# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=79 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 80 --- ## [Thread Intet MISP](https://discuss.elastic.co/t/thread-intet-misp/312361)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [August 18, 2022, 8:37am UTC](https://discuss.elastic.co/t/thread-intet-misp/312361 "2022-08-18T08:37:31Z")
I can't receive misp data on my dashboard but filebeat don't have any error. Any solution for this problem? --- ## [\[Filebeat\] AWS CloudTrail Processor parses incorrect AWS region from logs](https://discuss.elastic.co/t/filebeat-aws-cloudtrail-processor-parses-incorrect-aws-region-from-logs/312150)
**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\ **Replies:** 3\ **Last updated:** [August 18, 2022, 6:31am UTC](https://discuss.elastic.co/t/filebeat-aws-cloudtrail-processor-parses-incorrect-aws-region-from-logs/312150 "2022-08-18T06:31:48Z")
When processing AWS CloudTrail logs, we noticed a discrepancy in the parsed AWS region compared to the region a log file originated. CloudTrail is not region specific , but monitors all configured regions and stuffs the … --- ## [Backreference in regex](https://discuss.elastic.co/t/backreference-in-regex/312299)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 1\ **Last updated:** [August 18, 2022, 3:11am UTC](https://discuss.elastic.co/t/backreference-in-regex/312299 "2022-08-18T03:11:45Z")
Hi, is it possible to use backreference for regex in auditbeat/filebeat? I am trying something like this: \\"1\\":\\"(\\w+)\\",\\"2\\":\\"\\1\\" and the following string should match: "1":"string","2":"string" But I am getti… --- ## [No field "postgresql.log.level" frome Filebat Posresql module in Kibana](https://discuss.elastic.co/t/no-field-postgresql-log-level-frome-filebat-posresql-module-in-kibana/311725)
**Author:** [@sadux](https://discuss.elastic.co/u/sadux)\ **Replies:** 1\ **Last updated:** [August 17, 2022, 2:23pm UTC](https://discuss.elastic.co/t/no-field-postgresql-log-level-frome-filebat-posresql-module-in-kibana/311725 "2022-08-17T14:23:48Z")
Hello! Just install filebeat (7.15.1)+postgresql module. filebeat.yml: output.logstash: hosts: \["logstash.test.com:5001","logstash2.test.com:5001"\] loadbalance: true fields: env: prod host\_type: postgresql fi… --- ## [Filebeat cant monitor the log file that file name include \[\]](https://discuss.elastic.co/t/filebeat-cant-monitor-the-log-file-that-file-name-include/311758)
**Author:** [@zyjj1](https://discuss.elastic.co/u/zyjj1)\ **Replies:** 1\ **Last updated:** [August 17, 2022, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-cant-monitor-the-log-file-that-file-name-include/311758 "2022-08-17T14:13:56Z")
We monitor a log file. The name of this log file is mwsummary-log\[0\].log. We found that filebeat cannot monitor any content of this file. Also no data is sent to elasticsearch. If we remove the in the log file name, fil… --- ## [Comparing the values of two fields](https://discuss.elastic.co/t/comparing-the-values-of-two-fields/312280)
**Author:** [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\ **Replies:** 0\ **Last updated:** [August 17, 2022, 12:10pm UTC](https://discuss.elastic.co/t/comparing-the-values-of-two-fields/312280 "2022-08-17T12:10:05Z")
Hello, I am setting up the auditbeat processor, and I am trying to figure out comparison of two fields based on theirs values and use it in condition for processor, like: equals.field1.inner\_field: field2.inner\_field I… --- ## [Test multiline pattern - random order](https://discuss.elastic.co/t/test-multiline-pattern-random-order/312275)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 0\ **Last updated:** [August 17, 2022, 12:00pm UTC](https://discuss.elastic.co/t/test-multiline-pattern-random-order/312275 "2022-08-17T12:00:01Z")
Hi I have elk stack 8.3 I need to test multiline patterns. I do it so that I write a given part of the log to the .txt file, and then rewrite it to the log file monitored by filebeat example: \[xxx @ xxx logs\] # cat … --- ## [How to connect Winlogbeat to Elasticsearch using SSL?](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-using-ssl/312238)
