# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=86 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 87 --- ## [Heartbeat showing Down even the port is working when autodiscovery of Docker Host Port and IP's](https://discuss.elastic.co/t/heartbeat-showing-down-even-the-port-is-working-when-autodiscovery-of-docker-host-port-and-ips/307568)
**Author:** [@itssenthil](https://discuss.elastic.co/u/itssenthil)\ **Replies:** 2\ **Last updated:** [June 20, 2022, 9:42am UTC](https://discuss.elastic.co/t/heartbeat-showing-down-even-the-port-is-working-when-autodiscovery-of-docker-host-port-and-ips/307568 "2022-06-20T09:42:30Z")
Hey Elastic Team, Good Day, I'm done the configurations to autodiscovery of Heartbeat, and also it discovers the port, but the some of the up status ports in realtime in docker showing down from the beginning in the Hear… --- ## [Can heartbeat monitor ip/website via specific network interface?](https://discuss.elastic.co/t/can-heartbeat-monitor-ip-website-via-specific-network-interface/307346)
**Author:** [@luckyclue](https://discuss.elastic.co/u/luckyclue)\ **Replies:** 3\ **Last updated:** [June 20, 2022, 9:30am UTC](https://discuss.elastic.co/t/can-heartbeat-monitor-ip-website-via-specific-network-interface/307346 "2022-06-20T09:30:26Z")
One server connected to 3 ISP and need to monitor those latency to some ip/websites . Can heartbeat monitor ip/website via specific network interface ? or run some scripts (for change gateway ) after complete a round of… --- ## [Help with installing Filebeat ubuntu 20.04](https://discuss.elastic.co/t/help-with-installing-filebeat-ubuntu-20-04/307599)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 3\ **Last updated:** [June 20, 2022, 5:06am UTC](https://discuss.elastic.co/t/help-with-installing-filebeat-ubuntu-20-04/307599 "2022-06-20T05:06:19Z")
Please help to understand how \[Filebeat\] works, i have elk stack installed with fleet server , system & fleet server integration installed in the stack i have an ubuntu 18.04 added as client and i wanted to monitor /ro… --- ## [Filebeat journald input failing to open a handle to the library](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 2\ **Last updated:** [June 18, 2022, 9:07am UTC](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505 "2022-06-18T09:07:16Z")
Hello everyone, i just managed to compile filebeat to work on armv7 with journald input (regular filestream works just fine) however when starting filebeat i get a following error message, filebeat keeps on running but … --- ## [Metricbeat mysql 8.2.3 fleet integration failing](https://discuss.elastic.co/t/metricbeat-mysql-8-2-3-fleet-integration-failing/307306)
**Author:** [@rbos](https://discuss.elastic.co/u/rbos)\ **Replies:** 7\ **Last updated:** [June 18, 2022, 5:15am UTC](https://discuss.elastic.co/t/metricbeat-mysql-8-2-3-fleet-integration-failing/307306 "2022-06-18T05:15:16Z")
On all my hosts that have upgraded to elastic-agent 8.2.3 (with the RHEL packages), the "mysql" integration is failing with: {"log.level":"error","@timestamp":"2022-06-15T09:01:06.421-0700","log.origin":{"file.name":"lo… --- ## [Instead of Beats 7.17.3v in kibana 8v index templates are showing](https://discuss.elastic.co/t/instead-of-beats-7-17-3v-in-kibana-8v-index-templates-are-showing/307217)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 5:37am UTC](https://discuss.elastic.co/t/instead-of-beats-7-17-3v-in-kibana-8v-index-templates-are-showing/307217 "2022-06-15T05:37:43Z")
Hi , I have downgraded elk and beats of 8v to 7.17.3v. And all 8v were uninstalled and deleted but beats(metric,packet,winlog) of 8v index templates & Data stream is only coming up in kibana 7.17.3v. It's not showing 7… --- ## [Beats 7.17.3v agents are running properly but no data showing 7.17.3v in data stream](https://discuss.elastic.co/t/beats-7-17-3v-agents-are-running-properly-but-no-data-showing-7-17-3v-in-data-stream/307345)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 6:19am UTC](https://discuss.elastic.co/t/beats-7-17-3v-agents-are-running-properly-but-no-data-showing-7-17-3v-in-data-stream/307345 "2022-06-16T06:19:46Z")
Hi, Beats 7.17.3v agents are running properly and data is coming but not showing 7.17.3v in data stream instead its showing 8v data stream --- ## [Mapping conflict field host.ip Filebeat](https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [June 17, 2022, 6:19pm UTC](https://discuss.elastic.co/t/mapping-conflict-field-host-ip-filebeat/307535 "2022-06-17T18:19:34Z")
