# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=84 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 85 --- ## [Filebeat Error logstash/async.go:280 "client is not connected"](https://discuss.elastic.co/t/filebeat-error-logstash-async-go-280-client-is-not-connected/308874)
**Author:** [@Ricard-CT](https://discuss.elastic.co/u/Ricard-CT)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:45am UTC](https://discuss.elastic.co/t/filebeat-error-logstash-async-go-280-client-is-not-connected/308874 "2022-07-06T09:45:17Z")
Hi, I have installed ELK Stack in my server and all seems to work fine, but when filebeat (installed on another server) tries to send the log to Logstash, an error appears: ERROR \[logstash\] logstash/async… --- ## [\[HAproxy\] log pipeline fails to extract http.request.method for HTTP/2.0 requests](https://discuss.elastic.co/t/haproxy-log-pipeline-fails-to-extract-http-request-method-for-http-2-0-requests/308956)
**Author:** [@Mydayyy](https://discuss.elastic.co/u/Mydayyy)\ **Replies:** 1\ **Last updated:** [July 6, 2022, 9:06am UTC](https://discuss.elastic.co/t/haproxy-log-pipeline-fails-to-extract-http-request-method-for-http-2-0-requests/308956 "2022-07-06T09:06:08Z")
Greetings, in accordance with your Github guideline, I am reporting this issue here. Please post all questions and issues on Beats - Discuss the Elastic Stack before opening a Github Issue. Your questions will reach … --- ## [Ship logs of application using Filbeat](https://discuss.elastic.co/t/ship-logs-of-application-using-filbeat/307257)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 5\ **Last updated:** [July 6, 2022, 7:46am UTC](https://discuss.elastic.co/t/ship-logs-of-application-using-filbeat/307257 "2022-07-06T07:46:26Z")
Hi, I have a kubernetes cluster on which I have deployed the elastic stack using ECK. I have several microservices deployed in the cluster as pods and I want to fetch logs from particular microservice pods. Also I have… --- ## [Filebeat disk queue not working as documented](https://discuss.elastic.co/t/filebeat-disk-queue-not-working-as-documented/308609)
**Author:** [@ulisses](https://discuss.elastic.co/u/ulisses)\ **Replies:** 4\ **Last updated:** [July 5, 2022, 7:19pm UTC](https://discuss.elastic.co/t/filebeat-disk-queue-not-working-as-documented/308609 "2022-07-05T19:19:50Z")
According to this documentation Internal Queue: Queue data is deleted from disk after it has been successfully sent to the output. This is not happening. Sent data still exists in the files (\*.seg). And to make matt… --- ## [Elastic-agent cannot configure filebeat error "failed for nwparser.icmp\_code"](https://discuss.elastic.co/t/elastic-agent-cannot-configure-filebeat-error-failed-for-nwparser-icmp-code/308603)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [July 5, 2022, 4:57pm UTC](https://discuss.elastic.co/t/elastic-agent-cannot-configure-filebeat-error-failed-for-nwparser-icmp-code/308603 "2022-07-05T16:57:29Z")
The Elastic Agent that I have assigned to my Fleet server policy cannot configure it's Filebeat instance. This is version 8.2.3 on Ubuntu 18.04. elastic-agent status gives me: Status: FAILED Message: (no message) Appl… --- ## [Processor in auditd module fails](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693)
**Author:** [@parisila](https://discuss.elastic.co/u/parisila)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 6:38pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693 "2022-07-04T18:38:41Z")
I have a processor defined in the auditd module and seems to be correct based on other posts I have read. No configuration errors and filebeat starts up but I get an error ERROR instance/beat.go:989 Exit… --- ## [Failed to monitor mongo cluster](https://discuss.elastic.co/t/failed-to-monitor-mongo-cluster/308453)
**Author:** [@Maksym\_Postument](https://discuss.elastic.co/u/Maksym_Postument)\ **Replies:** 5\ **Last updated:** [July 4, 2022, 1:05pm UTC](https://discuss.elastic.co/t/failed-to-monitor-mongo-cluster/308453 "2022-07-04T13:05:05Z")
I have multiple hosts specified in hosts like this hosts: \["ip1:port1", "ip2:port1"\]. But metricbeats showing error like this. How can i configure it to work correctly fetching data for metricset mongodb.dbstats: could… --- ## [How to make beats send data to multiple instances](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/308785)
