# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=55 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 56 --- ## [How to resolve metricbeat docker container internal errors?](https://discuss.elastic.co/t/how-to-resolve-metricbeat-docker-container-internal-errors/327689)
**Author:** [@angel1](https://discuss.elastic.co/u/angel1)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 4:04pm UTC](https://discuss.elastic.co/t/how-to-resolve-metricbeat-docker-container-internal-errors/327689 "2023-03-14T16:04:41Z")
Hello, I am new to this forum but I am glad it exists. I recently started using the ELK stack and I am still new to it. I am currently trying to setup a docker-compose file with my microservices plus elasticsearch, kib… --- ## [Add a field to @metadata dictionary](https://discuss.elastic.co/t/add-a-field-to-metadata-dictionary/328025)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 0\ **Last updated:** [March 19, 2023, 3:34pm UTC](https://discuss.elastic.co/t/add-a-field-to-metadata-dictionary/328025 "2023-03-19T15:34:08Z")
Wondering if would be possible to add an extra field to the @metadata 'dictionary' from an input section of filebeat? Eg. someting like: filebeat.input: - type: filestream id: \ enabled: true @… --- ## [Winlogbeat and metricbeat taking high storage space](https://discuss.elastic.co/t/winlogbeat-and-metricbeat-taking-high-storage-space/327996)
**Author:** [@Gaurav\_kr](https://discuss.elastic.co/u/Gaurav_kr)\ **Replies:** 2\ **Last updated:** [March 19, 2023, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-and-metricbeat-taking-high-storage-space/327996 "2023-03-19T13:42:32Z")
Hi All, I am using ELK version 8.0.0, with winlogbeat and metricbeat version 8.0.0 we are monitoring around 200 environments for event logs and metrics from winlog and metricbeat respectively. BUt not sure why the winlo… --- ## [Winlogbeat.yml path.data and path.logs not working](https://discuss.elastic.co/t/winlogbeat-yml-path-data-and-path-logs-not-working/327882)
**Author:** [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Replies:** 3\ **Last updated:** [March 18, 2023, 9:44pm UTC](https://discuss.elastic.co/t/winlogbeat-yml-path-data-and-path-logs-not-working/327882 "2023-03-18T21:44:59Z")
Hi, I am trying to change where my logs and data are stored. In my winlogbeat service properties i see this : ""D:\\vm workstation\\winlogbeat\\winlogbeat.exe" --environment=windows\_service -c "D:\\vm workstation\\winlogbeat… --- ## [Threat intel Filebeat module - I don't get any data From MISP and i don't know why](https://discuss.elastic.co/t/threat-intel-filebeat-module-i-dont-get-any-data-from-misp-and-i-dont-know-why/327986)
**Author:** [@Nicolas\_Pelletier](https://discuss.elastic.co/u/Nicolas_Pelletier)\ **Replies:** 0\ **Last updated:** [March 18, 2023, 8:48am UTC](https://discuss.elastic.co/t/threat-intel-filebeat-module-i-dont-get-any-data-from-misp-and-i-dont-know-why/327986 "2023-03-18T08:48:39Z")
Hello, I'm trying to integrate MISP IOC's into Kibana via Threat intel Filebeat Module. When i look at the analytics dicover view in kibana, i see every var.interval (set in the module config) a new hit with an event.o… --- ## [Telnet - which IP address do i try to telnet to?](https://discuss.elastic.co/t/telnet-which-ip-address-do-i-try-to-telnet-to/327885)
**Author:** [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Replies:** 2\ **Last updated:** [March 17, 2023, 7:33pm UTC](https://discuss.elastic.co/t/telnet-which-ip-address-do-i-try-to-telnet-to/327885 "2023-03-17T19:33:28Z")
Hi, I get this message in my winlogbeat logs : {"file.name":"beater/winlogbeat.go","file.line":149},"message":"Winlogbeat is unable to load the ingest pipelines because the Elasticsearch output is not configured/enabled… --- ## [Filebeat failed to start v7.10.2](https://discuss.elastic.co/t/filebeat-failed-to-start-v7-10-2/327957)
**Author:** [@Joshua\_John\_Consulta](https://discuss.elastic.co/u/Joshua_John_Consulta)\ **Replies:** 1\ **Last updated:** [March 17, 2023, 5:57pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-v7-10-2/327957 "2023-03-17T17:57:50Z")
Hi please help me with my problem. My filebeat services stop working. Even though after I restart it. It starts but after a minute it stopped. Please help me. My career depends on it Filbeat status: filebeat.service - … --- ## [Multiline and flush pattern issue](https://discuss.elastic.co/t/multiline-and-flush-pattern-issue/327958)
