# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=60 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 61 --- ## [Collecting logs using docker.container.labels condition with filebeat:8.5.3](https://discuss.elastic.co/t/collecting-logs-using-docker-container-labels-condition-with-filebeat-8-5-3/324158)
**Author:** [@Viktor\_Herman](https://discuss.elastic.co/u/Viktor_Herman)\ **Replies:** 1\ **Last updated:** [January 30, 2023, 10:48am UTC](https://discuss.elastic.co/t/collecting-logs-using-docker-container-labels-condition-with-filebeat-8-5-3/324158 "2023-01-30T10:48:24Z")
I'm having some problems configuring filebeat to only ingest the logs from the containers that I want. I exhausted all of the resources and documentation doesn't have any examples on this exact issue. Filebeat version is… --- ## [Monitoring host with example from docs does not work](https://discuss.elastic.co/t/monitoring-host-with-example-from-docs-does-not-work/324161)
**Author:** [@Toaster2-0](https://discuss.elastic.co/u/Toaster2-0)\ **Replies:** 6\ **Last updated:** [January 29, 2023, 4:55pm UTC](https://discuss.elastic.co/t/monitoring-host-with-example-from-docs-does-not-work/324161 "2023-01-29T16:55:03Z")
Hi, in the Docs is a run command of docker with which you should be able to Monitor the host machine (with the System Module), but It seems to not be working. In a reddit thread nobody seems to be able to give a working… --- ## [How to read logs in subfolder of main folder filebeat](https://discuss.elastic.co/t/how-to-read-logs-in-subfolder-of-main-folder-filebeat/323888)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 13\ **Last updated:** [January 29, 2023, 4:27am UTC](https://discuss.elastic.co/t/how-to-read-logs-in-subfolder-of-main-folder-filebeat/323888 "2023-01-29T04:27:12Z")
HI, I have one main folder inside this I have 2 folder I am able to read the data of both folder in filebeat but how can be show which log is belong to which subfolder. --- ## [Missing log events for deleted files within a folder using Auditbeat 8.6 for Windows file integrity](https://discuss.elastic.co/t/missing-log-events-for-deleted-files-within-a-folder-using-auditbeat-8-6-for-windows-file-integrity/324123)
**Author:** [@cyber\_lc51](https://discuss.elastic.co/u/cyber_lc51)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 4:47pm UTC](https://discuss.elastic.co/t/missing-log-events-for-deleted-files-within-a-folder-using-auditbeat-8-6-for-windows-file-integrity/324123 "2023-01-27T16:47:18Z")
I am using Auditbeat 8.6 for Windows file integrity and have noticed that when I delete a folder, the event is captured and shows that the folder was deleted, but there are no logs of the individual files within the dele… --- ## [Target field in ndjson](https://discuss.elastic.co/t/target-field-in-ndjson/324014)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 12:25pm UTC](https://discuss.elastic.co/t/target-field-in-ndjson/324014 "2023-01-27T12:25:49Z")
Hi! I have a log file with json records like { "request": { "foo": "bar" }, "response": { "foo": "bar" } } and the following configuration for filebeat - type: filestream paths: - /path/to/file … --- ## [Start-Service heartbeat fails](https://discuss.elastic.co/t/start-service-heartbeat-fails/323600)
**Author:** [@ppic](https://discuss.elastic.co/u/ppic)\ **Replies:** 27\ **Last updated:** [January 27, 2023, 11:01am UTC](https://discuss.elastic.co/t/start-service-heartbeat-fails/323600 "2023-01-27T11:01:43Z")
Hello, I have installed heartbeat on a Windows server. When I start the service, it stops immediately. with the command : "Start-Service heartbeat" it says nothing, but I can see with the command "sc.exe query… --- ## [Confluent cloud from prometheus to elastic search](https://discuss.elastic.co/t/confluent-cloud-from-prometheus-to-elastic-search/324045)
**Author:** [@ch7247](https://discuss.elastic.co/u/ch7247)\ **Replies:** 1\ **Last updated:** [January 27, 2023, 12:07am UTC](https://discuss.elastic.co/t/confluent-cloud-from-prometheus-to-elastic-search/324045 "2023-01-27T00:07:27Z")
Hello everyone, I'm completely new to elk, planning to have a dashboard in kibana to visualize confluent cloud metric. Currently, i'm successful in getting the metrics to prometheus, i'm having some issue with getting t… --- ## [Log files are not cleared from the registry when harvested Kubernetes container is restarted](https://discuss.elastic.co/t/log-files-are-not-cleared-from-the-registry-when-harvested-kubernetes-container-is-restarted/322827)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 4\ **Last updated:** [January 26, 2023, 10:00am UTC](https://discuss.elastic.co/t/log-files-are-not-cleared-from-the-registry-when-harvested-kubernetes-container-is-restarted/322827 "2023-01-26T10:00:13Z")