**Author:** [@Santhosh\_Kumar247](https://discuss.elastic.co/u/Santhosh_Kumar247)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 12:03pm UTC](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/308785 "2022-07-04T12:03:39Z")
Hello, I have the following setting in the filebeats.yml: Two conditions input for logs filebeat.inputs: - paths: - E: \\ log\_type1 \_ \*. Log fields\_under\_root: true fields: type: type1 - paths: - E: \\ … --- ## [Metricbeat fails to parse field](https://discuss.elastic.co/t/metricbeat-fails-to-parse-field/308446)
**Author:** [@cracanut](https://discuss.elastic.co/u/cracanut)\ **Replies:** 2\ **Last updated:** [July 4, 2022, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-fails-to-parse-field/308446 "2022-07-04T07:41:11Z")
I'm trying to setup monitoring of our ES cluster via MetricBeat. The cluster consists of: 1 master & 1 data node (more to be added later) running on AWS Ubuntu ARM instances I'm getting the following error in MetricB… --- ## [Metric monitoring for multi cpu systems](https://discuss.elastic.co/t/metric-monitoring-for-multi-cpu-systems/306839)
**Author:** [@Siddhant\_Gupta](https://discuss.elastic.co/u/Siddhant_Gupta)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 7:27am UTC](https://discuss.elastic.co/t/metric-monitoring-for-multi-cpu-systems/306839 "2022-07-04T07:27:29Z")
I want to monitor a multi cpu system and set up the systems metricbeat to get the values. The problem is the systems metric beat reports a cumulative metric for all the CPUs. I want to report the values of all the CPUs s… --- ## [Metricbeat does not send documents to indices other than .monitoring-es-\*-mb, even when output.elasticsearch.index specified](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516)
**Author:** [@Olivia\_Anderson](https://discuss.elastic.co/u/Olivia_Anderson)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 7:23am UTC](https://discuss.elastic.co/t/metricbeat-does-not-send-documents-to-indices-other-than-monitoring-es-mb-even-when-output-elasticsearch-index-specified/308516 "2022-07-04T07:23:44Z")
I have 2 elasticsearch clusters deployed with ECK, and want to send stack monitoring data from the main cluster to the monitoring cluster. Metricbeat is setup with the following configs: elasticsearch.yml: - module: el… --- ## [Filebeat ilm options don't work](https://discuss.elastic.co/t/filebeat-ilm-options-dont-work/308768)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 0\ **Last updated:** [July 4, 2022, 3:24am UTC](https://discuss.elastic.co/t/filebeat-ilm-options-dont-work/308768 "2022-07-04T03:24:33Z")
i edit filebeat.yml set "setup.ilm.policy\_name" to my own test policy created by kibana. filebeat log shows the option worked. {"log.level":"info","@timestamp":"2022-07-04T02:51:11.473Z","log.logger":"index-management.… --- ## [How to add an alias to index by using filebeat?](https://discuss.elastic.co/t/how-to-add-an-alias-to-index-by-using-filebeat/308640)
**Author:** [@busishe](https://discuss.elastic.co/u/busishe)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 3:10am UTC](https://discuss.elastic.co/t/how-to-add-an-alias-to-index-by-using-filebeat/308640 "2022-07-04T03:10:15Z")
i want to use ilm to delete outdated logs.the ilm policy is configured for rollover ,means the index need an alias.filebeat will create an index automatically (if you configured in filebeat.yml and the index not existed)… --- ## [Packetbeat not sending logs to Logstash](https://discuss.elastic.co/t/packetbeat-not-sending-logs-to-logstash/308607)
**Author:** [@Nightshade](https://discuss.elastic.co/u/Nightshade)\ **Replies:** 16\ **Last updated:** [July 3, 2022, 1:32am UTC](https://discuss.elastic.co/t/packetbeat-not-sending-logs-to-logstash/308607 "2022-07-03T01:32:39Z")
Alright, the most basic potential problem. I have packetbeat on an Arch Linux system, the beats package for Arch is currently 8.1.3. my ELK stack server is running 8.2x I don't believe this is the problem because the … --- ## [Monitoring AWS Environment](https://discuss.elastic.co/t/monitoring-aws-environment/308623)
**Author:** [@JypraGroup](https://discuss.elastic.co/u/JypraGroup)\ **Replies:** 1\ **Last updated:** [July 2, 2022, 1:49pm UTC](https://discuss.elastic.co/t/monitoring-aws-environment/308623 "2022-07-02T13:49:07Z")
Hi All, I need some advice! We have a AWS CloudWatch collecting all the logs from different sources (WAF, application, EC2 etc.), and we need to pull those logs into Elastic for monitoring from both the application avai… --- ## [Beats on VMS to Logstash deployed in kubernetes with ingress definition - Beats Config Question](https://discuss.elastic.co/t/beats-on-vms-to-logstash-deployed-in-kubernetes-with-ingress-definition-beats-config-question/308668)
