instruction: How do you implement comprehensive microservices observability?
output: Run Filebeat on Kubernetes | Beats Docs Release notes Troubleshoot Reference Reference Get started Solutions and use cases Manage data Explore and analyze Deploy and manage Manage your Cloud account and preferences Troubleshoot Extend and contribute Release notes Reference Elasticsearch Configuration Circuit breaker settings Auditing settings Enrich settings Cluster-level shard allocation and routing settings Miscellaneous cluster settings Cross-cluster replication settings Discovery and cluster formation settings Field data cache settings Health Diagnostic settings Index lifecycle management settings Data stream lifecycle settings Index management settings Index recovery settings Indexing buffer settings License settings Local gateway Machine learning settings Inference settings Monitoring settings Node settings Networking settings Node query cache settings Search settings Security settings Shard request cache Snapshot and restore settings Transforms settings Thread pool settings Watcher settings JVM settings Roles Elasticsearch privileges Index settings Serverless index settings Better Binary Quantization (BBQ) General Shard allocation Data tier allocation Index recovery prioritization Total shards per node History retention Index blocks Mapping limit Merge Similarity Slow log Sorting Use index sorting to speed up conjunctions Store Preloading data into the file system cache Time series Source settings Translog Indexing pressure Path Index lifecycle actions Allocate Delete Force merge Migrate Read only Rollover Downsample Searchable snapshot Set priority Shrink Unfollow Wait for snapshot REST APIs API conventions Common options Compatibility Guides and examples Collapse search results Create index from source Filter search results Find text structure API examples Highlighting Optimistic concurrency control Paginate search results Query API key information Reciprocal rank fusion The refresh parameter Reindex data stream Reindex indices Retrieve inner hits Retrieve selected fields Retrieve stored fields Retrievers kNN retriever Linear retriever Pinned retriever Rescorer retriever RRF retriever Query rules retriever Standard retriever Text similarity re-ranker retriever Examples Search multiple data streams and indices Profile search requests Ranking evaluation Search shard routing Suggesters Sort search results Searching with query rules The shard request cache Term vectors API examples Update By Query API Update a document Update cross-cluster API examples Vector tile search API Mapping Document metadata fields _doc_count field _field_names field _ignored field _id field _index field _meta field _routing field _source field _tier field Field data types Aggregate metric Alias Arrays Binary Boolean Completion Date Date nanoseconds Dense vector Flattened Geopoint Geoshape Histogram IP Join Keyword Nested Numeric Object Pass-through object Percolator Point Range Rank feature Rank features Rank Vectors Search-as-you-type Semantic text Shape Sparse vector Text Token count Unsigned long Version Mapping parameters analyzer coerce copy_to doc_values dynamic eager_global_ordinals enabled format ignore_above ignore_above index setting ignore_malformed index index_options index_phrases index_prefixes meta fields normalizer norms null_value position_increment_gap properties search_analyzer similarity store subobjects term_vector Elasticsearch audit events Command line tools elasticsearch-certgen elasticsearch-certutil elasticsearch-create-enrollment-token elasticsearch-croneval elasticsearch-keystore elasticsearch-node elasticsearch-reconfigure-node elasticsearch-reset-password elasticsearch-saml-metadata elasticsearch-service-tokens elasticsearch-setup-passwords elasticsearch-shard elasticsearch-syskeygen elasticsearch-users Aggregations Bucket Adjacency matrix Auto-interval date histogram Categorize text Children Composite Date histogram Date range Diversified sampler Filter Filters Frequent item sets Geo-distance Geohash grid Geohex grid Geotile grid Global Histogram IP prefix IP range Missing Multi Terms Nested Parent Random sampler Range Rare terms Reverse nested Sampler Significant terms Significant text Terms Time series Variable width histogram Subtleties of bucketing range fields Metrics Avg Boxplot Cardinality Extended stats Geo-bounds Geo-centroid Geo-line Cartesian-bounds Cartesian-centroid Matrix stats Max Median absolute deviation Min Percentile ranks Percentiles Rate Scripted metric Stats String stats Sum T-test Top hits Top metrics Value count Weighted avg Pipeline Average bucket Bucket script Bucket count K-S test Bucket correlation Bucket selector Bucket sort Change point Cumulative cardinality Cumulative sum Derivative Extended stats bucket Inference bucket Max bucket Min bucket Moving function Moving percentiles Normalize Percentiles bucket Serial differencing Stats bucket Sum bucket Processor reference Append Attachment Bytes Circle Community ID Convert CSV Date Date index name Dissect Dot expander Drop Enrich Fail Fingerprint Foreach Geo-grid GeoIP Grok Gsub HTML strip Inference IP Location Join JSON KV Lowercase Network direction Normalize for Stream Pipeline Redact Registered domain Remove Rename Reroute Script Set Set security user Sort Split Terminate Trim Uppercase URL decode URI parts User agent Curator Curator and index lifecycle management ILM Actions ILM or Curator? ILM and Curator! About Origin Features Command-Line Interface (CLI) Application Program Interface (API) License Site Corrections Contributing Installation pip Installation from source Docker Running Curator Command Line Interface Singleton Command Line Interface Exit Codes Configuration Environment Variables Action File Configuration File Actions Alias Allocation Close Cluster Routing Cold2Frozen Create Index Delete Indices Delete Snapshots Forcemerge Index Settings Open Reindex Replicas Restore Rollover Shrink Snapshot Options allocation_type allow_ilm_indices continue_if_exception copy_aliases count delay delete_after