beats
elastic/beats main cc7fbea
Beats
  • Beats
    • Beats
    • Config file format
      • Namespacing
      • Config file data types
      • Environment variables
      • Reference variables
      • Config file ownership and permissions
      • Command line arguments
      • YAML tips and gotchas
    • Auditbeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Repositories for APT and YUM
        • Run Auditbeat on Docker
        • Running Auditbeat on Kubernetes
        • Auditbeat and systemd
        • Start Auditbeat
        • Stop Auditbeat
      • Upgrade Auditbeat
      • Configure
        • Modules
        • General settings
        • Project paths
        • Config file reloading
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Kibana endpoint
        • Kibana dashboards
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_session_metadata
          • add_tags
          • append
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • rate_limit
          • registered_domain
          • rename
          • replace
          • syslog
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Internal queue
        • Logging
        • HTTP endpoint
        • Regular expression support
        • Instrumentation
        • Feature flags
        • auditbeat.reference.yml
      • How to guides
        • Load the Elasticsearch index template
        • Change the index name
        • Load Kibana dashboards
        • Enrich events with geoIP information
        • Parse data using an ingest pipeline
        • Use environment variables in the configuration
        • Avoid YAML formatting problems
      • Modules
        • Auditd Module
        • File Integrity Module
        • System Module
          • System host dataset
          • System login dataset
          • System package dataset
          • System process dataset
          • System socket dataset
          • System user dataset
      • Exported fields
        • Auditd fields
        • Beat fields
        • Cloud provider metadata fields
        • Common fields
        • Docker fields
        • ECS fields
        • File Integrity fields
        • Host fields
        • Jolokia Discovery autodiscover provider fields
        • Kubernetes fields
        • Process fields
        • System fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
        • Use Linux Secure Computing Mode (seccomp)
      • Troubleshoot
        • Get Help
        • Debug
        • Understand logged metrics
        • Common problems
          • Auditbeat fails to watch folders because too many files are open
          • Auditbeat uses too much bandwidth
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • Dashboard could not locate the index-pattern
          • High RSS memory usage due to MADV settings
      • Contribute
    • Filebeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Repositories for APT and YUM
        • Run Filebeat on Docker
        • Run Filebeat on Kubernetes
        • Run Filebeat on Cloud Foundry
        • Filebeat and systemd
        • Start Filebeat
        • Stop Filebeat
      • Upgrade
      • How Filebeat works
      • Configure
        • Inputs
          • Multiline messages
          • AWS CloudWatch
          • AWS S3
          • Azure Event Hub
          • Azure Blob Storage
          • Benchmark
          • CEL
          • Cloud Foundry
          • CometD
          • Container
          • Entity Analytics
          • ETW
          • filestream
          • GCP Pub/Sub
          • Google Cloud Storage
          • HTTP Endpoint
          • HTTP JSON
          • journald
          • Kafka
          • Log
          • MQTT
          • NetFlow
          • Office 365 Management Activity API
          • Redis
          • Salesforce
          • Stdin
          • Streaming
          • Syslog
          • TCP
          • UDP
          • Unified Logs
          • Unix
          • winlog
        • Modules
          • Override input settings
        • General settings
        • Project paths
        • Config file loading
          • Live reloading
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Kibana endpoint
        • Kibana dashboards
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_tags
          • append
          • cache
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_cef
          • decode_csv_fields
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • parse_aws_vpc_flow_log
          • rate_limit
          • registered_domain
          • rename
          • replace
          • script
          • syslog
          • timestamp
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Autodiscover
          • Hints based autodiscover
          • Advanced usage
        • Internal queue
        • Logging
        • HTTP endpoint
        • Regular expression support