**Author:** [@jthart](https://discuss.elastic.co/u/jthart)\ **Replies:** 0\ **Last updated:** [July 1, 2022, 2:22pm UTC](https://discuss.elastic.co/t/beats-on-vms-to-logstash-deployed-in-kubernetes-with-ingress-definition-beats-config-question/308668 "2022-07-01T14:22:53Z")
Overview of data flow: Beats on VMs -→ nginx -→ logstash (ingress definition, see below) -→ elasticsearch Logstash Ingress Definition: ingress: enabled: true className: "nginx" pathtype: ImplementationSpecific … --- ## [Invalid mapping error in metricbeat 7.16.2](https://discuss.elastic.co/t/invalid-mapping-error-in-metricbeat-7-16-2/308264)
**Author:** [@ritesh811](https://discuss.elastic.co/u/ritesh811)\ **Replies:** 5\ **Last updated:** [July 1, 2022, 4:26am UTC](https://discuss.elastic.co/t/invalid-mapping-error-in-metricbeat-7-16-2/308264 "2022-07-01T04:26:00Z")
I am facing the below error in my metricbeat index in kibana illegal\_state\_exception: invalid mapping definition, expected a single map underneath \[\_doc\] but it was: \[{\_meta={beat=metricbeat, version=7.16.2}, dynamic\_te… --- ## [Filebeat installation using tar and configurations](https://discuss.elastic.co/t/filebeat-installation-using-tar-and-configurations/308536)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 1\ **Last updated:** [June 30, 2022, 7:00am UTC](https://discuss.elastic.co/t/filebeat-installation-using-tar-and-configurations/308536 "2022-06-30T07:00:51Z")
Hi all, I installed filebeat using tar. Can I know where it is configure for the registry and config files. For example the location of below fields --path.config -- path.data -- path.logs How should i start the file… --- ## [Office365 ELK STACK integration error](https://discuss.elastic.co/t/office365-elk-stack-integration-error/308463)
**Author:** [@mkibani](https://discuss.elastic.co/u/mkibani)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 11:39am UTC](https://discuss.elastic.co/t/office365-elk-stack-integration-error/308463 "2022-06-29T11:39:36Z")
hello community, My company is trying to intergrate o365 logs to the SIEM, i have configured the module o365 in filebeat however i keep getting "unable to acquire authentication token for tenant" in logs while reviewing… --- ## [Certificate Error When Setting Up Winlogbeat](https://discuss.elastic.co/t/certificate-error-when-setting-up-winlogbeat/308414)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 2\ **Last updated:** [June 29, 2022, 4:07pm UTC](https://discuss.elastic.co/t/certificate-error-when-setting-up-winlogbeat/308414 "2022-06-29T16:07:00Z")
I am setting up an elastic stack for my organization and I am running into some issues. The error happens when I try to run the following command .\\winlogbeat.exe setup -e When I run that command, I get the following: … --- ## [Optionnal triggers in functionbeat](https://discuss.elastic.co/t/optionnal-triggers-in-functionbeat/308425)
**Author:** [@Lucas\_Zientek](https://discuss.elastic.co/u/Lucas_Zientek)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 7:14am UTC](https://discuss.elastic.co/t/optionnal-triggers-in-functionbeat/308425 "2022-06-29T07:14:29Z")
Hello everyone, I have an issue on my functionbeat configuration, I want to have no triggers declared in my functionbeat.yml file. I am deploying the functionbeat lambda on aws using cloudformation that I edited myself… --- ## [Winlogbeat error connecting to Elasticsearch at https://ip:9200: Get "https://ip:9200": x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority cert](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch-at-https-ip-get-https-ip-9200-x509-certificate-signed-by-unknown-authority-possibly-because-of-crypto-rsa-verification-error-while-trying-to-verify-candidate-authority-cert/308419)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [June 29, 2022, 4:29am UTC](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch-at-https-ip-get-https-ip-9200-x509-certificate-signed-by-unknown-authority-possibly-because-of-crypto-rsa-verification-error-while-trying-to-verify-candidate-authority-cert/308419 "2022-06-29T04:29:39Z")
i just try to install winlogbeat, and i put the ip into elasticsearch-ca.pem. but have an error like this. please help 2022-06-29T11:25:47.925+0700 INFO instance/beat.go:328 Setup Beat: winlogbeat; Version: 7.1… --- ## [Elastic\_agent 8.2.3 unhealthy status](https://discuss.elastic.co/t/elastic-agent-8-2-3-unhealthy-status/308413)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 2\ **Last updated:** [June 29, 2022, 12:00am UTC](https://discuss.elastic.co/t/elastic-agent-8-2-3-unhealthy-status/308413 "2022-06-29T00:00:55Z")