delete_aliases skip_flush disable_action extra_settings ignore_empty_list ignore_unavailable include_aliases include_global_state indices key max_age max_docs max_size max_num_segments max_wait migration_prefix migration_suffix name new_index node_filters number_of_replicas number_of_shards partial post_allocation preserve_existing refresh remote_certificate remote_client_cert remote_client_key remote_filters remote_url_prefix rename_pattern rename_replacement repository requests_per_second request_body retry_count retry_interval routing_type search_pattern setting shrink_node shrink_prefix shrink_suffix slices skip_repo_fs_check timeout timeout_override value wait_for_active_shards wait_for_completion wait_for_rebalance wait_interval warn_if_no_indices Filters filtertype age alias allocated closed count empty forcemerged kibana none opened pattern period space state Filter Elements aliases allocation_type count date_from date_from_format date_to date_to_format direction disk_space epoch exclude field intersect key kind max_num_segments pattern period_type range_from range_to reverse source state stats_result timestring threshold_behavior unit unit_count unit_count_pattern use_age value week_starts_on Examples alias allocation close cluster_routing create_index delete_indices delete_snapshots forcemerge index_settings open reindex replicas restore rollover shrink snapshot Frequently Asked Questions Q: How can I report an error in the documentation? Q: Can I delete only certain data from within indices? Q: Can Curator handle index names with strange characters? Clients Eland Installation Data Frames Machine Learning Go Getting started Installation Connecting Typed API Getting started with the API Conventions Running queries Using ES|QL Examples Java Getting started Setup Installation Connecting Using OpenTelemetry API conventions Package structure and namespace clients Method naming conventions Blocking and asynchronous clients Building API objects Lists and maps Variant types Object life cycles and thread safety Creating API objects from JSON data Exceptions Using the Java API client Indexing single documents Bulk: indexing multiple documents Reading documents by id Searching for documents Aggregations ES|QL in the Java client Troubleshooting Missing required property NoSuchMethodError: removeHeader IOReactor errors Serializing without typed keys Could not resolve dependencies NoClassDefFoundError: LogFactory Transport layer REST 5 Client Getting started Initialization Performing requests Reading responses Logging Common configuration Timeouts Number of threads Basic authentication Other authentication methods Encrypted communication Others Node selector Sniffer Legacy REST Client Getting started Javadoc Maven Repository Dependencies Shading Initialization Performing requests Reading responses Logging Common configuration Timeouts Number of threads Basic authentication Other authentication methods Encrypted communication Others Node selector Sniffer Javadoc Maven Repository Usage Javadoc and source code External resources Breaking changes policy Release highlights License JavaScript Getting started Installation Connecting Configuration Basic configuration Advanced configuration Creating a child client Testing Integrations Observability Transport TypeScript support API Reference Examples asStream Bulk Exists Get Ignore MSearch Scroll Search Suggest transport.request SQL Update Update By Query Reindex Client helpers Timeout best practices .NET Getting started Installation Connecting Configuration Options on ElasticsearchClientSettings Client concepts Serialization Source serialization Using the .NET Client Aggregation examples Using ES|QL CRUD usage examples Custom mapping examples Query examples Usage recommendations Low level Transport example Troubleshoot Logging Logging with OnRequestCompleted Logging with Fiddler Debugging Audit trail Debug information Debug mode Breaking changes policy PHP Getting started Installation Connecting Configuration Dealing with JSON arrays and objects in PHP Host Configuration Set retries HTTP Meta Data Enabling the Logger Configure the HTTP client Namespaces Node Pool Operations Index management operations Search operations Indexing documents Getting documents Updating documents Deleting documents Client helpers Iterators ES|QL Python Getting started Installation Connecting Configuration Querying ES|QL Query Builder Using with asyncio Integrations Using OpenTelemetry ES|QL and Pandas Examples Elasticsearch Python DSL Configuration Tutorials How-To Guides Examples Migrating from the elasticsearch-dsl package Client helpers Ruby Getting started Installation Connecting Configuration Basic configuration Advanced configuration Integrations Transport Elasticsearch API Using OpenTelemetry Elastic Common Schema (ECS) ActiveModel / ActiveRecord Ruby On Rails Persistence Elasticsearch DSL Examples Client helpers Bulk and Scroll helpers ES|QL Troubleshoot Rust Installation Community-contributed clients Elasticsearch plugins Plugin management Installing plugins Custom URL or file system Installing multiple plugins Mandatory plugins Listing, removing and updating installed plugins Other command line parameters Plugins directory Manage plugins using a configuration file Upload custom plugins and bundles Managing plugins and extensions through the API API extension plugins Analysis plugins ICU analysis plugin ICU analyzer ICU normalization character filter ICU tokenizer ICU normalization token filter ICU folding token filter ICU collation token filter ICU collation keyword field ICU transform token filter Japanese (kuromoji) analysis plugin kuromoji analyzer kuromoji_iteration_mark character filter kuromoji_tokenizer kuromoji_baseform token filter kuromoji_part_of_speech token filter kuromoji_readingform token filter kuromoji_stemmer token filter ja_stop token filter kuromoji_number token filter hiragana_uppercase token filter katakana_uppercase token filter kuromoji_completion token filter Korean (nori) analysis plugin nori analyzer nori_tokenizer nori_part_of_speech