        • Instrumentation
        • Feature flags
        • filebeat.reference.yml
      • How to guides
        • Override configuration settings
        • Load the Elasticsearch index template
        • Change the index name
        • Load Kibana dashboards
        • Load ingest pipelines
        • Enrich events with geoIP information
        • Deduplicate data
        • Parse data using an ingest pipeline
        • Use environment variables in the configuration
        • Avoid YAML formatting problems
        • Migrate log or container input configurations to filestream
        • How to choose file identity for filestream
        • Migrating from a Deprecated Filebeat Module
        • Removing files after ingestion
      • Modules
        • Modules
        • ActiveMQ module
        • Apache module
        • Auditd module
        • AWS module
        • AWS Fargate module
        • Azure module
        • CEF module
        • Check Point module
        • Cisco module
        • CoreDNS module
        • CrowdStrike module
        • Cyberark PAS module
        • Elasticsearch module
        • Envoyproxy module
        • Fortinet module
        • Google Cloud Platform (GCP) module
        • Google Workspace module
        • HAProxy module
        • IBM MQ module
        • Icinga module
        • IIS module
        • Iptables module
        • Juniper JUNOS module
        • Kafka module
        • Kibana module
        • Logstash module
        • Microsoft module
        • MISP module
        • MongoDB module
        • MSSQL module
        • MySQL module
        • MySQL Enterprise module
        • NATS module
        • NetFlow module
        • Nginx module
        • Office 365 module
        • Okta module
        • Oracle module
        • Osquery module
        • Palo Alto Networks module
        • Pensando module
        • PostgreSQL module
        • RabbitMQ module
        • Redis module
        • Salesforce module
          • Set up the OAuth App in the Salesforce
        • Google Santa module
        • Snyk module
        • Sophos module
        • Suricata module
        • System module
        • Threat Intel module
        • Traefik module
        • Zeek (Bro) module
        • ZooKeeper module
        • Zoom module
      • Exported fields
        • ActiveMQ fields
        • Apache fields
        • Auditd fields
        • AWS fields
        • AWS CloudWatch fields
        • AWS Fargate fields
        • Azure fields
        • Beat fields
        • Decode CEF processor fields fields
        • CEF fields
        • Check Point fields
        • Cisco fields
        • Cloud provider metadata fields
        • CoreDNS fields
        • CrowdStrike fields
        • Cyberark PAS fields
        • Docker fields
        • ECS fields
        • Elasticsearch fields
        • Envoyproxy fields
        • Fortinet fields
        • Google Cloud Platform (GCP) fields
        • Google Workspace fields
        • HAProxy fields
        • Host fields
        • IBM MQ fields
        • Icinga fields
        • IIS fields
        • Iptables fields
        • Jolokia Discovery autodiscover provider fields
        • Juniper JUNOS fields
        • Kafka fields
        • Kibana fields
        • Kubernetes fields
        • Log file content fields
        • Logstash fields
        • Lumberjack fields
        • Microsoft fields
        • MISP fields
        • MongoDB fields
        • MSSQL fields
        • MySQL fields
        • MySQL Enterprise fields
        • NATS fields
        • NetFlow fields
        • Nginx fields
        • Office 365 fields
        • Okta fields
        • Oracle fields
        • Osquery fields
        • Palo Alto Networks fields
        • Pensando fields
        • PostgreSQL fields
        • Process fields
        • RabbitMQ fields
        • Redis fields
        • s3 fields
        • Salesforce fields
        • Google Santa fields
        • Snyk fields
        • Sophos fields
        • Suricata fields
        • System fields
        • Threat Intel fields
        • Traefik fields
        • Windows ETW fields
        • Zeek (Bro) fields
        • ZooKeeper fields
        • Zoom fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
        • Use Linux Secure Computing Mode (seccomp)
      • Troubleshoot
        • Get help
        • Debug
        • Understand logged metrics
        • Common problems
          • Error extracting container id while using Kubernetes metadata
          • Can't read log files from network volumes
          • Filebeat isn't collecting lines from a file
          • Too many open file handlers
          • Registry file is too large
          • Inode reuse causes Filebeat to skip lines
          • Log rotation results in lost or duplicate events
          • Open file handlers cause issues with Windows file rotation
