# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=67 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 68 --- ## [Exiting: no outputs are defined, please define one under the output section](https://discuss.elastic.co/t/exiting-no-outputs-are-defined-please-define-one-under-the-output-section/319674)
**Author:** [@PunithRaj](https://discuss.elastic.co/u/PunithRaj)\ **Replies:** 11\ **Last updated:** [November 24, 2022, 5:48pm UTC](https://discuss.elastic.co/t/exiting-no-outputs-are-defined-please-define-one-under-the-output-section/319674 "2022-11-24T17:48:31Z")
Hello All, I am new to elastic and filebeats. I have installed filebeat to collect logs from defender apt via microsoft module and store them as file in linux server via file output method. But when i run the configurat… --- ## [Heartbeat in elastic agent](https://discuss.elastic.co/t/heartbeat-in-elastic-agent/319742)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 11:29am UTC](https://discuss.elastic.co/t/heartbeat-in-elastic-agent/319742 "2022-11-24T11:29:01Z")
We have installed Elastic agent (Fleet) but not able to find how to integrate heartbeat with it. Fleet version 7.10.01 . Please help to find how to configure URL's monitoring with Elastic agent. --- ## [Filebeat is not taking input in regular interval](https://discuss.elastic.co/t/filebeat-is-not-taking-input-in-regular-interval/319732)
**Author:** [@subrata7](https://discuss.elastic.co/u/subrata7)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 10:15am UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-input-in-regular-interval/319732 "2022-11-24T10:15:43Z")
A node js application is writing on a JSON file in a interval of 30s from where Filebeat is supposed to take input and send to elasticsearch through logstash.But filebeat is not reading the input until I open the file in… --- ## [Create custom index while sending logs from filebeat to elasticsearch](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 0\ **Last updated:** [November 24, 2022, 11:24am UTC](https://discuss.elastic.co/t/create-custom-index-while-sending-logs-from-filebeat-to-elasticsearch/319747 "2022-11-24T11:24:08Z")
Hi i've setup filebeat(7.17.7) to send logs to elasticsearch(8.5.1) The logs are getting shipped but to the default index that is filebeat 7.17 Here is my filebeat.yml output.elasticsearch: # Array of hosts to conne… --- ## [Data stream in filebeat 8.1.0](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/data-stream-in-filebeat-8-1-0/319596 "2022-11-24T10:35:46Z")
Hi I'm using filebeat in 8.1.0 on docker below is my filebeat.yml But I'm able to reach data stream option how i should enable it? The second thing how to under docker image force enable dedicated module for example ap… --- ## [Filebeat k8s annotations](https://discuss.elastic.co/t/filebeat-k8s-annotations/319587)
**Author:** [@Jeff\_d\_Ambly](https://discuss.elastic.co/u/Jeff_d_Ambly)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:23am UTC](https://discuss.elastic.co/t/filebeat-k8s-annotations/319587 "2022-11-24T10:23:48Z")
I'm trying to get filebeat working in kubernetes, I'm wanting to only collect logs for pods in specific namespaces here is my filebeat config filebeat.inputs: - type: log paths: - /var/lib/rancher/rke/log/\*… --- ## [Filebeat start config wrong](https://discuss.elastic.co/t/filebeat-start-config-wrong/319502)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [November 24, 2022, 10:14am UTC](https://discuss.elastic.co/t/filebeat-start-config-wrong/319502 "2022-11-24T10:14:22Z")
I've tried to read my nginx logs trough filebeats on Windows (for test) but something goes wrong. Can You suggest? - module: nginx # Access logs access: enabled: true # Set custom paths for the log files. I… --- ## [Does filebeat transmit data to the master node of the elasticsearch cluster or to the data node](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694)
**Author:** [@CatLoveFishma](https://discuss.elastic.co/u/CatLoveFishma)\ **Replies:** 3\ **Last updated:** [November 24, 2022, 8:27am UTC](https://discuss.elastic.co/t/does-filebeat-transmit-data-to-the-master-node-of-the-elasticsearch-cluster-or-to-the-data-node/319694 "2022-11-24T08:27:59Z")
Hello, If I have a es cluster which has three data nodes (B,C,D) and a master node (A). Now I want to use filebeat to collect logs and directly transfer date to the es cluster.Which node should I transfer the data to？ … --- ## [Packetbeat Adding Output Fields from YML config file](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686)