token filter nori_readingform token filter nori_number token filter Phonetic analysis plugin phonetic token filter Smart Chinese analysis plugin Reimplementing and extending the analyzers smartcn_stop token filter Stempel Polish analysis plugin Reimplementing and extending the analyzers polish_stop token filter Ukrainian analysis plugin Discovery plugins EC2 Discovery plugin Using the EC2 discovery plugin Best Practices in AWS Azure Classic discovery plugin Azure Virtual Machine discovery Setup process for Azure Discovery Scaling out GCE Discovery plugin GCE Virtual Machine discovery GCE Network Host Setting up GCE Discovery Cloning your existing machine Using GCE zones Filtering by tags Changing default transport port GCE Tips Testing GCE Mapper plugins Mapper size plugin Using the _size field Mapper murmur3 plugin Using the murmur3 field Mapper annotated text plugin Using the annotated-text field Data modelling tips Using the annotated highlighter Limitations Snapshot/restore repository plugins Hadoop HDFS repository plugin Getting started with HDFS Configuration properties Hadoop security Store plugins Store SMB plugin Working around a bug in Windows SMB and Java on windows Integrations Security Fields and object schemas Elastic Security ECS field reference Timeline schema Alert schema Endpoint command reference Elastic Defend advanced settings Prebuilt detection rules reference Prebuilt detection rules reference Observability Fields and object schemas Elastic Distributions of OpenTelemetry (EDOT) Quickstart Self-managed Kubernetes Hosts / VMs Docker Elastic Cloud Serverless Kubernetes Hosts and VMs Docker Elastic Cloud Hosted Kubernetes Hosts and VMs Docker Reference Architecture Kubernetes environments Hosts / VMs environments Use cases Kubernetes observability Prerequisites and compatibility Components description Deployment Instrumenting Applications Upgrade Customization LLM observability Compatibility and support Features Collector distributions SDK Distributions EDOT compared to upstream OTel Limitations Nomenclature Data streams comparison EDOT Collector Download Deployment modes Configuration Default config (Standalone) Default config (Kubernetes) Configure Logs Collection Configure Metrics Collection Proxy settings Components Elastic APM intake receiver Customization Custom Collector EDOT Cloud Forwarder AWS EDOT SDKs EDOT Android Get started Configuration Manual instrumentation Automatic instrumentation EDOT .NET Setup ASP.NET Console applications .NET worker services Zero-code instrumentation Opinionated defaults Configuration Supported technologies Migration EDOT iOS Setup Supported technologies Instrumentations Configuration EDOT Java Setup Kubernetes Setup Runtime attach Setup Configuration Features Supported Technologies Migration Performance overhead EDOT Node.js Setup Kubernetes Configuration Supported Technologies Metrics Migration EDOT PHP Setup Limitations Configuration Supported Technologies Migration Performance overhead EDOT Python Setup Kubernetes Manual Instrumentation Configuration Supported Technologies Migration Performance Overhead Proxy settings Managed OTLP Endpoint Central configuration Ingestion tools Fleet and Elastic Agent Restrictions for Elastic Cloud Serverless Migrate from Beats to Elastic Agent Migrate from Auditbeat to Elastic Agent Deployment models What is Fleet Server? Deploy on Elastic Cloud Deploy on-premises and self-managed Deploy Fleet Server on-premises and Elasticsearch on Cloud Deploy Fleet Server on Kubernetes Fleet Server scalability Fleet Server Secrets Secret files guide Monitor a self-managed Fleet Server Install Elastic Agents Install Fleet-managed Elastic Agents Install standalone Elastic Agents Upgrade standalone Elastic Agents Install Elastic Agents in a containerized environment Run Elastic Agent in a container Run Elastic Agent on Kubernetes managed by Fleet Install Elastic Agent on Kubernetes using Helm Example: Install standalone Elastic Agent on Kubernetes using Helm Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm Advanced Elastic Agent configuration managed by Fleet Configuring Kubernetes metadata enrichment on Elastic Agent Run Elastic Agent on GKE managed by Fleet Configure Elastic Agent Add-On on Amazon EKS Run Elastic Agent on Azure AKS managed by Fleet Run Elastic Agent Standalone on Kubernetes Scaling Elastic Agent on Kubernetes Using a custom ingest pipeline with the Kubernetes Integration Environment variables Run Elastic Agent as an EDOT Collector Transform an installed Elastic Agent to run as an EDOT Collector Run Elastic Agent without administrative privileges Install Elastic Agent from an MSI package Installation layout Air-gapped environments Using a proxy server with Elastic Agent and Fleet When to configure proxy settings Proxy Server connectivity using default host variables Fleet managed Elastic Agent connectivity using a proxy server Standalone Elastic Agent connectivity using a proxy server Set the proxy URL of the Elastic Package Registry Uninstall Elastic Agents from edge hosts Start and stop Elastic Agents on edge hosts Elastic Agent configuration encryption Secure connections Configure SSL/TLS for self-managed Fleet Servers Rotate SSL/TLS CA certificates Elastic Agent deployment models with mutual TLS One-way and mutual TLS certifications flow Configure SSL/TLS for the Logstash output Manage Elastic Agents in Fleet Fleet settings Elasticsearch output settings Logstash output settings Kafka output settings Remote Elasticsearch output Automatic integrations synchronization Considerations when changing outputs Elastic Agents Unenroll Elastic Agents Set inactivity timeout Upgrade Elastic Agents Migrate Elastic Agents Monitor Elastic Agents Elastic Agent health status Add tags to filter the Agents list Enrollment handling for containerized agents Policies Create an agent policy without using the UI Enable custom settings in an agent policy Set environment variables in an Elastic Agent policy Roles and privileges Fleet enrollment tokens Kibana Fleet APIs Configure standalone Elastic