# Elastic-Agent - filebeat and metricbeat - Error Log help

**URL:** <https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054>\
**Category:** Endpoint Security\
**Created:** [February 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054 "2021-02-11T21:01:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cwobuzz](https://avatars.discourse-cdn.com/v4/letter/c/e0b2c6/32.png) [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\
**Post date:** [February 11, 2021, 9:01pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054/1 "2021-02-11T21:01:52Z")

</div>

# I have ElasticSearch and Kibana running as dockers I documented it here: [https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md](https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md)

My Elastic-Agent is pushing Endpoint security logs, but Auditbeat, Filebeat and Winlogbeat are all showing 0 logs.

# Metricbeat Monitor Log:

```auto
{"log.level":"info","@timestamp":"2021-02-11T13:00:09.510-0700","log.origin":{"file.name":"module/wrapper.go","file.line":259},"message":"Error fetching data for metricset beat.state: error making http request: Get \"http://npipe/state\": open \\\\.\\pipe\\default-endpoint-security: The system cannot find the file specified.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-02-11T13:00:09.510-0700","log.origin":{"file.name":"module/wrapper.go","file.line":259},"message":"Error fetching data for metricset beat.stats: error making http request: Get \"http://npipe/stats\": open \\\\.\\pipe\\default-endpoint-security: The system cannot find the file specified.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-02-11T13:00:09.510-0700","log.origin":{"file.name":"module/wrapper.go","file.line":259},"message":"Error fetching data for metricset http.json: error making http request: Get \"http://npipe/stats\": open \\\\.\\pipe\\default-endpoint-security: The system cannot find the file specified.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-02-11T13:00:18.690-0700","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":144},"message":"Non-zero metrics in the last 30s","monitoring":{"metrics":{"beat":{"cpu":{"system":{"ticks":16078,"time":{"ms":94}},"total":{"ticks":25984,"time":{"ms":157},"value":25984},"user":{"ticks":9906,"time":{"ms":63}}},"handles":{"open":280},"info":{"ephemeral_id":"7c59624d-7982-49f4-aea7-9026c17c1816","uptime":{"ms":11191727}},"memstats":{"gc_next":17784784,"memory_alloc":9909672,"memory_total":776768968,"rss":59359232},"runtime":{"goroutines":92}},"libbeat":{"config":{"module":{"running":7}},"output":{"events":{"acked":30,"active":0,"batches":3,"total":30},"read":{"bytes":8147},"write":{"bytes":64007}},"pipeline":{"clients":10,"events":{"active":0,"published":30,"total":30},"queue":{"acked":30}}},"metricbeat":{"beat":{"state":{"events":9,"failures":3,"success":6},"stats":{"events":9,"failures":3,"success":6}},"http":{"json":{"events":12,"failures":3,"success":9}}}},"ecs.version":"1.6.0"}}

```

# Filebeat Monitor Log

```auto
{"log.level":"info","@timestamp":"2021-02-11T13:00:19.011-0700","log.origin":{"file.name":"log/harvester.go","file.line":302},"message":"Harvester started for file: C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-84c4d4\\logs\\default\\metricbeat-json.log","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-02-11T13:00:19.011-0700","log.logger":"jsonhelper","log.origin":{"file.name":"jsontransform/jsonhelper.go","file.line":62},"message":"JSON: Won't overwrite @timestamp because of parsing error: parsing time \"2021-02-11T13:00:13.850-0700\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"-0700\" as \"Z07:00\"","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-02-11T13:00:19.011-0700","log.origin":{"file.name":"log/harvester.go","file.line":302},"message":"Harvester started for file: C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-84c4d4\\logs\\default\\filebeat-json.log","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-02-11T13:00:19.011-0700","log.logger":"jsonhelper","log.origin":{"file.name":"jsontransform/jsonhelper.go","file.line":62},"message":"JSON: Won't overwrite @timestamp because of parsing error: parsing time \"2021-02-11T13:00:17.285-0700\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"-0700\" as \"Z07:00\"","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-02-11T13:00:44.034-0700","log.logger":"jsonhelper","log.origin":{"file.name":"jsontransform/jsonhelper.go","file.line":62},"message":"JSON: Won't overwrite @timestamp because of parsing error: parsing time \"2021-02-11T13:00:43.862-0700\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"-0700\" as \"Z07:00\"","ecs.version":"1.6.0"}

```

# Agent Watcher Log

```auto
{"log.level":"error","@timestamp":"2021-02-11T09:53:35.251-0700","log.origin":{"file.name":"cmd/watch.go","file.line":60},"message":"failed to load markeropen C:\\Program Files\\Elastic\\Agent\\data\\.update-marker: The system cannot find the file specified.","ecs.version":"1.6.0"}

```

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [February 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054/2 "2021-02-15T17:18:14Z")

</div>

i think we're hitting this bug of filebeat here [Allow to overwrite @timestamp with different format · Issue #11273 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/11273). i will check what we can do about that and test possible worarounds

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [February 25, 2021, 9:47am UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054/3 "2021-02-25T09:47:38Z")

</div>

> [@cwobuzz](#):
>
> `2021-02-11T13:00:19.011-0700`

I created issue we can track [[Ingest Manager] Unable to collect logs on machines with timezone set · Issue #24229 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/24229)

---

<div class="post-metadata">

**Author:** ![cwobuzz](https://avatars.discourse-cdn.com/v4/letter/c/e0b2c6/32.png) [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\
**Post date:** [March 3, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054/4 "2021-03-03T16:05:05Z")

</div>

Thanks! I have not tested this, but it seems like you need to set your host computer to UTC for elastic agent to ingest it's beats.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054/5 "2021-03-31T16:05:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.