**Author:** [@dbh1985](https://discuss.elastic.co/u/dbh1985)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:57pm UTC](https://discuss.elastic.co/t/packetbeat-adding-output-fields-from-yml-config-file/319686 "2022-11-23T21:57:12Z")
How can I configure the packetbeat yml file to add a field "username" if an output field exists "agent.hostname" equal to a specific value? Here's what I got so far, but unable to start service afterwards: I've put thi… --- ## [Seccomp default policy is missing clock\_nanosleep](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637)
**Author:** [@izaneuski](https://discuss.elastic.co/u/izaneuski)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:03pm UTC](https://discuss.elastic.co/t/seccomp-default-policy-is-missing-clock-nanosleep/319637 "2022-11-23T13:03:27Z")
On some ubuntu hosts I'm facing high CPU consumption by auditbeat(7.16.3&8.5.1) and journalbeat(7.15.2) with default config. During investigation with strace found out: clock\_nanosleep(CLOCK\_REALTIME, 0, {tv\_sec=0, tv\_… --- ## [Cyclic reference eror while dissecting source.nat.port](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [November 23, 2022, 12:42pm UTC](https://discuss.elastic.co/t/cyclic-reference-eror-while-dissecting-source-nat-port/319656 "2022-11-23T12:42:47Z")
i all! I get the following output when starting filebeat with one processor: .... {"log.level":"error","@timestamp":"2022-11-23T13:29:24.875+0100","log.origin":{"file.name":"instance/beat.go","file.line":1057},"message… --- ## [HTTPJSON input : get only new records](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598)
**Author:** [@djesus](https://discuss.elastic.co/u/djesus)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 12:24am UTC](https://discuss.elastic.co/t/httpjson-input-get-only-new-records/319598 "2022-11-23T00:24:17Z")
hi everyone! im trying to get audit logs from a cloud api, the logs on the api are always the same unless there is a new login happening. while using the httpjson input im always getting all data again, creating multip… --- ## [Metricbeat unable to find keystore values with \`systemctl\`](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [November 23, 2022, 4:09am UTC](https://discuss.elastic.co/t/metricbeat-unable-to-find-keystore-values-with-systemctl/319595 "2022-11-23T04:09:42Z")
I am having trouble using the /usr/share/metricbeat/bin/metricbeat keystore command to store an api key. Everytime I do a systemctl restart metricbeat.service, I get this error: {"log.level":"error","@timestamp":"2022-… --- ## [Can I edit the query or inspector of a metricbeat lens?](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 5:00pm UTC](https://discuss.elastic.co/t/can-i-edit-the-query-or-inspector-of-a-metricbeat-lens/319567 "2022-11-22T17:00:03Z")
I am learning to use MetricBeat and dashboards. I'm really enjoying it so far but I want to be able to edit one of the lens. This image below shows two lens that I really like, but I want to modify: So what I did w… --- ## [Set ip on http monitors like curl resolve command](https://discuss.elastic.co/t/set-ip-on-http-monitors-like-curl-resolve-command/319346)
**Author:** [@oofbird](https://discuss.elastic.co/u/oofbird)\ **Replies:** 3\ **Last updated:** [November 22, 2022, 11:05am UTC](https://discuss.elastic.co/t/set-ip-on-http-monitors-like-curl-resolve-command/319346 "2022-11-22T11:05:32Z")
I want to monitor https service. (domain - VIP - webserver) testing domain(VIP) is clear. just call "https://domain". but testing webserver has a problem, guessing from SNI(Server Name Indication). Calling "https://we… --- ## [Postgres integration Fleet](https://discuss.elastic.co/t/postgres-integration-fleet/317649)
**Author:** [@Gaston\_Beltramelli](https://discuss.elastic.co/u/Gaston_Beltramelli)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 10:12am UTC](https://discuss.elastic.co/t/postgres-integration-fleet/317649 "2022-11-22T10:12:33Z")
Hello! I'm trying to install the Postgres integration to get metrics via Fleet, but when I get to the configuration I don't have the option to add the database from the UI, no matter how I add the database in the conne… --- ## [Beats vs Elastic Agent - use case of SIEM](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377)