Agents Create a standalone Elastic Agent policy Structure of a config file Inputs Simplified log ingestion Elastic Agent inputs Variables and conditions in input configurations Providers Local Agent provider Host provider Env Provider Filesource provider Kubernetes Secrets Provider Kubernetes LeaderElection Provider Local dynamic provider Docker Provider Kubernetes Provider Outputs Elasticsearch Kafka Logstash SSL/TLS Logging Feature flags Agent download Config file examples Apache HTTP Server Nginx HTTP Server Grant standalone Elastic Agents access to Elasticsearch Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx Example: Use standalone Elastic Agent with Elastic Cloud Hosted to monitor nginx Debug standalone Elastic Agents Kubernetes autodiscovery with Elastic Agent Conditions based autodiscover Hints annotations based autodiscover Monitoring Reference YAML Manage integrations Package signatures Add an integration to an Elastic Agent policy View integration policies Edit or delete an integration policy Install and uninstall integration assets View integration assets Set integration-level outputs Upgrade an integration Managed integrations content Best practices for integration assets Data streams Tutorials: Customize data retention policies Scenario 1 Scenario 2 Scenario 3 Scenario 4 Tutorial: Transform data with custom ingest pipelines Advanced data stream features Command reference Agent processors Processor syntax add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags community_id convert copy_fields decode_base64_field decode_cef decode_csv_fields decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields parse_aws_vpc_flow_log rate_limit registered_domain rename replace script syslog timestamp translate_sid truncate_fields urldecode APM APM settings APM settings for Elastic Cloud APM settings for Elastic Cloud Enterprise APM Attacher for Kubernetes Instrument and configure pods Add the helm repository to Helm Configure the webhook with a Helm values file Install the webhook with Helm Add a pod template annotation to each pod you want to auto-instrument Watch data flow into the Elastic Stack APM Architecture for AWS Lambda Performance impact and overhead Configuration options Using AWS Secrets Manager to manage APM authentication keys APM agents APM .NET agent Set up the APM .NET agent Profiler Auto instrumentation ASP.NET Core .NET Core and .NET 5&#x2B; ASP.NET Azure Functions Other .NET applications NuGet packages Entity Framework Core Entity Framework 6 Elasticsearch gRPC SqlClient StackExchange.Redis Azure Cosmos DB Azure Service Bus Azure Storage MongoDB Supported technologies Configuration Configuration on ASP.NET Core Configuration for Windows Services Configuration on ASP.NET Core configuration options Reporter configuration options HTTP configuration options Messaging configuration options Stacktrace configuration options Supportability configuration options All options summary Public API OpenTelemetry bridge Metrics Logs Serilog NLog Manual log correlation Performance tuning Upgrading APM Go agent Set up the APM Go Agent Built-in instrumentation modules Custom instrumentation Context propagation Supported technologies Configuration API documentation Metrics Logs Log correlation OpenTelemetry API OpenTracing API Contributing Upgrading APM Java agent Set up the APM Java Agent Manual setup with -javaagent flag Automatic setup with apm-agent-attach-cli.jar Programmatic API setup to self-attach SSL/TLS communication with APM Server Monitoring AWS Lambda Java Functions Supported technologies Configuration Circuit-Breaker Core Datastore HTTP Huge Traces JAX-RS JMX Logging Messaging Metrics Profiling Reporter Serverless Stacktrace Property file reference Tracing APIs Public API OpenTelemetry bridge OpenTracing bridge Plugin API Metrics Logs How to find slow methods Sampling-based profiler API/Code Annotations Configuration-based Overhead and performance tuning Frequently asked questions Community plugins Upgrading APM Node.js agent Set up the Agent Monitoring AWS Lambda Node.js Functions Monitoring Node.js Azure Functions Get started with Express Get started with Fastify Get started with hapi Get started with Koa Get started with Next.js Get started with Restify Get started with TypeScript Get started with a custom Node.js stack Starting the agent Supported technologies Configuration Configuring the agent Configuration options Custom transactions Custom spans API Reference Agent API Transaction API Span API Metrics Logs OpenTelemetry bridge OpenTracing bridge Source map support ECMAScript module support Distributed tracing Message queues Performance Tuning Upgrading Upgrade to v4.x Upgrade to v3.x Upgrade to v2.x Upgrade to v1.x APM PHP agent Set up the APM PHP Agent Supported technologies Configuration Configuration reference Public API APM Python agent Set up the APM Python Agent Django support Flask support Aiohttp Server support Tornado Support Starlette/FastAPI Support Sanic Support Monitoring AWS Lambda Python Functions Monitoring Azure Functions Wrapper Support ASGI Middleware Supported technologies Configuration Advanced topics Instrumenting custom code Sanitizing data How the Agent works Run Tests Locally API reference Metrics OpenTelemetry API Bridge Logs Performance tuning Upgrading Upgrading to version 6 of the agent Upgrading to version 5 of the agent Upgrading to version 4 of the agent APM Ruby agent Set up the APM Ruby agent Getting started with Rails Getting started with Rack Supported technologies Configuration Advanced topics Adding additional context Custom instrumentation API reference Metrics Logs OpenTracing API GraphQL Performance tuning Upgrading APM RUM JavaScript agent Set up the APM Real User Monitoring JavaScript Agent Install the Agent Configure CORS Supported technologies Configuration API reference Agent API Transaction API Span API Source maps Framework-specific integrations React integration Angular integration Vue integration Distributed tracing Breakdown metrics OpenTracing Advanced topics How to interpret long task spans