          • Filebeat is using too much CPU
          • Dashboard in Kibana is breaking up data fields incorrectly
          • Fields are not indexed or usable in Kibana visualizations
          • Filebeat isn't shipping the last line of a file
          • Filebeat keeps open file handlers of deleted files for a long time
          • Filebeat uses too much bandwidth
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • Dashboard could not locate the index-pattern
          • High RSS memory usage due to MADV settings
          • Files are not fully ingested when using autodiscover
      • Contribute
    • Heartbeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Repositories for APT and YUM
        • Run Heartbeat on Docker
        • Running Heartbeat on Kubernetes
        • Heartbeat and systemd
        • Stop Heartbeat
      • Configure
        • Monitors
          • Common monitor options
          • ICMP options
          • TCP options
          • HTTP options
        • Task scheduler
        • General settings
        • Project paths
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_tags
          • append
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • rate_limit
          • registered_domain
          • rename
          • replace
          • script
          • syslog
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Autodiscover
          • Hints based autodiscover
          • Advanced usage
        • Internal queue
        • Logging
        • HTTP endpoint
        • Regular expression support
        • Instrumentation
        • Feature flags
        • heartbeat.reference.yml
      • How to guides
        • Add observer and geo metadata
        • Load the Elasticsearch index template
        • Change the index name
        • Enrich events with geoIP information
        • Use environment variables in the configuration
        • Parse data using an ingest pipeline
        • Avoid YAML formatting problems
      • Exported fields
        • Beat fields
        • Synthetics browser metrics fields
        • Cloud provider metadata fields
        • Common heartbeat monitor fields
        • Docker fields
        • ECS fields
        • Host fields
        • HTTP monitor fields
        • ICMP fields
        • Jolokia Discovery autodiscover provider fields
        • Kubernetes fields
        • Process fields
        • Host lookup fields
        • APM Service fields
        • SOCKS5 proxy fields
        • Monitor state fields
        • Monitor summary fields
        • Synthetics types fields
        • TCP layer fields
        • TLS encryption layer fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
        • Use Linux Secure Computing Mode (seccomp)
      • Troubleshoot
        • Get help
        • Debug
        • Understand logged metrics
        • Common problems
          • Heartbeat uses too much bandwidth
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • High RSS memory usage due to MADV settings
      • Contribute
    • Metricbeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Repositories for APT and YUM
        • Run Metricbeat on Docker
        • Run Metricbeat on Kubernetes
        • Run Metricbeat on Cloud Foundry
        • Metricbeat and systemd
        • Start Metricbeat
        • Stop Metricbeat
      • Upgrade Metricbeat
      • How Metricbeat works
        • Event structure
        • Error event structure
        • Key metricbeat features
      • Configure
        • Modules
        • General settings
        • Project paths
        • Config file loading
          • Live reloading
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Kibana endpoint
        • Kibana dashboards
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_tags
          • append
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • rate_limit
          • registered_domain
          • rename
          • replace
          • script
          • syslog
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Autodiscover
          • Hints based autodiscover
          • Advanced usage
        • Internal queue
        • Logging
        • HTTP endpoint
        • Regular expression support
        • Instrumentation
        • Feature flags
        • metricbeat.reference.yml
      • How to guides
        • Load the Elasticsearch index template
        • Change the index name
        • Load Kibana dashboards
        • Enrich events with geoIP information
        • Use environment variables in the configuration
        • Parse data using an ingest pipeline
        • Avoid YAML formatting problems
      • Modules
        • ActiveMQ module
          • ActiveMQ broker metricset
          • ActiveMQ queue metricset
          • ActiveMQ topic metricset
        • Aerospike module