**Author:** [@SirMuffington](https://discuss.elastic.co/u/SirMuffington)\ **Replies:** 2\ **Last updated:** [November 21, 2022, 7:00pm UTC](https://discuss.elastic.co/t/beats-vs-elastic-agent-use-case-of-siem/319377 "2022-11-21T19:00:15Z")
Hello dear Community! I wanted to ask a beginner question - what is the difference between Beats and Elastic Agent and what is better for SIEM analysis? Cheers --- ## [Beats won't send multiple log files or updated log file](https://discuss.elastic.co/t/beats-wont-send-multiple-log-files-or-updated-log-file/319438)
**Author:** [@Daniel4](https://discuss.elastic.co/u/Daniel4)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 12:03pm UTC](https://discuss.elastic.co/t/beats-wont-send-multiple-log-files-or-updated-log-file/319438 "2022-11-21T12:03:04Z")
So I just got started with the ELK stack, I have configured filebeat to send log files to logstash \> logstash then ships these logs to elasticsearch, now I have faced multiple setbacks I can't seem to fix, filebeat behav… --- ## [Enable Testing for ARM64 platform on CI](https://discuss.elastic.co/t/enable-testing-for-arm64-platform-on-ci/319423)
**Author:** [@odidev](https://discuss.elastic.co/u/odidev)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 10:51am UTC](https://discuss.elastic.co/t/enable-testing-for-arm64-platform-on-ci/319423 "2022-11-21T10:51:46Z")
Hi Team, I am working with Elastic Beats on the Linux ARM64 platform. Although it seems support for ARM64 is present, testing is not included in the CI. Do you have any plan to include the ARM64 testing for Linux? If … --- ## [Only first path being harvested](https://discuss.elastic.co/t/only-first-path-being-harvested/319403)
**Author:** [@jrubenc](https://discuss.elastic.co/u/jrubenc)\ **Replies:** 1\ **Last updated:** [November 21, 2022, 9:19am UTC](https://discuss.elastic.co/t/only-first-path-being-harvested/319403 "2022-11-21T09:19:11Z")
Hello, I have the following simple configuration: # cat /etc/filebeat/filebeat.yml # Workaround manually managed ################### filebeat Configuration ######################### ############################# fil… --- ## [Failed to start Ping remote services for availability and log results to Elasticsearch or send to Logstash](https://discuss.elastic.co/t/failed-to-start-ping-remote-services-for-availability-and-log-results-to-elasticsearch-or-send-to-logstash/319343)
**Author:** [@bta16](https://discuss.elastic.co/u/bta16)\ **Replies:** 1\ **Last updated:** [November 19, 2022, 3:26pm UTC](https://discuss.elastic.co/t/failed-to-start-ping-remote-services-for-availability-and-log-results-to-elasticsearch-or-send-to-logstash/319343 "2022-11-19T15:26:23Z")
i have config heartbeat like tutorial quickstart, when i enable and start heartbeat, it noticed me: heartbeat-elastic.service - Ping remote services for availability and log results to Elasticsearch or send to Logstash.… --- ## [Filebeat Threat Intel Module Errors](https://discuss.elastic.co/t/filebeat-threat-intel-module-errors/319225)
**Author:** [@tofubeats](https://discuss.elastic.co/u/tofubeats)\ **Replies:** 2\ **Last updated:** [November 19, 2022, 9:33am UTC](https://discuss.elastic.co/t/filebeat-threat-intel-module-errors/319225 "2022-11-19T09:33:39Z")
Hi, I am setting up MISP servers and Threat Intel Module. I can get the threat intel module to bring in IOCs from other feeds, but MISP is creating issues. I keep getting the following error.message: "cannot access met… --- ## [Autodiscover with nomad doesn't work](https://discuss.elastic.co/t/autodiscover-with-nomad-doesnt-work/318690)