**Author:** [@vipkabra](https://discuss.elastic.co/u/vipkabra)\ **Replies:** 0\ **Last updated:** [March 17, 2023, 5:09pm UTC](https://discuss.elastic.co/t/multiline-and-flush-pattern-issue/327958 "2023-03-17T17:09:48Z")
Hi All, I have a requirement to pick log lines from log based on some start word, lets assume 'ABC' and combine all following lines until 'XYZ' appears in log file. If XYZ found, combine all log lines and ship them to l… --- ## [Kibana, Winlogbeat Agent-search with custom variable](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102)
**Author:** [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)\ **Replies:** 5\ **Last updated:** [March 17, 2023, 1:50pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102 "2023-03-17T13:50:05Z")
Hi, I am new to the forum. For some time now, we have been unable to search with our custom variables for winlogbeat logs on only two servers. I have restarted the winlog agent service but the problem still persist. A… --- ## [Metricbeat Agent](https://discuss.elastic.co/t/metricbeat-agent/327798)
**Author:** [@Tw1cUser](https://discuss.elastic.co/u/Tw1cUser)\ **Replies:** 2\ **Last updated:** [March 17, 2023, 12:45pm UTC](https://discuss.elastic.co/t/metricbeat-agent/327798 "2023-03-17T12:45:56Z")
Hi is it possible to pull all VMs on the server without installing metricbeat on all VMs? example: one server has 100+ VMs, and I want to monitor one server and include the VMs in it, without installing metricbeat on t… --- ## [Filebeat: Problem to get Domino HCL logs](https://discuss.elastic.co/t/filebeat-problem-to-get-domino-hcl-logs/327920)
**Author:** [@davidedavidedavide](https://discuss.elastic.co/u/davidedavidedavide)\ **Replies:** 0\ **Last updated:** [March 17, 2023, 10:20am UTC](https://discuss.elastic.co/t/filebeat-problem-to-get-domino-hcl-logs/327920 "2023-03-17T10:20:46Z")
Hi, I'm trying to get logs from a Domino HCL mail server but no data are coming and in the filebeat log i see that the file is inactive It's a single file with overwriting when it reaches the max dimension. i'm trying … --- ## [Auditbeat 7.17 high cpu usage](https://discuss.elastic.co/t/auditbeat-7-17-high-cpu-usage/327900)
**Author:** [@KevinShi](https://discuss.elastic.co/u/KevinShi)\ **Replies:** 0\ **Last updated:** [March 17, 2023, 6:12am UTC](https://discuss.elastic.co/t/auditbeat-7-17-high-cpu-usage/327900 "2023-03-17T06:12:48Z")
auditbeat configure: auditbeat.modules: - module: auditd resolve\_ids: true failure\_mode: silent backlog\_limit: 8192 rate\_limit: 0 include\_raw\_message: false include\_warnings: false backpressure\_strategy: … --- ## [Winlogbeat logs only show that it is 6kb](https://discuss.elastic.co/t/winlogbeat-logs-only-show-that-it-is-6kb/327789)
**Author:** [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Replies:** 8\ **Last updated:** [March 16, 2023, 7:25pm UTC](https://discuss.elastic.co/t/winlogbeat-logs-only-show-that-it-is-6kb/327789 "2023-03-16T19:25:08Z")
Hi, I am trying to get my Sysmon data to winlogbeat and then to security onion. (unfortunatly, the sysmon.xml and winlogbeat.yml are too big to put here. I wish i could just attach them as files) I am having two issues… --- ## [\[BUG\] Metricbeat stops generating the right timestamp after a while](https://discuss.elastic.co/t/bug-metricbeat-stops-generating-the-right-timestamp-after-a-while/327778)
**Author:** [@vhenriquez](https://discuss.elastic.co/u/vhenriquez)\ **Replies:** 1\ **Last updated:** [March 16, 2023, 6:25pm UTC](https://discuss.elastic.co/t/bug-metricbeat-stops-generating-the-right-timestamp-after-a-while/327778 "2023-03-16T18:25:09Z")
Metricbeat 8.6 (and possibly other 8.x versions) stops sending the right timestamp after a while. When metricbeat starts running, the timestamps sent to Logstash are correct, but after several hours without restarting t… --- ## [Heartbeat stops pinging http(s) routes](https://discuss.elastic.co/t/heartbeat-stops-pinging-http-s-routes/325181)