          • Aerospike namespace metricset
        • Airflow module
          • Airflow statsd metricset
        • Apache module
          • Apache status metricset
        • AWS module
          • AWS awshealth metricset
          • AWS billing metricset
          • AWS cloudwatch metricset
          • AWS dynamodb metricset
          • AWS ebs metricset
          • AWS ec2 metricset
          • AWS elb metricset
          • AWS kinesis metricset
          • AWS lambda metricset
          • AWS natgateway metricset
          • AWS rds metricset
          • AWS s3_daily_storage metricset
          • AWS s3_request metricset
          • AWS sns metricset
          • AWS sqs metricset
          • AWS transitgateway metricset
          • AWS usage metricset
          • AWS vpn metricset
        • AWS Fargate module
          • AWS Fargate task_stats metricset
        • Azure module
          • Azure app_insights metricset
          • Azure app_state metricset
          • Azure billing metricset
          • Azure compute_vm metricset
          • Azure compute_vm_scaleset metricset
          • Azure container_instance metricset
          • Azure container_registry metricset
          • Azure container_service metricset
          • Azure database_account metricset
          • Azure monitor metricset
          • Azure storage metricset
        • Beat module
          • Beat state metricset
          • Beat stats metricset
        • Benchmark module
          • Benchmark info metricset
        • Ceph module
          • Ceph cluster_disk metricset
          • Ceph cluster_health metricset
          • Ceph cluster_status metricset
          • Ceph mgr_cluster_disk metricset
          • Ceph mgr_cluster_health metricset
          • Ceph mgr_osd_perf metricset
          • Ceph mgr_osd_pool_stats metricset
          • Ceph mgr_osd_tree metricset
          • Ceph mgr_pool_disk metricset
          • Ceph monitor_health metricset
          • Ceph osd_df metricset
          • Ceph osd_tree metricset
          • Ceph pool_disk metricset
        • Cloudfoundry module
          • Cloudfoundry container metricset
          • Cloudfoundry counter metricset
          • Cloudfoundry value metricset
        • CockroachDB module
          • CockroachDB status metricset
        • Consul module
          • Consul agent metricset
        • Containerd module
          • Containerd blkio metricset
          • Containerd cpu metricset
          • Containerd memory metricset
        • Coredns module
          • Coredns stats metricset
        • Couchbase module
          • Couchbase bucket metricset
          • Couchbase cluster metricset
          • Couchbase node metricset
        • CouchDB module
          • CouchDB server metricset
        • Docker module
          • Docker container metricset
          • Docker cpu metricset
          • Docker diskio metricset
          • Docker event metricset
          • Docker healthcheck metricset
          • Docker image metricset
          • Docker info metricset
          • Docker memory metricset
          • Docker network metricset
          • Docker network_summary metricset
        • Dropwizard module
          • Dropwizard collector metricset
        • Elasticsearch module
          • Elasticsearch ccr metricset
          • Elasticsearch cluster_stats metricset
          • Elasticsearch enrich metricset
          • Elasticsearch index metricset
          • Elasticsearch index_recovery metricset
          • Elasticsearch index_summary metricset
          • Elasticsearch ingest_pipeline metricset
          • Elasticsearch ml_job metricset
          • Elasticsearch node metricset
          • Elasticsearch node_stats metricset
          • Elasticsearch pending_tasks metricset
          • Elasticsearch shard metricset
        • Envoyproxy module
          • Envoyproxy server metricset
        • Etcd module
          • Etcd leader metricset
          • Etcd metrics metricset
          • Etcd self metricset
          • Etcd store metricset
        • Google Cloud Platform module
          • Google Cloud Platform billing metricset
          • Google Cloud Platform carbon metricset
          • Google Cloud Platform compute metricset
          • Google Cloud Platform dataproc metricset
          • Google Cloud Platform firestore metricset
          • Google Cloud Platform gke metricset
          • Google Cloud Platform loadbalancing metricset
          • Google Cloud Platform metrics metricset
          • Google Cloud Platform pubsub metricset
          • Google Cloud Platform storage metricset
          • Google Cloud Platform vertexai_logs metricset
        • Golang module
          • Golang expvar metricset
          • Golang heap metricset
        • Graphite module
          • Graphite server metricset