**Author:** [@Natanael\_Weslley](https://discuss.elastic.co/u/Natanael_Weslley)\ **Replies:** 5\ **Last updated:** [November 18, 2022, 8:11pm UTC](https://discuss.elastic.co/t/autodiscover-with-nomad-doesnt-work/318690 "2022-11-18T20:11:16Z")
Hi, guys! I'm having some trouble to configure autodiscover to run with nomad, to get allocation logs from the nomad agent and send to logstash. Everytime i got this message in filebeat logs. // "message":"Non-zero met… --- ## [Filebeat - Exiting: error unpacking config data: more than one namespace configured accessing 'queue'](https://discuss.elastic.co/t/filebeat-exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-queue/319028)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 1\ **Last updated:** [November 18, 2022, 11:56am UTC](https://discuss.elastic.co/t/filebeat-exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-queue/319028 "2022-11-18T11:56:50Z")
Hi All, I have received the following error message in the /var/log/messages - while filebeat won't start: Exiting: error unpacking config data: more than one namespace configured accessing 'queue' (source:'/usr/asdf/e… --- ## [Set dynamic headers in every request](https://discuss.elastic.co/t/set-dynamic-headers-in-every-request/319118)
**Author:** [@rbr66](https://discuss.elastic.co/u/rbr66)\ **Replies:** 1\ **Last updated:** [November 17, 2022, 3:46pm UTC](https://discuss.elastic.co/t/set-dynamic-headers-in-every-request/319118 "2022-11-17T15:46:17Z")
Hi, We are monitoring a series of machines with heartbeat and we have a special casuistic in which we need heartbeat to send the timestamp in which the request is made, we don't care if by headers, params, or query para… --- ## [Json and normal logs as input](https://discuss.elastic.co/t/json-and-normal-logs-as-input/319205)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 0\ **Last updated:** [November 17, 2022, 2:17pm UTC](https://discuss.elastic.co/t/json-and-normal-logs-as-input/319205 "2022-11-17T14:17:40Z")
Hi, what is the best practice when using filestream as type and having 2 different input paths of logs where 1 is a simple \*.log and the other one is a \*.json? Should I still just use e.g. the following although like 5… --- ## [Multiple modules and/or pipelines in containers in kubernetes autodiscover with hints](https://discuss.elastic.co/t/multiple-modules-and-or-pipelines-in-containers-in-kubernetes-autodiscover-with-hints/319190)
**Author:** [@arpderp](https://discuss.elastic.co/u/arpderp)\ **Replies:** 0\ **Last updated:** [November 17, 2022, 12:24pm UTC](https://discuss.elastic.co/t/multiple-modules-and-or-pipelines-in-containers-in-kubernetes-autodiscover-with-hints/319190 "2022-11-17T12:24:43Z")
Hi, I have containers running drupal and drupal is among another things generating its own syslog messages and nginx access logs. I want to capture nginx access logs and the drupal syslogs and pass them to elasticsearc… --- ## [Enable TLS for filebeat.input \[Newbie\]](https://discuss.elastic.co/t/enable-tls-for-filebeat-input-newbie/319180)
**Author:** [@dant0005](https://discuss.elastic.co/u/dant0005)\ **Replies:** 0\ **Last updated:** [November 17, 2022, 11:30am UTC](https://discuss.elastic.co/t/enable-tls-for-filebeat-input-newbie/319180 "2022-11-17T11:30:12Z")
Hallo community, Quite new to the elastic stack but lurking for a while in this community. I got the task to set up log management based on the elastic stack. Use case: External system (SAAS) sends logs (a variety of … --- ## [Heartbeat 8.5.0 Parsing Errors](https://discuss.elastic.co/t/heartbeat-8-5-0-parsing-errors/318031)
**Author:** [@christophercutajar](https://discuss.elastic.co/u/christophercutajar)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 10:51am UTC](https://discuss.elastic.co/t/heartbeat-8-5-0-parsing-errors/318031 "2022-11-17T10:51:23Z")
Hi team, After upgrading our heartbeat deployment from 8.4.3 to 8.5.0, heartbeat data ingestion stopped. From the logs, we can see that the reason why the event cannot be ingested is due to parsing issues. \\"reason\\":… --- ## [Metricbeat|Kubernetes|](https://discuss.elastic.co/t/metricbeat-kubernetes/319024)
**Author:** [@panditvaddi](https://discuss.elastic.co/u/panditvaddi)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 7:05am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes/319024 "2022-11-16T07:05:50Z")
Hi All, I want to read data from multiple namespaces using single metricbeat. Example: namespace1 namespace2 namespace3 using single metricbeat, i want to read data from all the namespace using wildcards like "name… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=66) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=68)