Background: we are running Filebeat as a DaemonSet in a self-managed Microk8s Kubernetes cluster. I noticed extreme CPU usage and failures/delays with delivering logs after a while. More details in this Slack thread but … --- ## [Metricbeat to monitor specific docker containers by name/image](https://discuss.elastic.co/t/metricbeat-to-monitor-specific-docker-containers-by-name-image/323986)
**Author:** [@Yungxin\_Shin](https://discuss.elastic.co/u/Yungxin_Shin)\ **Replies:** 5\ **Last updated:** [January 26, 2023, 8:30am UTC](https://discuss.elastic.co/t/metricbeat-to-monitor-specific-docker-containers-by-name-image/323986 "2023-01-26T08:30:56Z")
Hello everyone, I am currently using Metricbeat to monitor my Docker containers and it is working well with my current configuration. metricbeat.modules: - module: docker metricsets: - container - cpu… --- ## [Is Filebeat suitable for local source-code search?](https://discuss.elastic.co/t/is-filebeat-suitable-for-local-source-code-search/323952)
**Author:** [@avistray](https://discuss.elastic.co/u/avistray)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 4:25pm UTC](https://discuss.elastic.co/t/is-filebeat-suitable-for-local-source-code-search/323952 "2023-01-25T16:25:05Z")
I have a local folder containing source code and I want to search the files in real time using Elasticsearch. Specifically, I want to use filebeat to monitor files in the folder and send the lines of the files to Elastic… --- ## [Error when using autodiscover + hints + templates with filebeat 8.6](https://discuss.elastic.co/t/error-when-using-autodiscover-hints-templates-with-filebeat-8-6/323527)
**Author:** [@Laffs2k5](https://discuss.elastic.co/u/Laffs2k5)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 12:38pm UTC](https://discuss.elastic.co/t/error-when-using-autodiscover-hints-templates-with-filebeat-8-6/323527 "2023-01-25T12:38:11Z")
Hi, Thought I should check in with the community here before creating a github issue, just in case there's something I'm not understanding correctly; After upgrading our filebeat kubernetes daemonset from 7.17.8 to 8.6… --- ## [Kubernetes.node.status.\* metrics not available for alerting](https://discuss.elastic.co/t/kubernetes-node-status-metrics-not-available-for-alerting/323901)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 11:43am UTC](https://discuss.elastic.co/t/kubernetes-node-status-metrics-not-available-for-alerting/323901 "2023-01-25T11:43:52Z")
Hello, i am using metricbeat in kubernetes with next config - module: kubernetes metricsets: - node - system - pod - container - volume period: 10s host: ${N… --- ## [How can I create custom tags from the data inside a log file using filebeat](https://discuss.elastic.co/t/how-can-i-create-custom-tags-from-the-data-inside-a-log-file-using-filebeat/323657)
**Author:** [@Raja\_Muneer](https://discuss.elastic.co/u/Raja_Muneer)\ **Replies:** 11\ **Last updated:** [January 25, 2023, 11:21am UTC](https://discuss.elastic.co/t/how-can-i-create-custom-tags-from-the-data-inside-a-log-file-using-filebeat/323657 "2023-01-25T11:21:20Z")
I am using elk stack for a month now. Lately, I have come across a situation where I need some help from the community to save me some time. I am actually running filebeat and elk stack in docker. I am sending logs from … --- ## [Filebeat settings](https://discuss.elastic.co/t/filebeat-settings/323845)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 8:37am UTC](https://discuss.elastic.co/t/filebeat-settings/323845 "2023-01-25T08:37:27Z")
Hello, I want to clarify if I understood the documentation correctly, bulk\_max\_size - filebeat transmits events (as I understand it, let's say a line in the log file) bundled, default 50, if I set 0, then queue comes i… --- ## [Can Packetbeat just capture the packets without decoding?](https://discuss.elastic.co/t/can-packetbeat-just-capture-the-packets-without-decoding/323473)
**Author:** [@sarathtv](https://discuss.elastic.co/u/sarathtv)\ **Replies:** 4\ **Last updated:** [January 25, 2023, 4:35am UTC](https://discuss.elastic.co/t/can-packetbeat-just-capture-the-packets-without-decoding/323473 "2023-01-25T04:35:05Z")
My application uses SIP protocol and I wanted to have a real-time packet analyzer for it. I found that Packetbeat could be the perfect fit, but unfortunately it doesn't support SIP in the listed set of protocols. Is the… --- ## [Is there a beat listing all installed RPMs?](https://discuss.elastic.co/t/is-there-a-beat-listing-all-installed-rpms/323886)