in the UI Using with TypeScript Custom page load transaction names Custom Transactions Performance tuning Upgrading Beats Beats Config file format Namespacing Config file data types Environment variables Reference variables Config file ownership and permissions Command line arguments YAML tips and gotchas Auditbeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Repositories for APT and YUM Run Auditbeat on Docker Running Auditbeat on Kubernetes Auditbeat and systemd Start Auditbeat Stop Auditbeat Upgrade Auditbeat Configure Modules General settings Project paths Config file reloading Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Kibana endpoint Kibana dashboards Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_session_metadata add_tags append community_id convert copy_fields decode_base64_field decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now rate_limit registered_domain rename replace syslog translate_ldap_attribute translate_sid truncate_fields urldecode Internal queue Logging HTTP endpoint Regular expression support Instrumentation Feature flags auditbeat.reference.yml How to guides Load the Elasticsearch index template Change the index name Load Kibana dashboards Enrich events with geoIP information Parse data using an ingest pipeline Use environment variables in the configuration Avoid YAML formatting problems Modules Auditd Module File Integrity Module System Module System host dataset System login dataset System package dataset System process dataset System socket dataset System user dataset Exported fields Auditd fields Beat fields Cloud provider metadata fields Common fields Docker fields ECS fields File Integrity fields Host fields Jolokia Discovery autodiscover provider fields Kubernetes fields Process fields System fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Use Linux Secure Computing Mode (seccomp) Troubleshoot Get Help Debug Understand logged metrics Common problems Auditbeat fails to watch folders because too many files are open Auditbeat uses too much bandwidth Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected Dashboard could not locate the index-pattern High RSS memory usage due to MADV settings Contribute Filebeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Repositories for APT and YUM Run Filebeat on Docker Run Filebeat on Kubernetes Run Filebeat on Cloud Foundry Filebeat and systemd Start Filebeat Stop Filebeat Upgrade How Filebeat works Configure Inputs Multiline messages AWS CloudWatch AWS S3 Azure Event Hub Azure Blob Storage Benchmark CEL Cloud Foundry CometD Container Entity Analytics ETW filestream GCP Pub/Sub Google Cloud Storage HTTP Endpoint HTTP JSON journald Kafka Log MQTT NetFlow Office 365 Management Activity API Redis Salesforce Stdin Streaming Syslog TCP UDP Unified Logs Unix winlog Modules Override input settings General settings Project paths Config file loading Live reloading Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Kibana endpoint Kibana dashboards Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags append cache community_id convert copy_fields decode_base64_field decode_cef decode_csv_fields decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now parse_aws_vpc_flow_log rate_limit registered_domain rename replace script syslog timestamp translate_ldap_attribute translate_sid truncate_fields urldecode Autodiscover Hints based autodiscover Advanced usage Internal queue Logging HTTP endpoint Regular expression support Instrumentation Feature flags filebeat.reference.yml How to guides Override configuration settings Load the Elasticsearch index template Change the index name Load Kibana dashboards Load ingest pipelines Enrich events with geoIP information Deduplicate data Parse data using an ingest pipeline Use environment variables in the configuration Avoid YAML formatting problems Migrate log or container input configurations to filestream How to choose file identity for filestream Migrating from a Deprecated Filebeat Module Modules Modules ActiveMQ module Apache module Auditd module AWS module AWS Fargate module Azure module CEF module Check Point module Cisco module CoreDNS module CrowdStrike module Cyberark PAS module Elasticsearch module Envoyproxy Module Fortinet module Google Cloud module Google Workspace module HAproxy module IBM MQ module Icinga module IIS module Iptables module Juniper module Kafka module Kibana module Logstash module Microsoft module MISP module MongoDB module MSSQL module MySQL module MySQL Enterprise module NATS module NetFlow module Nginx module Office 365 module Okta module Oracle module Osquery module Palo Alto Networks module pensando module PostgreSQL module RabbitMQ module Redis module Salesforce module Set up the OAuth App in the Salesforce Santa module Snyk module Sophos module Suricata module System module Threat Intel module Traefik module Zeek (Bro) Module ZooKeeper module Zoom module Exported fields ActiveMQ fields Apache fields Auditd fields AWS fields AWS CloudWatch fields AWS Fargate fields Azure fields Beat fields Decode CEF processor fields fields CEF fields Checkpoint fields Cisco fields Cloud provider metadata fields Coredns fields Crowdstrike fields CyberArk PAS fields Docker fields ECS fields Elasticsearch fields Envoyproxy fields Fortinet fields Google Cloud Platform (GCP) fields google_workspace fields HAProxy fields Host fields ibmmq fields Icinga fields IIS fields iptables fields Jolokia Discovery autodiscover provider fields Juniper JUNOS fields Kafka fields kibana fields Kubernetes fields Log file content fields logstash fields Lumberjack fields Microsoft fields MISP fields mongodb fields mssql fields MySQL fields MySQL Enterprise fields NATS fields NetFlow fields Nginx fields Office 365 fields Okta fields Oracle fields Osquery fields panw fields Pensando fields PostgreSQL fields Process fields RabbitMQ fields Redis fields s3 fields Salesforce fields Google Santa fields Snyk fields sophos fields Suricata fields System fields threatintel fields Traefik fields Windows ETW fields Zeek fields ZooKeeper fields Zoom fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Use Linux Secure Computing Mode (seccomp) Troubleshoot Get help Debug Understand logged metrics Common problems Error extracting container id while using Kubernetes metadata Can&#x27;t read log files from network volumes Filebeat isn&#x27;t collecting lines from a file Too many open file handlers Registry file is too large Inode reuse causes Filebeat to skip lines Log rotation results in lost or duplicate events Open file handlers cause issues with Windows file rotation Filebeat is using too much CPU Dashboard in Kibana is breaking up data fields incorrectly Fields are not indexed or usable in Kibana visualizations Filebeat isn&#x27;t shipping the last line of a file Filebeat keeps open file handlers of deleted files for a long time Filebeat uses too much bandwidth Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected Dashboard could not locate the index-pattern High RSS memory usage due to MADV settings Contribute Heartbeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Repositories for APT and YUM Run Heartbeat on Docker Running Heartbeat on Kubernetes Heartbeat and systemd Stop Heartbeat Configure Monitors Common monitor options ICMP options TCP options HTTP options Task scheduler General settings Project paths Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags append community_id convert copy_fields decode_base64_field decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now rate_limit registered_domain rename replace script syslog translate_ldap_attribute translate_sid truncate_fields urldecode Autodiscover Hints based autodiscover Advanced usage Internal queue Logging HTTP endpoint Regular expression support Instrumentation Feature flags heartbeat.reference.yml How to guides Add observer and geo metadata Load the Elasticsearch index template Change the index name Enrich events with geoIP information Use environment variables in the configuration Parse data using an ingest pipeline Avoid YAML formatting problems Exported fields Beat fields Synthetics browser metrics fields Cloud provider metadata fields Common heartbeat monitor fields Docker fields ECS fields Host fields HTTP monitor fields ICMP fields Jolokia Discovery autodiscover provider fields Kubernetes fields Process fields Host lookup fields APM Service fields SOCKS5 proxy fields Monitor state fields Monitor summary fields Synthetics types fields TCP layer fields TLS encryption layer fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Use Linux Secure Computing Mode (seccomp) Troubleshoot Get help Debug Understand logged metrics Common problems Heartbeat uses too much bandwidth Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected High RSS memory usage due to MADV settings Contribute Metricbeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Repositories for APT and YUM Run Metricbeat on Docker Run Metricbeat on Kubernetes Run Metricbeat on Cloud Foundry Metricbeat and systemd Start Metricbeat Stop Metricbeat Upgrade Metricbeat How Metricbeat works Event structure Error event structure Key metricbeat features Configure Modules General settings Project paths Config file loading Live reloading Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Kibana endpoint Kibana dashboards Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags append community_id convert copy_fields decode_base64_field decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now rate_limit registered_domain rename replace script syslog translate_ldap_attribute translate_sid truncate_fields urldecode Autodiscover Hints based autodiscover Advanced usage Internal queue Logging HTTP endpoint Regular expression support Instrumentation Feature flags metricbeat.reference.yml How to guides Load the Elasticsearch index template Change the index name Load Kibana dashboards Enrich events with geoIP information Use environment variables in the configuration Parse data using an ingest pipeline Avoid YAML formatting problems Modules ActiveMQ module ActiveMQ broker metricset ActiveMQ queue metricset ActiveMQ topic metricset Aerospike module Aerospike namespace metricset Airflow module Airflow statsd metricset Apache module Apache status metricset AWS module AWS awshealth metricset AWS billing metricset AWS cloudwatch metricset AWS dynamodb metricset AWS ebs metricset AWS ec2 metricset AWS elb metricset AWS kinesis metricset AWS lambda metricset AWS natgateway metricset AWS rds metricset AWS s3_daily_storage metricset AWS s3_request metricset AWS sns metricset AWS sqs metricset AWS transitgateway metricset AWS usage metricset AWS vpn metricset AWS Fargate module AWS Fargate task_stats metricset Azure module Azure app_insights metricset Azure app_state metricset Azure billing metricset Azure compute_vm metricset Azure compute_vm_scaleset metricset Azure container_instance metricset Azure container_registry metricset Azure container_service metricset Azure database_account metricset Azure monitor metricset Azure storage metricset Beat module Beat state metricset Beat stats metricset Benchmark module Benchmark info metricset Ceph module Ceph cluster_disk metricset Ceph cluster_health metricset Ceph cluster_status metricset Ceph mgr_cluster_disk metricset Ceph mgr_cluster_health metricset Ceph mgr_osd_perf metricset Ceph mgr_osd_pool_stats metricset Ceph mgr_osd_tree metricset Ceph mgr_pool_disk metricset Ceph monitor_health metricset Ceph osd_df metricset Ceph osd_tree metricset Ceph pool_disk metricset Cloudfoundry module Cloudfoundry container metricset Cloudfoundry counter metricset Cloudfoundry value metricset CockroachDB module CockroachDB status metricset Consul module Consul agent metricset Containerd module Containerd blkio metricset Containerd cpu metricset Containerd memory metricset Coredns module Coredns stats metricset Couchbase module Couchbase bucket metricset Couchbase cluster metricset Couchbase node metricset CouchDB module CouchDB server metricset Docker module Docker container metricset Docker cpu metricset Docker diskio metricset Docker event metricset Docker healthcheck metricset