**Author:** [@Linyilan-zz](https://discuss.elastic.co/u/Linyilan-zz)\ **Replies:** 1\ **Last updated:** [August 17, 2022, 9:29am UTC](https://discuss.elastic.co/t/how-to-connect-winlogbeat-to-elasticsearch-using-ssl/312238 "2022-08-17T09:29:18Z")
Hello Team： We are having a single node ELK configuration, In the same server we have installed Elasticsearch and kibana (8.3.3) As per the guide if we are installing the Elasticsearch generates own SSL configuration … --- ## [How to configure numeric value file name in filebeat](https://discuss.elastic.co/t/how-to-configure-numeric-value-file-name-in-filebeat/311686)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 2\ **Last updated:** [August 17, 2022, 6:18am UTC](https://discuss.elastic.co/t/how-to-configure-numeric-value-file-name-in-filebeat/311686 "2022-08-17T06:18:35Z")
Hello Team, I have a filename with numeric value, like 20220809-test.log While configure the same in filebeat.yml, its not sending the logs. I think the filebeat can't read the numeric value. Please help how to confi… --- ## [AWS SQS Message how to read through filebeat7.0?](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932)
**Author:** [@HariP](https://discuss.elastic.co/u/HariP)\ **Replies:** 1\ **Last updated:** [August 16, 2022, 2:02pm UTC](https://discuss.elastic.co/t/aws-sqs-message-how-to-read-through-filebeat7-0/311932 "2022-08-16T14:02:58Z")
I need to read AWS SQS or AWS SNS message through filebeat and pass to Elastic Search. Please note my message in JSON format text message .. I changed filebeat yml file below config type: s3 endpoint: https://sqs.us-ea… --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/311946)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 6\ **Last updated:** [August 16, 2022, 9:04am UTC](https://discuss.elastic.co/t/filebeat-error/311946 "2022-08-16T09:04:00Z")
Can you help me resolve this problem? Only Threat Intel activated is misp. --- ## [Filebeat - Journald input and parser support](https://discuss.elastic.co/t/filebeat-journald-input-and-parser-support/312099)
**Author:** [@Philipp\_Wiesner](https://discuss.elastic.co/u/Philipp_Wiesner)\ **Replies:** 0\ **Last updated:** [August 15, 2022, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-and-parser-support/312099 "2022-08-15T12:38:31Z")
I've seen a couple of already closed topics, with no real result about the JournalD input of Filebeat and its support for multiline messages or even the newly added parser support. There exists a couple of GitHub issues… --- ## [Metricbeat bad request error](https://discuss.elastic.co/t/metricbeat-bad-request-error/312074)
**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\ **Replies:** 0\ **Last updated:** [August 15, 2022, 7:23am UTC](https://discuss.elastic.co/t/metricbeat-bad-request-error/312074 "2022-08-15T07:23:56Z")
Hello, I keep getting the following Errors by metricbeat ERROR#011module/wrapper.go:259#011Error fetching data for metricset elasticsearch.index: HTTP error 400 in : 400 Bad Request ERROR#011module/wrapper.go:259#011E… --- ## [Filebeat not connecting to elasticsearch over ssl](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940)
**Author:** [@pauldon2](https://discuss.elastic.co/u/pauldon2)\ **Replies:** 6\ **Last updated:** [August 12, 2022, 7:22pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940 "2022-08-12T19:22:17Z")
I installed elasticsearch 8.3.3 on ubuntu 18.04 and allowed xpack. curl --cacert /etc/elasticsearch/certs/http\_ca.crt -u elastic https://localhost:9200 after entering the password gives the result { "name" : "mgmt-… --- ## [Filebeat irregularly restarts and crashes](https://discuss.elastic.co/t/filebeat-irregularly-restarts-and-crashes/311819)
**Author:** [@aleaesaest](https://discuss.elastic.co/u/aleaesaest)\ **Replies:** 18\ **Last updated:** [August 12, 2022, 9:32am UTC](https://discuss.elastic.co/t/filebeat-irregularly-restarts-and-crashes/311819 "2022-08-12T09:32:28Z")
Hello, we are using wazuh installed on a VM. Unfortunately, the filebeat service crashes at irregular intervals - after running for a while. I reviewed all the logs I could, but was unable to find the cause of the iss… --- ## [Fleet server keeps CrashLoopBackOff in Azure kubernetes](https://discuss.elastic.co/t/fleet-server-keeps-crashloopbackoff-in-azure-kubernetes/311938)
