/objectprogr)\ **Replies:** 7\ **Last updated:** [April 12, 2023, 1:36pm UTC](https://discuss.elastic.co/t/winlogbeat-wrong-values/326070 "2023-04-12T13:36:40Z")
I see the flows from my Windows computer, but I have for example: account name: %1 domain name: %2 logon type: %9 ect. For example, on Windows %1 is Computer1, domain name is testDomian ect. --- ## [Filebeat timestamp processor to parse from epoch/unix\_ms to readable format](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712)
**Author:** [@rkelastic](https://discuss.elastic.co/u/rkelastic)\ **Replies:** 4\ **Last updated:** [April 12, 2023, 11:37am UTC](https://discuss.elastic.co/t/filebeat-timestamp-processor-to-parse-from-epoch-unix-ms-to-readable-format/329712 "2023-04-12T11:37:45Z")
I want to convert an epoch timestamp (ex: 1680940932415) to readable format (ex: '2006-01-02 15:04:05') using timestamp processor (Timestamp | Filebeat Reference \[8.7\] | Elastic), but am unable to achieve it. processor… --- ## [Error: system/socket dataset setup failed](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761)
**Author:** [@med\_dp](https://discuss.elastic.co/u/med_dp)\ **Replies:** 0\ **Last updated:** [April 11, 2023, 3:33pm UTC](https://discuss.elastic.co/t/error-system-socket-dataset-setup-failed/329761 "2023-04-11T15:33:29Z")
Hello all I have this issus with auditeat, any help please Apr 11 01:08:47 wnl03 auditbeat\[13640\]: 2023-04-11T01:08:47.574+0200 ERROR instance/beat.go:989 Exiting: 1 error: system/socket dataset se… --- ## [Filebeat read different log paths and write to different elastic index with their own ilm policy,How?](https://discuss.elastic.co/t/filebeat-read-different-log-paths-and-write-to-different-elastic-index-with-their-own-ilm-policy-how/327638)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 25\ **Last updated:** [April 11, 2023, 9:47am UTC](https://discuss.elastic.co/t/filebeat-read-different-log-paths-and-write-to-different-elastic-index-with-their-own-ilm-policy-how/327638 "2023-04-11T09:47:23Z")
Hello All, I'm having a bit of a hard time understanding the best config for our setup. We are running filebeat to ship several logs from different file location to elastic that need their own index template and policy. … --- ## [How to filter Filebeat output by input id?](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 4\ **Last updated:** [April 10, 2023, 9:44pm UTC](https://discuss.elastic.co/t/how-to-filter-filebeat-output-by-input-id/329603 "2023-04-10T21:44:02Z")
I configured filebeat.yml as follows: filebeat.inputs: - type: filestream id: my-input1 paths: - /opt/mything1/logs/\*.log - type: filestream id: my-input2 paths: - /opt/mything2/logs/\*.log - type: file… --- ## [Can't get filebeat to read filestream](https://discuss.elastic.co/t/cant-get-filebeat-to-read-filestream/329598)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 2\ **Last updated:** [April 10, 2023, 7:22pm UTC](https://discuss.elastic.co/t/cant-get-filebeat-to-read-filestream/329598 "2023-04-10T19:22:13Z")
I'm trying to switch my filebeat "logs" streams to filestreams. I set up a really simple prospector file: --- filebeat.inputs: - type: filestream id: admintools paths: - '/home/geo/nba/6.3.5.1280/logs/admin-tool… --- ## [Map winlog.event\_data.param\* to text](https://discuss.elastic.co/t/map-winlog-event-data-param-to-text/329642)
**Author:** [@yohanwongso](https://discuss.elastic.co/u/yohanwongso)\ **Replies:** 0\ **Last updated:** [April 10, 2023, 7:17am UTC](https://discuss.elastic.co/t/map-winlog-event-data-param-to-text/329642 "2023-04-10T07:17:24Z")
By default, Winlogbeat would map the winlog.event\_data.param\* as keyword. How to map the field to multi-fields keyword and text? --- ## [Can I use Packetbeat and the ELK stack for network logs generated by a website button](https://discuss.elastic.co/t/can-i-use-packetbeat-and-the-elk-stack-for-network-logs-generated-by-a-website-button/329489)
**Author:** [@Jana\_Urmi](https://discuss.elastic.co/u/Jana_Urmi)\ **Replies:** 0\ **Last updated:** [April 6, 2023, 7:43am UTC](https://discuss.elastic.co/t/can-i-use-packetbeat-and-the-elk-stack-for-network-logs-generated-by-a-website-button/329489 "2023-04-06T07:43:42Z")
I wrote a Python script to extract the network logs generated by clicking a button on a website using Selenium and store them in a file. I now want to use the ELK stack to visualize the logs. I'm confused whether Packet… --- ## [Filebeat stops sending logs after kubernetes deployment.Hence logs loosing happens](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-kubernetes-deployment-hence-logs-loosing-happens/329480)
**Author:** [@Perwaiz\_Alam](https://discuss.elastic.co/u/Perwaiz_Alam)\ **Replies:** 0\ **Last updated:** [April 6, 2023, 4:45am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-after-kubernetes-deployment-hence-logs-loosing-happens/329480 "2023-04-06T04:45:14Z")
Filebeat stops sending logs after kubernetes deployment.Hence logs loosing happens --- ## [Elastic parsing error field type format incorrect](https://discuss.elastic.co/t/elastic-parsing-error-field-type-format-incorrect/329352)
**Author:** [@merlin](https://discuss.elastic.co/u/merlin)\ **Replies:** 1\ **Last updated:** [April 5, 2023, 7:18pm UTC](https://discuss.elastic.co/t/elastic-parsing-error-field-type-format-incorrect/329352 "2023-04-05T19:18:40Z")
Hello, I am collecting windows event logs via MS windows event log collector and then forwarded to graylog via winlogbeats. I am getting alerts to parsing errors for a winlogbeat field shown below due to the field data b… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=51) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=53)