Docker image metricset Docker info metricset Docker memory metricset Docker network metricset Docker network_summary metricset Dropwizard module Dropwizard collector metricset Elasticsearch module Elasticsearch ccr metricset Elasticsearch cluster_stats metricset Elasticsearch enrich metricset Elasticsearch index metricset Elasticsearch index_recovery metricset Elasticsearch index_summary metricset Elasticsearch ingest_pipeline metricset Elasticsearch ml_job metricset Elasticsearch node metricset Elasticsearch node_stats metricset Elasticsearch pending_tasks metricset Elasticsearch shard metricset Envoyproxy module Envoyproxy server metricset Etcd module Etcd leader metricset Etcd metrics metricset Etcd self metricset Etcd store metricset Google Cloud Platform module Google Cloud Platform billing metricset Google Cloud Platform carbon metricset Google Cloud Platform compute metricset Google Cloud Platform dataproc metricset Google Cloud Platform firestore metricset Google Cloud Platform gke metricset Google Cloud Platform loadbalancing metricset Google Cloud Platform metrics metricset Google Cloud Platform pubsub metricset Google Cloud Platform storage metricset Golang module Golang expvar metricset Golang heap metricset Graphite module Graphite server metricset HAProxy module HAProxy info metricset HAProxy stat metricset HTTP module HTTP json metricset HTTP server metricset IBM MQ module IBM MQ qmgr metricset IIS module IIS application_pool metricset IIS webserver metricset IIS website metricset Istio module Istio citadel metricset Istio galley metricset Istio istiod metricset Istio mesh metricset Istio mixer metricset Istio pilot metricset Istio proxy metricset Jolokia module Jolokia jmx metricset Kafka module Kafka broker metricset Kafka consumer metricset Kafka consumergroup metricset Kafka partition metricset Kafka producer metricset Kibana module Kibana cluster_actions metricset Kibana cluster_rules metricset Kibana node_actions metricset Kibana node_rules metricset Kibana stats metricset Kibana status metricset Kubernetes module Kubernetes apiserver metricset Kubernetes container metricset Kubernetes controllermanager metricset Kubernetes event metricset Kubernetes node metricset Kubernetes pod metricset Kubernetes proxy metricset Kubernetes scheduler metricset Kubernetes state_container metricset Kubernetes state_cronjob metricset Kubernetes state_daemonset metricset Kubernetes state_deployment metricset Kubernetes state_job metricset Kubernetes state_node metricset Kubernetes state_persistentvolumeclaim metricset Kubernetes state_pod metricset Kubernetes state_replicaset metricset Kubernetes state_resourcequota metricset Kubernetes state_service metricset Kubernetes state_statefulset metricset Kubernetes state_storageclass metricset Kubernetes system metricset Kubernetes volume metricset KVM module KVM dommemstat metricset KVM status metricset Linux module Linux conntrack metricset Linux iostat metricset Linux ksm metricset Linux memory metricset Linux pageinfo metricset Linux pressure metricset Linux rapl metricset Logstash module Logstash node metricset Logstash node_stats metricset Memcached module Memcached stats metricset Cisco Meraki module Cisco Meraki device_health metricset Cisco Meraki network_health metricset MongoDB module MongoDB collstats metricset MongoDB dbstats metricset MongoDB metrics metricset MongoDB replstatus metricset MongoDB status metricset MSSQL module MSSQL performance metricset MSSQL transaction_log metricset Munin module Munin node metricset MySQL module MySQL galera_status metricset galera status MetricSet MySQL performance metricset MySQL query metricset MySQL status metricset NATS module NATS connection metricset NATS connections metricset NATS JetStream metricset NATS route metricset NATS routes metricset NATS stats metricset NATS subscriptions metricset Nginx module Nginx stubstatus metricset openai module openai usage metricset Openmetrics module Openmetrics collector metricset Oracle module Oracle performance metricset Oracle sysmetric metricset Oracle tablespace metricset Panw module Panw interfaces metricset Panw routing metricset Panw system metricset Panw vpn metricset PHP_FPM module PHP_FPM pool metricset PHP_FPM process metricset PostgreSQL module PostgreSQL activity metricset PostgreSQL bgwriter metricset PostgreSQL database metricset PostgreSQL statement metricset Prometheus module Prometheus collector metricset Prometheus query metricset Prometheus remote_write metricset RabbitMQ module RabbitMQ connection metricset RabbitMQ exchange metricset RabbitMQ node metricset RabbitMQ queue metricset RabbitMQ shovel metricset Redis module Redis info metricset Redis key metricset Redis keyspace metricset Redis Enterprise module Redis Enterprise node metricset Redis Enterprise proxy metricset SQL module Host Setup SQL query metricset Stan module Stan channels metricset Stan stats metricset Stan subscriptions metricset Statsd module Metricsets Statsd server metricset SyncGateway module SyncGateway db metricset SyncGateway memory metricset SyncGateway replication metricset SyncGateway resources metricset System module System core metricset System cpu metricset System diskio metricset System entropy metricset System filesystem metricset System fsstat metricset System load metricset System memory metricset System network metricset System network_summary metricset System process metricset System process_summary metricset System raid metricset System service metricset System socket metricset System socket_summary metricset System uptime metricset System users metricset Tomcat module Tomcat cache metricset Tomcat memory metricset Tomcat requests metricset Tomcat threading metricset Traefik module Traefik health metricset uWSGI module uWSGI status metricset vSphere module vSphere cluster metricset vSphere datastore metricset vSphere datastorecluster metricset vSphere host metricset vSphere network metricset vSphere resourcepool metricset vSphere virtualmachine metricset Windows module Windows perfmon metricset Windows service metricset Windows wmi