# Non-zero metrics in the last 30s- Filebeat

**URL:** <https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 8, 2018, 6:30pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223 "2018-04-08T18:30:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pruthvi\_Lokasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pruthvi_lokasani/32/29753_2.png) [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\
**Post date:** [April 8, 2018, 6:30pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/1 "2018-04-08T18:30:40Z")

</div>

I am trying to pass my IIS logs to logstach using Filebeat and My logs are not showing in kibna .  
When I checked By Filebeat Log Below is the message it showing  
|2018-04-08T18:13:14.324Z|INFO|[monitoring]|log/log.go:124|Non-zero metrics in the last 30s|{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":453,"time":453},"total":{"ticks":484,"time":484,"value":484},"user":{"ticks":31,"time":31}},"info":{"ephemeral\_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":9810038}},"memstats":{"gc\_next":4194304,"memory\_alloc":1452232,"memory\_total":15559168}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}|

Using

ElasticSerch :6.2.3  
Kibana : 6.2.3  
Logstach: 6.2.3  
Filebeat : 6.2.3

Pasting my filebeat.yml file

###################### Filebeat Configuration Example #########################

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so

# you can use different prospectors for various configurations.

# Below are the prospector specific configurations.

- type: log

#============================= Filebeat modules ===============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: false

# Period on which files under path should be checked for changes

#reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:  
index.number\_of\_shards: 3  
#index.codec: best\_compression  
#\_source.enabled: false

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group

# all the transactions sent by a single shipper in the web interface.

#name:

# The tags of the shipper are included in their own field with each

# transaction published.

#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the

# output.

#fields:

# env: staging

#============================== Dashboards =====================================

# These settings control loading the sample dashboards to the Kibana index. Loading

# the dashboards is disabled by default and can be enabled either by setting the

# options here, or by using the `-setup` CLI flag or the `setup` command.

#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL

# has a value which is computed based on the Beat name and version. For released

# versions, this URL points to the dashboard archive on the [artifacts.elastic.co](http://artifacts.elastic.co)

# website.

#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.

# This requires a Kibana endpoint configuration.

setup.kibana:

# Kibana Host

# Scheme and port can be left out and will be set to the default (http and 5601)

# In case you specify and additional path, the scheme is required: [http://localhost:5601/path](http://localhost:5601/path)

# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

#host: "localhost:5601"

#============================= Elastic Cloud ==================================

# These settings simplify using filebeat with the Elastic Cloud ([https://cloud.elastic.co/](https://cloud.elastic.co/)).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and

# `setup.kibana.host` options.

# You can find the `cloud.id` in the Elastic Cloud web UI.

#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and

# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

#cloud.auth:

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------  
#output.elasticsearch:

# Array of hosts to connect to.

#hosts: ["localhost:9200"]

# Optional protocol and basic auth credentials.

#protocol: "https"  
#username: "elastic"  
#password: "changeme"

#----------------------------- Logstash output --------------------------------  
output.logstash:

# The Logstash hosts

hosts: ["localhost:5044"]

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.

# Available log levels are: error, warning, info, debug

#logging.level: debug

# At debug level, you can selectively enable logging only for some components.

# To enable all selectors use ["\*"]. Examples of other selectors are "beat",

# "publish", "service".

#logging.selectors: ["\*"]

#============================== Xpack Monitoring ===============================

# filebeat can export internal metrics to a central Elasticsearch monitoring

# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The

# reporting is disabled by default.

# Set to true to enable the monitoring reporter.

#xpack.monitoring.enabled: false

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 8, 2018, 8:17pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/2 "2018-04-08T20:17:06Z")

</div>

Please format your code using the `</>` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 9, 2018, 5:29am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/3 "2018-04-09T05:29:19Z")

</div>

Best also share your full log file.

---

<div class="post-metadata">

**Author:** ![Pruthvi\_Lokasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pruthvi_lokasani/32/29753_2.png) [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\
**Post date:** [April 9, 2018, 5:31am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/4 "2018-04-09T05:31:12Z")

</div>

```
#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- type: log

  # Change to true to enable this prospector configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
  - C:\inetpub\logs\LogFiles\W3SVC1\*.log
    #- /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']

  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']

  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #exclude_files: ['.gz$']

  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  # level: debug
  # review: 1

  ### Multiline options

  # Mutiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation

  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  #multiline.pattern: ^\[

  # Defines if the pattern set under pattern should be negated or not. Default is false.
  #multiline.negate: false

  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  #multiline.match: after

#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
  #index.codec: best_compression
  #_source.enabled: false

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging

#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here, or by using the `-setup` CLI flag or the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#============================== Xpack Monitoring ===============================
# filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
#xpack.monitoring.elasticsearch:
```

---

<div class="post-metadata">

**Author:** ![Pruthvi\_Lokasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pruthvi_lokasani/32/29753_2.png) [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\
**Post date:** [April 9, 2018, 5:33am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/5 "2018-04-09T05:33:16Z")