**Author:** [@ppic](https://discuss.elastic.co/u/ppic)\ **Replies:** 7\ **Last updated:** [March 16, 2023, 5:39pm UTC](https://discuss.elastic.co/t/heartbeat-stops-pinging-http-s-routes/325181 "2023-03-16T17:39:06Z")
Hello, I have installed heartbeat (heartbeat-7.17.6-windows-x86\_64) in order to monitor the availability of some URLs. The pb is that it stops pinging without apparent reason (I see nothing special in the logs) while t… --- ## [Cannot append\_fields on custom template](https://discuss.elastic.co/t/cannot-append-fields-on-custom-template/327855)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [March 16, 2023, 2:00pm UTC](https://discuss.elastic.co/t/cannot-append-fields-on-custom-template/327855 "2023-03-16T14:00:54Z")
Hello! I am using filebeat 7.17.6 and I am using the nginx module. I have altered the access log pipeline to include additional fields. Everything is grokked fine. My issue is that when i define the additional fields… --- ## [Filebeat - how to monitor inactivity](https://discuss.elastic.co/t/filebeat-how-to-monitor-inactivity/327819)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 0\ **Last updated:** [March 16, 2023, 7:38am UTC](https://discuss.elastic.co/t/filebeat-how-to-monitor-inactivity/327819 "2023-03-16T07:38:57Z")
I have an application (windows, 3rd party closed source) which is running as a service. Issue is, it stuck here and there and does nothing although the service is in "running" state. Is there any way how to monitor this… --- ## [Ingest pipeline created for filebeat log using grok pattern,but unable to run in dev tools](https://discuss.elastic.co/t/ingest-pipeline-created-for-filebeat-log-using-grok-pattern-but-unable-to-run-in-dev-tools/327660)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 4\ **Last updated:** [March 15, 2023, 11:43am UTC](https://discuss.elastic.co/t/ingest-pipeline-created-for-filebeat-log-using-grok-pattern-but-unable-to-run-in-dev-tools/327660 "2023-03-15T11:43:12Z")
Hello All, I'm successfully getting output of my log pattern using grok pattern,but when trying to create log ingest pipeline that can be used in template later,I'm getting exception while running the ingest pipeline in… --- ## [Elasticsearch not receiving Metricbeat data completely](https://discuss.elastic.co/t/elasticsearch-not-receiving-metricbeat-data-completely/327723)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 0\ **Last updated:** [March 15, 2023, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-metricbeat-data-completely/327723 "2023-03-15T06:42:04Z")
After install metricbeat and enable CPU,memory,disk, proccess enable only we are receiving process related data. Please guide how to troubleshoot , why CPU , memory and disk data not coming. --- ## [404 Error installing Filebeat on Debian Linux via apt](https://discuss.elastic.co/t/404-error-installing-filebeat-on-debian-linux-via-apt/327701)
**Author:** [@michael.jarvis](https://discuss.elastic.co/u/michael.jarvis)\ **Replies:** 1\ **Last updated:** [March 15, 2023, 2:36am UTC](https://discuss.elastic.co/t/404-error-installing-filebeat-on-debian-linux-via-apt/327701 "2023-03-15T02:36:35Z")
Hello, I am trying to install filebeat on some Debian Linux devices, using the instructions from this link. Unfortunately, the URL provided on that page (https://artifacts.elastic.co/packages/8.x/apt) is not working. Am… --- ## [Unable to load data from filebeat using input of AWS S3](https://discuss.elastic.co/t/unable-to-load-data-from-filebeat-using-input-of-aws-s3/327268)
**Author:** [@vivekd](https://discuss.elastic.co/u/vivekd)\ **Replies:** 4\ **Last updated:** [March 14, 2023, 3:40pm UTC](https://discuss.elastic.co/t/unable-to-load-data-from-filebeat-using-input-of-aws-s3/327268 "2023-03-14T15:40:29Z")
Hi Team, We are unable to load data from filebeat using input of AWS S3. We have followed the below article for setting the filebeat configuration. Post configuration of filebeat, Please let us know on how to create … --- ## [VxLAN packet decription - packetbeat](https://discuss.elastic.co/t/vxlan-packet-decription-packetbeat/327545)
**Author:** [@mihai.radulescu](https://discuss.elastic.co/u/mihai.radulescu)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 3:01pm UTC](https://discuss.elastic.co/t/vxlan-packet-decription-packetbeat/327545 "2023-03-14T15:01:06Z")
Hello, I have the same issue like Docker overlay networks I'm using AWS mirroring to send traffic from one Network Interface to another EC2 instance where I have installed ES. AWS is using VXLAN and sends the traffic o… --- ## [Service Metricbeat Suddenly Stop After Loaded Dashboard](https://discuss.elastic.co/t/service-metricbeat-suddenly-stop-after-loaded-dashboard/327622)