Hello there, I got this cluster setup and apparently is working fine apart from that I got some mapping conflicts under the hood. After added Custom Windows Event Logs integrations using fleet, I checked if logs was co… --- ## [Elastic Agent AWS Integration - no option for ingesting EKS control plane logs](https://discuss.elastic.co/t/elastic-agent-aws-integration-no-option-for-ingesting-eks-control-plane-logs/307518)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 0\ **Last updated:** [June 17, 2022, 1:50pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-integration-no-option-for-ingesting-eks-control-plane-logs/307518 "2022-06-17T13:50:19Z")
Hi, We have AWS EKS and we want to ingest control plane log such as K8s audit Log (Amazon EKS control plane logging - Amazon EKS). Currently we use Kubernetes integration but it seems the current integration only suppo… --- ## [Deduplicate data](https://discuss.elastic.co/t/deduplicate-data/307372)
**Author:** [@Worlock](https://discuss.elastic.co/u/Worlock)\ **Replies:** 3\ **Last updated:** [June 17, 2022, 12:08pm UTC](https://discuss.elastic.co/t/deduplicate-data/307372 "2022-06-17T12:08:37Z")
So I have data that is getting exported to a JSON file, that's being uploaded to Elastic using FIlebeat. One of the fields can change, and when that happens, I would like the record being updated in Elastic instead of u… --- ## [Building filebeat with journald support for arm](https://discuss.elastic.co/t/building-filebeat-with-journald-support-for-arm/307490)
**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\ **Replies:** 2\ **Last updated:** [June 17, 2022, 11:24am UTC](https://discuss.elastic.co/t/building-filebeat-with-journald-support-for-arm/307490 "2022-06-17T11:24:41Z")
Hello everyone, I've been struggling to figure out how to compile filebeat with support for journald for arm platform. I know it seems to not be officially supported (since there are no arm packages available to downl… --- ## [Whether anyone configured filebeats and metricbeats for Azure HDinsight \[Apache kafka\]?](https://discuss.elastic.co/t/whether-anyone-configured-filebeats-and-metricbeats-for-azure-hdinsight-apache-kafka/307400)
**Author:** [@BERIN\_C\_DHAS](https://discuss.elastic.co/u/BERIN_C_DHAS)\ **Replies:** 1\ **Last updated:** [June 17, 2022, 11:05am UTC](https://discuss.elastic.co/t/whether-anyone-configured-filebeats-and-metricbeats-for-azure-hdinsight-apache-kafka/307400 "2022-06-17T11:05:48Z")
whether anyone configured filebeats and metricbeats for Monitoring Azure HDinsight \[Apache kafka\]? --- ## [Httpjson pagination querystring value + 1](https://discuss.elastic.co/t/httpjson-pagination-querystring-value-1/307398)
**Author:** [@frolko](https://discuss.elastic.co/u/frolko)\ **Replies:** 1\ **Last updated:** [June 17, 2022, 10:31am UTC](https://discuss.elastic.co/t/httpjson-pagination-querystring-value-1/307398 "2022-06-17T10:31:40Z")
Trying to use httpjson integration to scrape an api of data, using filebeat.8.2.2 The api takes query parameters PageSize=1000&PageNumber=1, where I'm supposed to keep adding PageNumber +1 until I get a 404 error. Howe… --- ## [Need some help understanding filebeat init scripts](https://discuss.elastic.co/t/need-some-help-understanding-filebeat-init-scripts/307032)
**Author:** [@Hermooz](https://discuss.elastic.co/u/Hermooz)\ **Replies:** 5\ **Last updated:** [June 17, 2022, 7:20am UTC](https://discuss.elastic.co/t/need-some-help-understanding-filebeat-init-scripts/307032 "2022-06-17T07:20:56Z")
Hi all. I have been tasked to manage a filebeat installation on a not-so-recent machine - we're talking about a CentOS 6.4 with a filebeat version 7.12, installed by rpm. This is not (yet) a systemd-enabled distro so fil… --- ## [How to fix host issue in filebeat-7.17.4 without drop\_fields](https://discuss.elastic.co/t/how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/306890)
**Author:** [@mbmannubisht](https://discuss.elastic.co/u/mbmannubisht)\ **Replies:** 3\ **Last updated:** [June 17, 2022, 4:51am UTC](https://discuss.elastic.co/t/how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/306890 "2022-06-17T04:51:43Z")
Hi Team, Stuck in one issue if I drop\_fields of host then it will work otherwise not working Working condition code: - drop\_fields: fields: \["beat", "offset", "source", "type", "input\_type", "host"\] igno… --- ## [Filebeat and Metricbeat process cause CPU high for 8.2.0 version](https://discuss.elastic.co/t/filebeat-and-metricbeat-process-cause-cpu-high-for-8-2-0-version/307207)