        • HAProxy module
          • HAProxy info metricset
          • HAProxy stat metricset
        • HTTP module
          • HTTP json metricset
          • HTTP server metricset
        • IBM MQ module
          • IBM MQ qmgr metricset
        • IIS module
          • IIS application_pool metricset
          • IIS webserver metricset
          • IIS website metricset
        • Istio module
          • Istio citadel metricset
          • Istio galley metricset
          • Istio istiod metricset
          • Istio mesh metricset
          • Istio mixer metricset
          • Istio pilot metricset
          • Istio proxy metricset
        • Jolokia module
          • Jolokia jmx metricset
        • Kafka module
          • Kafka broker metricset
          • Kafka consumer metricset
          • Kafka consumergroup metricset
          • Kafka partition metricset
          • Kafka producer metricset
        • Kibana module
          • Kibana cluster_actions metricset
          • Kibana cluster_rules metricset
          • Kibana node_actions metricset
          • Kibana node_rules metricset
          • Kibana stats metricset
          • Kibana status metricset
        • Kubernetes module
          • Kubernetes apiserver metricset
          • Kubernetes container metricset
          • Kubernetes controllermanager metricset
          • Kubernetes event metricset
          • Kubernetes node metricset
          • Kubernetes pod metricset
          • Kubernetes proxy metricset
          • Kubernetes scheduler metricset
          • Kubernetes state_container metricset
          • Kubernetes state_cronjob metricset
          • Kubernetes state_daemonset metricset
          • Kubernetes state_deployment metricset
          • Kubernetes state_horizontalpodautoscaler metricset
          • Kubernetes state_job metricset
          • Kubernetes state_node metricset
          • Kubernetes state_persistentvolumeclaim metricset
          • Kubernetes state_pod metricset
          • Kubernetes state_replicaset metricset
          • Kubernetes state_resourcequota metricset
          • Kubernetes state_service metricset
          • Kubernetes state_statefulset metricset
          • Kubernetes state_storageclass metricset
          • Kubernetes system metricset
          • Kubernetes volume metricset
        • KVM module
          • KVM dommemstat metricset
          • KVM status metricset
        • Linux module
          • Linux conntrack metricset
          • Linux iostat metricset
          • Linux ksm metricset
          • Linux memory metricset
          • Linux pageinfo metricset
          • Linux pressure metricset
          • Linux rapl metricset
        • Logstash module
          • Logstash node metricset
          • Logstash node_stats metricset
        • Memcached module
          • Memcached stats metricset
        • Cisco Meraki module
          • Cisco Meraki device_health metricset
          • Cisco Meraki network_health metricset
        • MongoDB module
          • MongoDB collstats metricset
          • MongoDB dbstats metricset
          • MongoDB metrics metricset
          • MongoDB replstatus metricset
          • MongoDB status metricset
        • MSSQL module
          • MSSQL performance metricset
          • MSSQL transaction_log metricset
        • Munin module
          • Munin node metricset
        • MySQL module
          • MySQL galera_status metricset
          • galera status MetricSet
          • MySQL performance metricset
          • MySQL query metricset
          • MySQL status metricset
        • NATS module
          • NATS connection metricset
          • NATS connections metricset
          • NATS jetstream metricset
          • NATS route metricset
          • NATS routes metricset
          • NATS stats metricset
          • NATS subscriptions metricset
        • Nginx module
          • Nginx stubstatus metricset
        • Openmetrics module
          • Openmetrics collector metricset
        • Oracle module
          • Oracle performance metricset
          • Oracle sysmetric metricset
          • Oracle tablespace metricset
        • Panw module
          • Panw interfaces metricset
          • Panw routing metricset
          • Panw system metricset
          • Panw vpn metricset
        • PHP_FPM module
          • PHP_FPM pool metricset
          • PHP_FPM process metricset
        • PostgreSQL module
          • PostgreSQL activity metricset
          • PostgreSQL bgwriter metricset
          • PostgreSQL database metricset
          • PostgreSQL statement metricset
        • Prometheus module
          • Prometheus collector metricset
          • Prometheus query metricset
          • Prometheus remote_write metricset
        • RabbitMQ module
          • RabbitMQ connection metricset