**Author:** [@levitoh123](https://discuss.elastic.co/u/levitoh123)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 2:49pm UTC](https://discuss.elastic.co/t/fleet-server-keeps-crashloopbackoff-in-azure-kubernetes/311938 "2022-08-11T14:49:34Z")
I have installed ECK and elasticsearch, kibana and fleet (agents and server) via the recipe yaml files in my kubernetes cluster running in Azure (version 1.21) and the fleet server keeps crashing without staying up. The … --- ## [Split logs per customers](https://discuss.elastic.co/t/split-logs-per-customers/311658)
**Author:** [@YannKistenmacker](https://discuss.elastic.co/u/YannKistenmacker)\ **Replies:** 9\ **Last updated:** [August 11, 2022, 12:46pm UTC](https://discuss.elastic.co/t/split-logs-per-customers/311658 "2022-08-11T12:46:34Z")
Hello everyone, I'm new elasticsearch user and i'm in charge to develop a system to monitoring our customers logs. So starting by this point i have to monitoring Fortinet Firewall Logs and i've already did with filebeat… --- ## [Auditbeat on Windows core with sshd](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920)
**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\ **Replies:** 0\ **Last updated:** [August 11, 2022, 11:42am UTC](https://discuss.elastic.co/t/auditbeat-on-windows-core-with-sshd/311920 "2022-08-11T11:42:56Z")
Just installed the first Aufitbeat agent to a Windows server and as this is a Windows Core server access is really only via ssh. Has anyone played with this setup? Auditbeat is reporting, but I'm not seeing sshd login be… --- ## [Devise logs](https://discuss.elastic.co/t/devise-logs/311849)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 7:16pm UTC](https://discuss.elastic.co/t/devise-logs/311849 "2022-08-10T19:16:42Z")
Hi, i have log file it looks like this : \*TR START\* AAAA INS AAAA: 121212 DATE 20-07-22 TIME 09:18:00 09:18:04 PI 09:1… --- ## [Ndjson.expand\_keys doesn't seem to work](https://discuss.elastic.co/t/ndjson-expand-keys-doesnt-seem-to-work/311289)
**Author:** [@andreycha](https://discuss.elastic.co/u/andreycha)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 7:44am UTC](https://discuss.elastic.co/t/ndjson-expand-keys-doesnt-seem-to-work/311289 "2022-08-10T07:44:33Z")
Hi, My application produces logs in ECS format where loggers write log level as a flat field "log.level". I use Filebeat 7.17.5 to ship logs into Elasticsearch. As stated in the documentation I set ndjson.expand\_keys to… --- ## [Dashboard MISP](https://discuss.elastic.co/t/dashboard-misp/311760)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 4:31pm UTC](https://discuss.elastic.co/t/dashboard-misp/311760 "2022-08-09T16:31:50Z")
The Dashboard \[Filebeat Threat Intel\] MISP only appears what is on my network? For example, MISP Indicators \[Filebeat Threat Intel\] only appears the number 24 and the MISP Tags \[Filebeat Threat Intel\] and the tags are m… --- ## [Elasticsearch/client.go:405 Cannot index event publisher.Event](https://discuss.elastic.co/t/elasticsearch-client-go-405-cannot-index-event-publisher-event/311744)
**Author:** [@maviles](https://discuss.elastic.co/u/maviles)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-client-go-405-cannot-index-event-publisher-event/311744 "2022-08-09T14:08:04Z")
Hello, I'm trying to change my index name. I made some modifications to my .yml file including: change index name change index template change index pattern change index ilm related settings. However, the following … --- ## [Filename starts with numeric value type of log not working in filebeat](https://discuss.elastic.co/t/filename-starts-with-numeric-value-type-of-log-not-working-in-filebeat/311620)
**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 8:18am UTC](https://discuss.elastic.co/t/filename-starts-with-numeric-value-type-of-log-not-working-in-filebeat/311620 "2022-08-09T08:18:50Z")
Hello Team, I need to collect the log from files to lofgstash. My filename looks like the below. D:\\test\\test\\app\\20220808-appname.log While i configure the same path in filebeat its not working. Could you please ad… --- ## [ELK-functionbeat-not-able-to-push-data](https://discuss.elastic.co/t/elk-functionbeat-not-able-to-push-data/311662)