**Author:** [@wisdomluo](https://discuss.elastic.co/u/wisdomluo)\ **Replies:** 9\ **Last updated:** [June 17, 2022, 1:13am UTC](https://discuss.elastic.co/t/filebeat-and-metricbeat-process-cause-cpu-high-for-8-2-0-version/307207 "2022-06-17T01:13:19Z")
top - 09:18:06 up 7 min, 1 user, load average: 10.19, 8.81, 4.51 Tasks: 124 total, 3 running, 58 sleeping, 0 stopped, 1 zombie %Cpu(s): 82.0 us, 7.7 sy, 0.0 ni, 10.3 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB … --- ## [How to debug filebeat module, it doesn't seem to be getting syslog data](https://discuss.elastic.co/t/how-to-debug-filebeat-module-it-doesnt-seem-to-be-getting-syslog-data/307307)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 9\ **Last updated:** [June 16, 2022, 7:24pm UTC](https://discuss.elastic.co/t/how-to-debug-filebeat-module-it-doesnt-seem-to-be-getting-syslog-data/307307 "2022-06-16T19:24:42Z")
I'm trying to use the panw module receiving data via a syslog port. I've enabled the module and can see that filebeat is listening on the proper udp port. I can see traffic arrive in tcpdump and the events look valid. … --- ## [Filebeat receives HTTP 405 from Elasticsearch after 7.x -\> 8.1 upgrade](https://discuss.elastic.co/t/filebeat-receives-http-405-from-elasticsearch-after-7-x-8-1-upgrade/303821)
**Author:** [@Specialist](https://discuss.elastic.co/u/Specialist)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 4:21pm UTC](https://discuss.elastic.co/t/filebeat-receives-http-405-from-elasticsearch-after-7-x-8-1-upgrade/303821 "2022-06-16T16:21:37Z")
Hi there, since upgrading to v8.1 Filebeat no longer starts with the following error: Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exist… --- ## [\[Metricbeat\] Can't apply rollover when creating indexes](https://discuss.elastic.co/t/metricbeat-cant-apply-rollover-when-creating-indexes/306810)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 15\ **Last updated:** [June 16, 2022, 4:16pm UTC](https://discuss.elastic.co/t/metricbeat-cant-apply-rollover-when-creating-indexes/306810 "2022-06-16T16:16:39Z")
Hello, I have a metricbeat deployed in a kubernetes cluster, I'm trying to create, for each kubernetes namespace, a metricbeat index following this pattern: metricbeat-%{\[agent.version\]}-%{\[kubernetes.namespace\]}-{now/d… --- ## [Inquiries about metricbeat disk write visualize](https://discuss.elastic.co/t/inquiries-about-metricbeat-disk-write-visualize/307342)
**Author:** [@inwoo1](https://discuss.elastic.co/u/inwoo1)\ **Replies:** 5\ **Last updated:** [June 16, 2022, 1:39pm UTC](https://discuss.elastic.co/t/inquiries-about-metricbeat-disk-write-visualize/307342 "2022-06-16T13:39:20Z")
hello~! Information on disk write capacity is collected and displayed. As you can see, the maximum capacity is 110 TB. I'm not sure if this is daily data, monthly data, or yearly data. How long is this data? Could i… --- ## [\[Metricbeat\] Can't get metrics: Get https://docker-desktop:10250/stats/summary, (Client.Timeout exceeded while awaiting headers](https://discuss.elastic.co/t/metricbeat-cant-get-metrics-get-https-docker-desktop-10250-stats-summary-client-timeout-exceeded-while-awaiting-headers/307415)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 0\ **Last updated:** [June 16, 2022, 1:37pm UTC](https://discuss.elastic.co/t/metricbeat-cant-get-metrics-get-https-docker-desktop-10250-stats-summary-client-timeout-exceeded-while-awaiting-headers/307415 "2022-06-16T13:37:40Z")
Hello, Follwoing this post to create index per namespace, I couldn't make metricbeat work to get metrics first from kubernetes. I'm using: ELK v8.2 metricbeat 8.2 kube-state-metrics Microsoft Windows \[version 10.0.19… --- ## [Filebeat 7.17.3 invalid CRI log format error](https://discuss.elastic.co/t/filebeat-7-17-3-invalid-cri-log-format-error/307130)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [June 16, 2022, 10:17am UTC](https://discuss.elastic.co/t/filebeat-7-17-3-invalid-cri-log-format-error/307130 "2022-06-16T10:17:01Z")
I am getting various CRI parsing errors, on Filebeat 7.17.3. I have cleared all filebeat state and restarted Filebeat, but these errors always occur. Here are a couple: FYI :- I am using Nomad containers. ERROR \[rea… --- ## [\[Urgent\] How to fix host issue in filebeat-7.17.4 without drop\_fields](https://discuss.elastic.co/t/urgent-how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/307353)