          • RabbitMQ exchange metricset
          • RabbitMQ node metricset
          • RabbitMQ queue metricset
          • RabbitMQ shovel metricset
        • Redis module
          • Redis info metricset
          • Redis key metricset
          • Redis keyspace metricset
        • Redis Enterprise module
          • Redis Enterprise node metricset
          • Redis Enterprise proxy metricset
        • SQL module
          • Host Setup
          • SQL query metricset
        • Stan module
          • Stan channels metricset
          • Stan stats metricset
          • Stan subscriptions metricset
        • Statsd module
          • Metricsets
          • Statsd server metricset
        • SyncGateway module
          • SyncGateway db metricset
          • SyncGateway memory metricset
          • SyncGateway replication metricset
          • SyncGateway resources metricset
        • System module
          • System core metricset
          • System cpu metricset
          • System diskio metricset
          • System entropy metricset
          • System filesystem metricset
          • System fsstat metricset
          • System load metricset
          • System memory metricset
          • System network metricset
          • System network_summary metricset
          • System process metricset
          • System process_summary metricset
          • System raid metricset
          • System service metricset
          • System socket metricset
          • System socket_summary metricset
          • System uptime metricset
          • System users metricset
          • System ntp metricset
        • Tomcat module
          • Tomcat cache metricset
          • Tomcat memory metricset
          • Tomcat requests metricset
          • Tomcat threading metricset
        • Traefik module
          • Traefik health metricset
        • uWSGI module
          • uWSGI status metricset
        • vSphere module
          • vSphere cluster metricset
          • vSphere datastore metricset
          • vSphere datastorecluster metricset
          • vSphere host metricset
          • vSphere network metricset
          • vSphere resourcepool metricset
          • vSphere virtualmachine metricset
        • Windows module
          • Windows perfmon metricset
          • Windows service metricset
          • Windows wmi metricset
        • ZooKeeper module
          • ZooKeeper connection metricset
          • ZooKeeper mntr metricset
          • ZooKeeper server metricset
      • Exported fields
        • ActiveMQ fields
        • Aerospike fields
        • Airflow fields
        • Apache fields
        • AutoOps ES fields
        • AWS fields
        • AWS Fargate fields
        • Azure fields
        • Beat fields
        • Beat fields
        • Benchmark fields
        • Ceph fields
        • Cloud provider metadata fields
        • Cloudfoundry fields
        • CockroachDB fields
        • Common fields
        • Consul fields
        • Containerd fields
        • Coredns fields
        • Couchbase fields
        • CouchDB fields
        • Docker fields
        • Docker fields
        • Dropwizard fields
        • ECS fields
        • Elasticsearch fields
        • Envoyproxy fields
        • Etcd fields
        • Google Cloud Platform fields
        • Golang fields
        • Graphite fields
        • HAProxy fields
        • Host fields
        • HTTP fields
        • IBM MQ fields
        • IIS fields
        • Istio fields
        • Jolokia fields
        • Jolokia Discovery autodiscover provider fields
        • Kafka fields
        • Kibana fields
        • Kubernetes fields
        • Kubernetes fields
        • KVM fields
        • Linux fields
        • Logstash fields
        • Memcached fields
        • Cisco Meraki fields
        • MongoDB fields
        • MSSQL fields
        • Munin fields
        • MySQL fields
        • NATS fields
        • Nginx fields
        • Openmetrics fields
        • Oracle fields
        • Panw fields
        • PHP_FPM fields
        • PostgreSQL fields
        • Process fields
        • Prometheus fields
        • Prometheus typed metrics fields
        • RabbitMQ fields
        • Redis fields
        • Redis Enterprise fields
        • SQL fields
        • Stan fields
        • Statsd fields
        • SyncGateway fields
        • System fields
        • Tomcat fields
        • Traefik fields
        • uWSGI fields
        • vSphere fields
        • Windows fields
        • ZooKeeper fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
        • Use Linux Secure Computing Mode (seccomp)
      • Troubleshoot
        • Get help
        • Debug
        • Understand logged metrics
        • Common problems
          • open /compat/linux/proc: no such file or directory error on FreeBSD