bellow error log in the client after i upgraded the elastic agent to 8.2.3 \[elastic\_agent\]\[error\] 2022-06-28T23:51:31Z - message: Application: filebeat--8.2.3\[23ef375c-440f-4504-aef6-26bfeb72d272\]: State changed to FAIL… --- ## [Syslog collection via Elastic Agent](https://discuss.elastic.co/t/syslog-collection-via-elastic-agent/307626)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 9:07am UTC](https://discuss.elastic.co/t/syslog-collection-via-elastic-agent/307626 "2022-06-28T09:07:05Z")
Hello, We have an application for which installing a local agent is not possible and there is no specific Agent Integration so we are looking to collect the syslog over TCP or UDP. I assumed within the System integrati… --- ## [How to uninstall metricbeat 7.16.2 and install the 6.8.3 version of metricbeat](https://discuss.elastic.co/t/how-to-uninstall-metricbeat-7-16-2-and-install-the-6-8-3-version-of-metricbeat/308256)
**Author:** [@ritesh811](https://discuss.elastic.co/u/ritesh811)\ **Replies:** 2\ **Last updated:** [June 28, 2022, 5:56am UTC](https://discuss.elastic.co/t/how-to-uninstall-metricbeat-7-16-2-and-install-the-6-8-3-version-of-metricbeat/308256 "2022-06-28T05:56:25Z")
I had installed metricbeat 7.16.2 using the rpm command and now I want to uninstall it and install the 6.8.3 version. Can someone please help by writing down the steps required for it? Thanks in advance. --- ## [Elasticsearch Elastic Agent integration (not via Filebeat/Metricbeat)](https://discuss.elastic.co/t/elasticsearch-elastic-agent-integration-not-via-filebeat-metricbeat/308147)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 4:44pm UTC](https://discuss.elastic.co/t/elasticsearch-elastic-agent-integration-not-via-filebeat-metricbeat/308147 "2022-06-27T16:44:05Z")
A few days ago I noticed that there was an actual Elasticsearch monitoring integration available when browsing through the available integrations in Kibana. So I figured I'd upgrade to 8.2.3 and then enable that for mon… --- ## [Elastic Agent - Sucessful Enrollment, but not updating beats configuration](https://discuss.elastic.co/t/elastic-agent-sucessful-enrollment-but-not-updating-beats-configuration/308044)
**Author:** [@hodops](https://discuss.elastic.co/u/hodops)\ **Replies:** 1\ **Last updated:** [June 27, 2022, 1:40pm UTC](https://discuss.elastic.co/t/elastic-agent-sucessful-enrollment-but-not-updating-beats-configuration/308044 "2022-06-27T13:40:34Z")
Elastic Agent Version: 7.17.4 Install method: APT OS: Ubuntu 18.04 Problem Description: I've installed Elastic Agent, and successfully enrolled it into the Fleet within my ES cluster. Within fleet the agent shows "H… --- ## [How dump/ingest nested API json data to elastic search](https://discuss.elastic.co/t/how-dump-ingest-nested-api-json-data-to-elastic-search/308221)
**Author:** [@azizullah2017](https://discuss.elastic.co/u/azizullah2017)\ **Replies:** 0\ **Last updated:** [June 27, 2022, 9:03am UTC](https://discuss.elastic.co/t/how-dump-ingest-nested-api-json-data-to-elastic-search/308221 "2022-06-27T09:03:33Z")
looking for help for large scale API calls of http like hundres if api call, trying to automate them with cron job. I am looking for solution where I can get data from different nested REST API and dump them on Elastics… --- ## [Only write ops with an op\_type of create are allowed in data streams"}}}}](https://discuss.elastic.co/t/only-write-ops-with-an-op-type-of-create-are-allowed-in-data-streams/308182)
**Author:** [@Nightshade](https://discuss.elastic.co/u/Nightshade)\ **Replies:** 3\ **Last updated:** [June 26, 2022, 8:50pm UTC](https://discuss.elastic.co/t/only-write-ops-with-an-op-type-of-create-are-allowed-in-data-streams/308182 "2022-06-26T20:50:27Z")
Not sure what to do here, have tried a bunch of suggestions from Github for this issue.. input { beats { port =\> 5044 } } output { elasticsearch { data\_stream =\> "true" data\_stream\_timestamp =\> "@time… --- ## [Unable to Connect Filebeat to Elasticsearch](https://discuss.elastic.co/t/unable-to-connect-filebeat-to-elasticsearch/308061)
**Author:** [@Nightshade](https://discuss.elastic.co/u/Nightshade)\ **Replies:** 5\ **Last updated:** [June 26, 2022, 12:09pm UTC](https://discuss.elastic.co/t/unable-to-connect-filebeat-to-elasticsearch/308061 "2022-06-26T12:09:58Z")
This is the error I am getting: Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error connecting to Elasticsearch at http://10.0.0.132:9200: Get "http://10.0.0.132:9200": EOF\] Full log w… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=83) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=85)