**Author:** [@Tw1cUser](https://discuss.elastic.co/u/Tw1cUser)\ **Replies:** 3\ **Last updated:** [March 14, 2023, 1:44pm UTC](https://discuss.elastic.co/t/service-metricbeat-suddenly-stop-after-loaded-dashboard/327622 "2023-03-14T13:44:12Z")
After i command .\\metricbeat setup my metricbeat service still running, but after loaded to dashboard to kibana, my metricbeat service suddenly stop, i don't know why. my config metricbeat.yml it's okay my output it's … --- ## [Filebeat loses first lines when file rotated](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655 "2023-03-14T12:28:58Z")
We have discovered that filebeat loses first lines when file rotated. For example we use the following config to get auditbeat logs and when file rotated (auditbeat restarted) we see that first lines missing (written in… --- ## [Metricbeat on Openshift & Nginx](https://discuss.elastic.co/t/metricbeat-on-openshift-nginx/327335)
**Author:** [@Ivan\_Hosea](https://discuss.elastic.co/u/Ivan_Hosea)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 3:38am UTC](https://discuss.elastic.co/t/metricbeat-on-openshift-nginx/327335 "2023-03-14T03:38:07Z")
Hi, I was wondering if there's any way to monitor nginx inside openshift service with metricbeat & filebeat. Can anyone help me with this? --- ## [Is there a way to output logs to s3 from filebeat without using logstash?](https://discuss.elastic.co/t/is-there-a-way-to-output-logs-to-s3-from-filebeat-without-using-logstash/327581)
**Author:** [@Z4ck404](https://discuss.elastic.co/u/Z4ck404)\ **Replies:** 1\ **Last updated:** [March 13, 2023, 6:29pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-output-logs-to-s3-from-filebeat-without-using-logstash/327581 "2023-03-13T18:29:34Z")
Continuing the discussion from Does Filebeat support output to S3?: --- ## [Prometheus remote\_write to metricbeat shows up in Kibana for one minute, then stops working](https://discuss.elastic.co/t/prometheus-remote-write-to-metricbeat-shows-up-in-kibana-for-one-minute-then-stops-working/325651)
**Author:** [@megaxm](https://discuss.elastic.co/u/megaxm)\ **Replies:** 4\ **Last updated:** [March 13, 2023, 4:00pm UTC](https://discuss.elastic.co/t/prometheus-remote-write-to-metricbeat-shows-up-in-kibana-for-one-minute-then-stops-working/325651 "2023-03-13T16:00:18Z")
Hi. I have set up the elk stack in one server. And also on the same server we have installed metricbeat. Version 8.6.1 for elk as well as metricbeat When we send the metrics to metricbeat we see that metrics are shown … --- ## [Issues with log rotation - Filebeat lock logs file](https://discuss.elastic.co/t/issues-with-log-rotation-filebeat-lock-logs-file/327565)
**Author:** [@akhil](https://discuss.elastic.co/u/akhil)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 2:26pm UTC](https://discuss.elastic.co/t/issues-with-log-rotation-filebeat-lock-logs-file/327565 "2023-03-13T14:26:24Z")
Hi All, We are having some issues with filbeat. Actually filebeat is locking a logs file and because of this the log rotation is not working. The data is keep getting ingested in the same file. Every time we have to re… --- ## [Filebeat pods keeps increasing Memory usage](https://discuss.elastic.co/t/filebeat-pods-keeps-increasing-memory-usage/325124)
**Author:** [@oandre7](https://discuss.elastic.co/u/oandre7)\ **Replies:** 12\ **Last updated:** [March 13, 2023, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-pods-keeps-increasing-memory-usage/325124 "2023-03-13T14:23:01Z")
Hi all, We are having a quite a strange issue that running filebeat in any version higher than 8.0.0 will cause filebeats agent to start increasing Memory consumption until the pod is OOM killed. As mentioned versions 8… --- ## [\[Filebeat 8.6.1 - httpjson\] chain response.transform question](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774)
**Author:** [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Replies:** 2\ **Last updated:** [March 13, 2023, 8:51am UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774 "2023-03-13T08:51:59Z")
Hello, I'm facing an issue with response.transform and after searching during hours I'm still not able to find a solution. I try to chain some api calls to get a list of bugs per host : Request 1: To get list of host … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=54) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=56)