**Author:** [@mbmannubisht](https://discuss.elastic.co/u/mbmannubisht)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 8:11am UTC](https://discuss.elastic.co/t/urgent-how-to-fix-host-issue-in-filebeat-7-17-4-without-drop-fields/307353 "2022-06-16T08:11:58Z")
Hi Team, Stuck in one issue if I drop\_fields of host then it will work otherwise not working Working condition code: - drop\_fields: fields: \["beat", "offset", "source", "type", "input\_type", "host"\] ignore… --- ## [\[Metricbeat\] metricbeat-metric pod keeps on crashing after deployment in kubernetes](https://discuss.elastic.co/t/metricbeat-metricbeat-metric-pod-keeps-on-crashing-after-deployment-in-kubernetes/307334)
**Author:** [@Charlie\_Guo](https://discuss.elastic.co/u/Charlie_Guo)\ **Replies:** 2\ **Last updated:** [June 16, 2022, 6:14am UTC](https://discuss.elastic.co/t/metricbeat-metricbeat-metric-pod-keeps-on-crashing-after-deployment-in-kubernetes/307334 "2022-06-16T06:14:26Z")
Hi Community, I have deployed the Metricbeat (v7.10.2) helm chart on the kubernetes. The deamonset pods and metricbeat-kube-state-metrics pod are running fine, but the metricbeat-metricbeat-metrics pod is keep on crashi… --- ## [Filebeat setup x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068)
**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\ **Replies:** 3\ **Last updated:** [June 16, 2022, 3:45am UTC](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068 "2022-06-16T03:45:33Z")
can some help i get the error below when i try to run "sudo filebeat setup" Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET reques… --- ## [Fleet server no data from other elastic agents](https://discuss.elastic.co/t/fleet-server-no-data-from-other-elastic-agents/307315)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 8:00pm UTC](https://discuss.elastic.co/t/fleet-server-no-data-from-other-elastic-agents/307315 "2022-06-15T20:00:27Z")
Hello, I recently installed elastic + kibana + elastic agent (all versions 7.17.4) on ubuntu 20.04, I have a cluster of one node with self-signed certificates, after setting up I installed elastic-agent (fleet server) ev… --- ## [Unable to read Cluster Stats index](https://discuss.elastic.co/t/unable-to-read-cluster-stats-index/306936)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 1\ **Last updated:** [June 15, 2022, 12:04pm UTC](https://discuss.elastic.co/t/unable-to-read-cluster-stats-index/306936 "2022-06-15T12:04:30Z")
I am unable to read or fetch data from cluster Stats field. GET /\_cluster/stats I need data in this index to be used in the kibana dashboard visualization to fetch the details like disk usage, cpu & jvm usage just like… --- ## [Downgrade beat version from v8 to v7](https://discuss.elastic.co/t/downgrade-beat-version-from-v8-to-v7/307045)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 4\ **Last updated:** [June 15, 2022, 9:53am UTC](https://discuss.elastic.co/t/downgrade-beat-version-from-v8-to-v7/307045 "2022-06-15T09:53:23Z")
Hi, can I know is it possible to downgrade from version 8 to v 7.14. Earlier what I did was just backup existing filebeat at /etc/filebeat and install new filebeat v8 via rpm. After installing noticed something cause my … --- ## [Filebeats not picking .log files from directories](https://discuss.elastic.co/t/filebeats-not-picking-log-files-from-directories/306790)
**Author:** [@Dhilipkumar](https://discuss.elastic.co/u/Dhilipkumar)\ **Replies:** 2\ **Last updated:** [June 15, 2022, 9:50am UTC](https://discuss.elastic.co/t/filebeats-not-picking-log-files-from-directories/306790 "2022-06-15T09:50:40Z")
Hello All, Im using 8.1.3 version of Elasticsearch and 8.1.0 version of filebeat for log Analysis puropse in Linux environment as a group user. We have log files of various types (e.g .txt, .log, .html, .sql, .csv) in … --- ## [Google Workspace module using wrong field to avoid duplicates](https://discuss.elastic.co/t/google-workspace-module-using-wrong-field-to-avoid-duplicates/306816)
**Author:** [@serhii.okhrimenko](https://discuss.elastic.co/u/serhii.okhrimenko)\ **Replies:** 3\ **Last updated:** [June 15, 2022, 8:33am UTC](https://discuss.elastic.co/t/google-workspace-module-using-wrong-field-to-avoid-duplicates/306816 "2022-06-15T08:33:12Z")
Hi, I have recently noticed that Google Workspace module uses @metadata.id instead of @metadata.\_id. It leads to duplicate appearance in logs. Changing this: var addID = new processor.Fingerprint({ fields: \[ … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=85) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=87)