**Author:** [@vijay23vikram](https://discuss.elastic.co/u/vijay23vikram)\ **Replies:** 0\ **Last updated:** [August 8, 2022, 5:17pm UTC](https://discuss.elastic.co/t/elk-functionbeat-not-able-to-push-data/311662 "2022-08-08T17:17:46Z")
Hello Team, We are facing the below error in AWS function beat lambda. Cannot index event publisher.Event{Content:beat.Event More error details as below: Error: 2022-07-22T15:15:01.087Z WARN \[elasticsearch\] elastics… --- ## [Some logs with more json fields are not processed (Filebeat 8.3.3)](https://discuss.elastic.co/t/some-logs-with-more-json-fields-are-not-processed-filebeat-8-3-3/311597)
**Author:** [@nobeerhere](https://discuss.elastic.co/u/nobeerhere)\ **Replies:** 3\ **Last updated:** [August 8, 2022, 4:42pm UTC](https://discuss.elastic.co/t/some-logs-with-more-json-fields-are-not-processed-filebeat-8-3-3/311597 "2022-08-08T16:42:22Z")
Hi there, I am using the ECS-Logging for Jaba with filebeat 8.3.3 (Get started | ECS Logging Java Reference \[1.x\] | Elastic) and i have a strange problem where the log entries are not processed by the filestream of file… --- ## [AWS CloudWatch integration with Elastic using Elastic Agent](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318)
**Author:** [@JypraGroup](https://discuss.elastic.co/u/JypraGroup)\ **Replies:** 27\ **Last updated:** [August 8, 2022, 2:52pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-integration-with-elastic-using-elastic-agent/308318 "2022-08-08T14:52:36Z")
Hi all, I have Elastic agent installed on the endpoint and I can see the logs coming in. The policy has AWS CloudWatch integration however I am not sure what else is required to get the logs and metrics flowing from the… --- ## [Fleet AWS Billing integration](https://discuss.elastic.co/t/fleet-aws-billing-integration/311138)
**Author:** [@aricau](https://discuss.elastic.co/u/aricau)\ **Replies:** 8\ **Last updated:** [August 8, 2022, 11:22am UTC](https://discuss.elastic.co/t/fleet-aws-billing-integration/311138 "2022-08-08T11:22:54Z")
Hello all, I'm trying to collect billing data with the AWS Billing integration using the elastic agent managed by Fleet. Running version 8.3.3 The agent appears to be running fine, with valid secret access key and perm… --- ## [Broken data received on kibana from metricbeat prometheus module](https://discuss.elastic.co/t/broken-data-received-on-kibana-from-metricbeat-prometheus-module/311266)
**Author:** [@saif.khan](https://discuss.elastic.co/u/saif.khan)\ **Replies:** 3\ **Last updated:** [August 8, 2022, 9:59am UTC](https://discuss.elastic.co/t/broken-data-received-on-kibana-from-metricbeat-prometheus-module/311266 "2022-08-08T09:59:07Z")
I'm collecting data from 3 targets i.e my network devices through snmp\_exporter on prometheus, from there i'm integrating it in elastic and kibana through metricbeat prometheus module, the data is received but its broken… --- ## [Use Metricbeat to monitor LXC containers](https://discuss.elastic.co/t/use-metricbeat-to-monitor-lxc-containers/311329)
**Author:** [@SamTV12345](https://discuss.elastic.co/u/SamTV12345)\ **Replies:** 13\ **Last updated:** [August 8, 2022, 8:13am UTC](https://discuss.elastic.co/t/use-metricbeat-to-monitor-lxc-containers/311329 "2022-08-08T08:13:45Z")
I'd like to use metricbeat to collect cpu and memory usage so that I can better monitor running applications and be alerted when an application is crashing in a loop. I used this code to start metricbeat in docker in the… --- ## [Filebeat setup: "Exiting: module system is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584)
**Author:** [@JoeShabadu2000](https://discuss.elastic.co/u/JoeShabadu2000)\ **Replies:** 2\ **Last updated:** [August 7, 2022, 11:41pm UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584 "2022-08-07T23:41:43Z")
I'm trying to set up filebeat on Ubuntu, to send system log data to Logstash. I am having issues setting up the "filebeat system" module. Upon running: sudo filebeat setup --pipelines --modules system I receive the er… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=78) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=80)