          • Metricbeat collects system metrics for interfaces you didn't configure
          • Metricbeat uses too much bandwidth
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • Dashboard could not locate the index-pattern
          • High RSS memory usage due to MADV settings
      • Contribute
    • Packetbeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Repositories for APT and YUM
        • Run Packetbeat on Docker
        • Packetbeat and systemd
        • Start Packetbeat
        • Stop Packetbeat
      • Upgrade Packetbeat
      • Configure
        • Traffic sniffing
        • Network flows
        • Protocols
          • Common protocol options
          • ICMP
          • DNS
          • HTTP
          • AMQP
          • Cassandra
          • Memcache
          • MySQL
          • PgSQL
          • Thrift
          • MongoDB
          • TLS
          • Redis
        • Processes
        • General settings
        • Project paths
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Kibana endpoint
        • Kibana dashboards
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_tags
          • append
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • rate_limit
          • registered_domain
          • rename
          • replace
          • syslog
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Internal queue
        • Logging
        • HTTP endpoint
          • Protocol-Specific Metrics
        • Instrumentation
        • Feature flags
        • packetbeat.reference.yml
      • How to guides
        • Load the Elasticsearch index template
        • Change the index name
        • Load Kibana dashboards
        • Enrich events with geoIP information
        • Load ingest pipelines
        • Use environment variables in the configuration
        • Parse data using an ingest pipeline
        • Avoid YAML formatting problems
      • Exported fields
        • AMQP fields
        • Beat fields
        • Cassandra fields
        • Cloud provider metadata fields
        • Common fields
        • DHCPv4 fields
        • DNS fields
        • Docker fields
        • ECS fields
        • Flow Event fields
        • Host fields
        • HTTP fields
        • ICMP fields
        • Jolokia Discovery autodiscover provider fields
        • Kubernetes fields
        • Memcache fields
        • MongoDb fields
        • MySQL fields
        • NFS fields
        • PostgreSQL fields
        • Process fields
        • Raw fields
        • Redis fields
        • SIP fields
        • Thrift-RPC fields
        • Detailed TLS fields
        • Transaction Event fields
        • Measurements (Transactions) fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
        • Use Linux Secure Computing Mode (seccomp)
      • Visualize Packetbeat data in Kibana
        • Customize the Discover page
        • Kibana queries and filters
      • Troubleshoot
        • Get help
        • Debug
        • Understand logged metrics
        • Record a trace
        • Common problems
          • Dashboard in Kibana is breaking up data fields incorrectly
          • Packetbeat doesn't see any packets when using mirror ports
          • Packetbeat Can't capture traffic from Windows loopback interface
          • Packetbeat is missing long running transactions
          • Packetbeat isn't capturing MySQL performance data
          • Packetbeat uses too much bandwidth
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • Dashboard could not locate the index-pattern
          • High RSS memory usage due to MADV settings
          • Fields show up as nested JSON in Kibana
      • Contribute
    • Winlogbeat
      • Quick start
        • Installation script
      • Set up and run
        • Directory layout
        • Secrets keystore
        • Command reference
        • Start Winlogbeat
        • Stop Winlogbeat
      • Upgrade
      • Configure
        • Winlogbeat
        • General settings
        • Project paths
        • Output
          • Elastic Cloud Hosted
          • Elasticsearch
          • Logstash
          • Kafka
          • Redis
          • File
          • Console
          • Discard
          • Change the output codec
        • Kerberos
        • SSL
        • Index lifecycle management (ILM)
        • Elasticsearch index template
        • Kibana endpoint
        • Kibana dashboards
        • Processors
          • Define processors
          • add_cloud_metadata
          • add_cloudfoundry_metadata
          • add_docker_metadata
          • add_fields
          • add_host_metadata
          • add_id
          • add_kubernetes_metadata
          • add_labels
          • add_locale
          • add_network_direction
          • add_nomad_metadata
          • add_observer_metadata
          • add_process_metadata