**Author:** [@franknord](https://discuss.elastic.co/u/franknord)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 6:57am UTC](https://discuss.elastic.co/t/is-there-a-beat-listing-all-installed-rpms/323886 "2023-01-25T06:57:02Z")
In order to get a quick overview of the RPMs installed on my servers, I wrote a simple shell script listing all RPMs and their versions into a CSV and sending this file via Filebeat to Logstash. Everything is working wel… --- ## [Haproxy + TCP + Provided Grok expressions do not match field value](https://discuss.elastic.co/t/haproxy-tcp-provided-grok-expressions-do-not-match-field-value/323879)
**Author:** [@Dipu\_Haridas](https://discuss.elastic.co/u/Dipu_Haridas)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 4:57am UTC](https://discuss.elastic.co/t/haproxy-tcp-provided-grok-expressions-do-not-match-field-value/323879 "2023-01-25T04:57:56Z")
Hi, I am new to Filebeat. Sorry if I sound foolish. I have been trying to load the haproxy logs to elasticsearch without much luck for quite some time. Haproxy Version: 1.8.27 Filebeat version: 7.17.8 Elasticsearch v… --- ## [Filebeat module ingest pipeline](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline/323270)
**Author:** [@Daniel\_B](https://discuss.elastic.co/u/Daniel_B)\ **Replies:** 5\ **Last updated:** [January 24, 2023, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline/323270 "2023-01-24T15:36:17Z")
I'm new to elastic. I'm using filebeat v8.5 and I have enabled some modules example: IIS, Checkpoint and few others which are working great. I also would like to create a new filebeat module for a specific device which … --- ## [Can't see logs in discover](https://discuss.elastic.co/t/cant-see-logs-in-discover/323726)
**Author:** [@mkibani](https://discuss.elastic.co/u/mkibani)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 9:36am UTC](https://discuss.elastic.co/t/cant-see-logs-in-discover/323726 "2023-01-24T09:36:21Z")
hello, i've just installed elastic stack, then proceeded to install an beat agent for the first time, pushed the template and everything as documented however i can't see anything in the data stream in discover, Down b… --- ## [Error "Event created before query" using o365 module](https://discuss.elastic.co/t/error-event-created-before-query-using-o365-module/323759)
**Author:** [@Apaquette](https://discuss.elastic.co/u/Apaquette)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 7:28pm UTC](https://discuss.elastic.co/t/error-event-created-before-query-using-o365-module/323759 "2023-01-23T19:28:36Z")
Hello, We use Filebeat's module for Office 365 to gather audit logs and send them to our SIEM. We detected multiple errors in the module's logs. We can read "Event created before query" (with a little bit more informat… --- ## [Unable to Reload certificates on filebeat container for Kafka](https://discuss.elastic.co/t/unable-to-reload-certificates-on-filebeat-container-for-kafka/323742)
**Author:** [@kadalin](https://discuss.elastic.co/u/kadalin)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 3:02pm UTC](https://discuss.elastic.co/t/unable-to-reload-certificates-on-filebeat-container-for-kafka/323742 "2023-01-23T15:02:11Z")
I'm trying to integrate filebeat with Kafka with SSL Handshake. The certificates are obtained from vault and they are valid for only 7 days. A different mechanism is applied to get the certificates renewed with a new pri… --- ## [Install Metricbeat on Kubernetes Cluster ( Azure)](https://discuss.elastic.co/t/install-metricbeat-on-kubernetes-cluster-azure/323328)
**Author:** [@Swathi12](https://discuss.elastic.co/u/Swathi12)\ **Replies:** 5\ **Last updated:** [January 20, 2023, 3:30pm UTC](https://discuss.elastic.co/t/install-metricbeat-on-kubernetes-cluster-azure/323328 "2023-01-20T15:30:27Z")
Hi team, i am trying for several weeks to install metricbeat on kubernetes cluster (azure) and i following these instructions: Run Metricbeat on Kubernetes | Metricbeat Reference \[8.6\] | Elastic i edited the metricbea… --- ## [About built in dashboard](https://discuss.elastic.co/t/about-built-in-dashboard/323512)