</div>

```
2018-04-08T15:29:44.309Z	INFO	instance/beat.go:468	Home path: [C:\Program Files\filebeat] Config path: [C:\Program Files\filebeat] Data path: [C:\\ProgramData\\filebeat] Logs path: [C:\\ProgramData\\filebeat\logs]
2018-04-08T15:29:44.320Z	INFO	instance/beat.go:475	Beat UUID: 70bb19bf-05c5-4da7-8f57-6695bdc822b0
2018-04-08T15:29:44.320Z	INFO	instance/beat.go:213	Setup Beat: filebeat; Version: 6.2.3
2018-04-08T15:29:44.320Z	INFO	pipeline/module.go:76	Beat name: WIN-VISVM8RCC6H
2018-04-08T15:29:44.321Z	INFO	instance/beat.go:301	filebeat start running.
2018-04-08T15:29:44.321Z	INFO	[monitoring]	log/log.go:97	Starting metrics logging every 30s
2018-04-08T15:29:44.321Z	INFO	registrar/registrar.go:108	Loading registrar data from C:\ProgramData\filebeat\registry
2018-04-08T15:29:44.321Z	INFO	registrar/registrar.go:119	States Loaded from registrar: 0
2018-04-08T15:29:44.321Z	WARN	beater/filebeat.go:261	Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2018-04-08T15:29:44.321Z	INFO	crawler/crawler.go:48	Loading Prospectors: 1
2018-04-08T15:29:44.321Z	INFO	crawler/crawler.go:82	Loading and starting Prospectors completed. Enabled prospectors: 0
2018-04-08T15:29:44.321Z	INFO	cfgfile/reload.go:127	Config reloader started
2018-04-08T15:29:44.322Z	INFO	cfgfile/reload.go:219	Loading of config files completed.
2018-04-08T15:30:14.360Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":62,"time":62,"value":62},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":30075}},"memstats":{"gc_next":4473924,"memory_alloc":2901256,"memory_total":2901256,"rss":15163392}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"type":"logstash"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":2}}}}}
2018-04-08T15:30:44.321Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":62,"time":62,"value":62},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":60036}},"memstats":{"gc_next":4473924,"memory_alloc":2950280,"memory_total":2950280,"rss":1568768}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2018-04-08T15:31:14.321Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":62,"time":62,"value":62},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":90036}},"memstats":{"gc_next":4473924,"memory_alloc":2984696,"memory_total":2984696,"rss":24576}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2018-04-08T15:31:44.322Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":62,"time":62,"value":62},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":120036}},"memstats":{"gc_next":4473924,"memory_alloc":3025672,"memory_total":3025672,"rss":53248}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2018-04-08T15:32:14.322Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":46,"time":46},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":150036}},"memstats":{"gc_next":4473924,"memory_alloc":3061016,"memory_total":3061016,"rss":20480}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2018-04-08T15:32:44.321Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":46,"time":46},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":180036}},"memstats":{"gc_next":4473924,"memory_alloc":3095784,"memory_total":3095784,"rss":8192}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2018-04-08T15:33:14.321Z	INFO	[monitoring]	log/log.go:124	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":46,"time":46},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":31,"time":31}},"info":{"ephemeral_id":"78e4f937-c77f-4c33-8466-4abe9bb6ccf0","uptime":{"ms":210036}},"memstats":{"gc_next":4473924,"memory_alloc":3135736,"memory_total":3135736,"rss":36864}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
```

---

<div class="post-metadata">

**Author:** ![Pruthvi\_Lokasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pruthvi_lokasani/32/29753_2.png) [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\
**Post date:** [April 9, 2018, 5:55pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/6 "2018-04-09T17:55:19Z")

</div>

Any issue found in log or Config file ?

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [April 10, 2018, 7:15am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/7 "2018-04-10T07:15:33Z")

</div>

Hi,

please set "True" to enable the prospector configuration.

> Change to true to enable this prospector configuration.  
> enabled: false

As we can see in the logs there is 1 prospector which is loading state but enabled prospector is '0'.

> | 2018-04-08T15:29:44.321Z | INFO | crawler/crawler.go:48 | Loading Prospectors: 1 |
> | --- | --- | --- | --- |
> | 2018-04-08T15:29:44.321Z | INFO | crawler/crawler.go:82 | Loading and starting Prospectors completed. Enabled prospectors: 0 |

please try this.

Thanks,  
Harsh Bajaj

---

<div class="post-metadata">

**Author:** ![Pruthvi\_Lokasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pruthvi_lokasani/32/29753_2.png) [@Pruthvi\_Lokasani](https://discuss.elastic.co/u/Pruthvi_Lokasani)\
**Post date:** [April 11, 2018, 4:36pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/8 "2018-04-11T16:36:08Z")

</div>

Thanks @harshbajaj16 it worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2018, 4:36pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat/127223/9 "2018-05-09T16:36:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.