          • add_tags
          • append
          • community_id
          • convert
          • copy_fields
          • decode_base64_field
          • decode_duration
          • decode_json_fields
          • decode_xml
          • decode_xml_wineventlog
          • decompress_gzip_field
          • detect_mime_type
          • dissect
          • dns
          • drop_event
          • drop_fields
          • extract_array
          • fingerprint
          • include_fields
          • move_fields
          • now
          • rate_limit
          • registered_domain
          • rename
          • replace
          • script
          • syslog
          • timestamp
          • translate_ldap_attribute
          • translate_sid
          • truncate_fields
          • urldecode
        • Internal queue
        • Logging
        • HTTP endpoint
          • Event Processing Metrics
        • Instrumentation
        • winlogbeat.reference.yml
      • How to guides
        • Enrich events with geoIP information
        • Load the Elasticsearch index template
        • Change the index name
        • Load Kibana dashboards
        • Load ingest pipelines
        • Use environment variables in the configuration
        • Parse data using an ingest pipeline
        • Avoid YAML formatting problems
      • Modules
        • PowerShell Module
        • Security Module
        • Sysmon Module
      • Exported fields
        • Beat fields
        • Cloud provider metadata fields
        • Docker fields
        • ECS fields
        • Legacy Winlogbeat alias fields
        • Host fields
        • Jolokia Discovery autodiscover provider fields
        • Kubernetes fields
        • PowerShell module fields
        • Process fields
        • Security module fields
        • Sysmon module fields
        • Winlogbeat fields
      • Monitor
        • Use internal collection
          • Settings for internal collection
        • Use Metricbeat collection
      • Secure
        • Grant users access to secured resources
          • Create a setup user
          • Create a monitoring user
          • Create a publishing user
          • Create a reader user
          • Learn more about privileges, roles, and users
        • Grant access using API keys
        • Secure communication with Elasticsearch
        • Secure communication with Logstash
      • Troubleshoot
        • Get Help
        • Debug
        • Understand logged metrics
        • Common problems
          • Dashboard in Kibana is breaking up data fields incorrectly
          • Bogus computer_name fields are reported in some events
          • Error loading config file
          • Found unexpected or unknown characters
          • Logstash connection doesn't work
          • Publishing to Logstash fails with "connection reset by peer" message
          • @metadata is missing in Logstash
          • Not sure whether to use Logstash or Beats
          • SSL client fails to connect to Logstash
          • Monitoring UI shows fewer Beats than expected
          • Dashboard could not locate the index-pattern
          • High RSS memory usage due to MADV settings
          • Not sure how to read from .evtx files
      • Contribute
    • Upgrade
    • Community Beats
    • Contribute
    • Elastic logging plugin for Docker
      • Install and configure
      • Configuration options
      • Usage examples
      • Known problems and limitations
  • Beats
    • Known issues
    • Breaking changes
    • Deprecations
  • Contribute to Beats
    • Pull request review guidelines
    • Contributing to the docs
    • Testing
    • Community Beats
      • Defining field mappings
      • Naming Conventions
      • Python in Beats
    • Creating New Kibana Dashboards
      • Importing Existing Beat Dashboards
      • Building Your Own Beat Dashboards
      • Generating the Beat Index Pattern
      • Exporting New and Modified Beat Dashboards
      • Archiving Your Beat Dashboards
      • Sharing Your Beat Dashboards
    • Adding a New Protocol to Packetbeat
      • Getting Ready
      • Protocol Modules
      • Testing
    • Extending Metricbeat
      • Overview
      • Creating a Metricset
      • Metricset Details
      • Creating a Metricbeat Module
      • Metricbeat Developer FAQ
    • Creating a New Filebeat Module
    • Migrating dashboards from Kibana 5.x to 6.x
  • View as Markdown
  • Report a docs issue
  • Edit this page
  • Learn how to contribute
Loading
  1. Filebeat /
  2. Troubleshoot

Common problems

This section describes common problems you might encounter with Filebeat. Also check out the Filebeat discussion forum.

Previous
Understand logged metrics
Next
Error extracting container id while using Kubernetes metadata
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.