**Author:** [@mr\_ph](https://discuss.elastic.co/u/mr_ph)\ **Replies:** 3\ **Last updated:** [January 20, 2023, 8:28am UTC](https://discuss.elastic.co/t/about-built-in-dashboard/323512 "2023-01-20T08:28:48Z")
Hi team, I am using ELK 8.5.3 and I have multiple servers and I am using metricbeat system module to collect the metrics and the dashboards were doing good. But I want group my servers. Is it possible to group the monit… --- ## [Winlogbeat performance](https://discuss.elastic.co/t/winlogbeat-performance/323571)
**Author:** [@MarcoVu](https://discuss.elastic.co/u/MarcoVu)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 8:11am UTC](https://discuss.elastic.co/t/winlogbeat-performance/323571 "2023-01-20T08:11:05Z")
So i have some Windows Event collector servers which collects events from workstations, and decided to send all collected events to Elasticsearch with Winlogbeat (8.4.1 version), but regardless of any of settings that i … --- ## [Auditbeat 7.17.8 high cpu usage during data transfer with system socket dataset](https://discuss.elastic.co/t/auditbeat-7-17-8-high-cpu-usage-during-data-transfer-with-system-socket-dataset/323540)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 7:10pm UTC](https://discuss.elastic.co/t/auditbeat-7-17-8-high-cpu-usage-during-data-transfer-with-system-socket-dataset/323540 "2023-01-19T19:10:19Z")
I'm running auditbeat-7.17.8-1.x86\_64 on AlmaLinux release 8.7 on one of our file servers. I just noticed that while running an rsync transfer to that machine auditbeat is consuming between 100-200% cpu. It is not outp… --- ## [Packetbeat not working & showin only one interface](https://discuss.elastic.co/t/packetbeat-not-working-showin-only-one-interface/323510)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 12:31pm UTC](https://discuss.elastic.co/t/packetbeat-not-working-showin-only-one-interface/323510 "2023-01-19T12:31:25Z")
Hello, I am attempting to run Packetbeat (8.6.0) on Microsoft Windows 11 (professional 22H2 version, latest). I have Npcap as part of NMAP installation, which I refreshed today - specially ticking to enable the WinPcap… --- ## [I can't connect my Logstash to ES Stack Monitoring please help](https://discuss.elastic.co/t/i-cant-connect-my-logstash-to-es-stack-monitoring-please-help/323465)
**Author:** [@Cruz](https://discuss.elastic.co/u/Cruz)\ **Replies:** 6\ **Last updated:** [January 19, 2023, 7:43am UTC](https://discuss.elastic.co/t/i-cant-connect-my-logstash-to-es-stack-monitoring-please-help/323465 "2023-01-19T07:43:22Z")
I check the status of metricbeat, it says node\_stats/node\_stats.go:73 json: cannot unmarshal object into Go struct field .version of type string and could not fetch node pipelines: HTTP error 405 in : 405 Method… --- ## [Can not collect logs if I installed beats on local machine or azure vm](https://discuss.elastic.co/t/can-not-collect-logs-if-i-installed-beats-on-local-machine-or-azure-vm/323313)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 10:32am UTC](https://discuss.elastic.co/t/can-not-collect-logs-if-i-installed-beats-on-local-machine-or-azure-vm/323313 "2023-01-17T10:32:25Z")
Hi folks, I have issue for log collecting when I installed the beats on outside of AWS Ec2 instances. My log architecture is beats \>\> kafka (ec2 vm) \>\> logstash (ec2 vm) \>\> elastic cloud I can collect the logs if I i… --- ## [How to specify different index name rather than the default?](https://discuss.elastic.co/t/how-to-specify-different-index-name-rather-than-the-default/323391)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 0\ **Last updated:** [January 18, 2023, 8:42am UTC](https://discuss.elastic.co/t/how-to-specify-different-index-name-rather-than-the-default/323391 "2023-01-18T08:42:29Z")
Hello, guys, I already had a es cluster, and many data in it. Now I want to stor a new nginx's access/error log to my es with filebeat+nginx module. I want the index to be the a new name such as nginx-log-20230118, rath… --- ## [Metricbeat' logstash module is NOT working properly (no errors)](https://discuss.elastic.co/t/metricbeat-logstash-module-is-not-working-properly-no-errors/322763)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [January 14, 2023, 3:33pm UTC](https://discuss.elastic.co/t/metricbeat-logstash-module-is-not-working-properly-no-errors/322763 "2023-01-14T15:33:15Z")
Hello World! I'm running same setup: metricbeat.yml and modules.d/logstash-xpack.yml, yet one of the instance everything works fine, yet in another (almost identical) instance it is not working at all: NOT properly wor… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=59) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=61)