metricset ZooKeeper module ZooKeeper connection metricset ZooKeeper mntr metricset ZooKeeper server metricset Exported fields ActiveMQ fields Aerospike fields Airflow fields Apache fields AutoOps ES fields AWS fields AWS Fargate fields Azure fields Beat fields Beat fields Benchmark fields Ceph fields Cloud provider metadata fields Cloudfoundry fields CockroachDB fields Common fields Consul fields Containerd fields Coredns fields Couchbase fields CouchDB fields Docker fields Docker fields Dropwizard fields ECS fields Elasticsearch fields Envoyproxy fields Etcd fields Google Cloud Platform fields Golang fields Graphite fields HAProxy fields Host fields HTTP fields IBM MQ fields IIS fields Istio fields Jolokia fields Jolokia Discovery autodiscover provider fields Kafka fields Kibana fields Kubernetes fields Kubernetes fields KVM fields Linux fields Logstash fields Memcached fields Cisco Meraki fields MongoDB fields MSSQL fields Munin fields MySQL fields NATS fields Nginx fields openai fields Openmetrics fields Oracle fields Panw fields PHP_FPM fields PostgreSQL fields Process fields Prometheus fields Prometheus typed metrics fields RabbitMQ fields Redis fields Redis Enterprise fields SQL fields Stan fields Statsd fields SyncGateway fields System fields Tomcat fields Traefik fields uWSGI fields vSphere fields Windows fields ZooKeeper fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Use Linux Secure Computing Mode (seccomp) Troubleshoot Get help Debug Understand logged metrics Common problems open /compat/linux/proc: no such file or directory error on FreeBSD Metricbeat collects system metrics for interfaces you didn&#x27;t configure Metricbeat uses too much bandwidth Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected Dashboard could not locate the index-pattern High RSS memory usage due to MADV settings Contribute Packetbeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Repositories for APT and YUM Run Packetbeat on Docker Packetbeat and systemd Start Packetbeat Stop Packetbeat Upgrade Packetbeat Configure Traffic sniffing Network flows Protocols Common protocol options ICMP DNS HTTP AMQP Cassandra Memcache MySQL PgSQL Thrift MongoDB TLS Redis Processes General settings Project paths Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Kibana endpoint Kibana dashboards Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags append community_id convert copy_fields decode_base64_field decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now rate_limit registered_domain rename replace syslog translate_ldap_attribute translate_sid truncate_fields urldecode Internal queue Logging HTTP endpoint Protocol-Specific Metrics Instrumentation Feature flags packetbeat.reference.yml How to guides Load the Elasticsearch index template Change the index name Load Kibana dashboards Enrich events with geoIP information Load ingest pipelines Use environment variables in the configuration Parse data using an ingest pipeline Avoid YAML formatting problems Exported fields AMQP fields Beat fields Cassandra fields Cloud provider metadata fields Common fields DHCPv4 fields DNS fields Docker fields ECS fields Flow Event fields Host fields HTTP fields ICMP fields Jolokia Discovery autodiscover provider fields Kubernetes fields Memcache fields MongoDb fields MySQL fields NFS fields PostgreSQL fields Process fields Raw fields Redis fields SIP fields Thrift-RPC fields Detailed TLS fields Transaction Event fields Measurements (Transactions) fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Use Linux Secure Computing Mode (seccomp) Visualize Packetbeat data in Kibana Customize the Discover page Kibana queries and filters Troubleshoot Get help Debug Understand logged metrics Record a trace Common problems Dashboard in Kibana is breaking up data fields incorrectly Packetbeat doesn&#x27;t see any packets when using mirror ports Packetbeat Can&#x27;t capture traffic from Windows loopback interface Packetbeat is missing long running transactions Packetbeat isn&#x27;t capturing MySQL performance data Packetbeat uses too much bandwidth Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected Dashboard could not locate the index-pattern High RSS memory usage due to MADV settings Fields show up as nested JSON in Kibana Contribute Winlogbeat Quick start Installation script Set up and run Directory layout Secrets keystore Command reference Start Winlogbeat Stop Winlogbeat Upgrade Configure Winlogbeat General settings Project paths Output Elastic Cloud Hosted Elasticsearch Logstash Kafka Redis File Console Discard Change the output codec Kerberos SSL Index lifecycle management (ILM) Elasticsearch index template Kibana endpoint Kibana dashboards Processors Define processors add_cloud_metadata add_cloudfoundry_metadata add_docker_metadata add_fields add_host_metadata add_id add_kubernetes_metadata add_labels add_locale add_network_direction add_nomad_metadata add_observer_metadata add_process_metadata add_tags append community_id convert copy_fields decode_base64_field decode_duration decode_json_fields decode_xml decode_xml_wineventlog decompress_gzip_field detect_mime_type dissect dns drop_event drop_fields extract_array fingerprint include_fields move_fields now rate_limit registered_domain rename replace script syslog timestamp translate_ldap_attribute translate_sid truncate_fields urldecode Internal queue Logging HTTP endpoint Event Processing Metrics Instrumentation winlogbeat.reference.yml How to guides Enrich events with geoIP information Load the Elasticsearch index template Change the index name Load Kibana dashboards Load ingest pipelines Use environment variables in the configuration Parse data using an ingest pipeline Avoid YAML formatting problems Modules PowerShell Module Security Module Sysmon Module Exported fields Beat fields Cloud provider metadata fields Docker fields ECS fields Legacy Winlogbeat alias fields Host fields Jolokia Discovery autodiscover provider fields Kubernetes fields PowerShell module fields Process fields Security module fields Sysmon module fields Winlogbeat fields Monitor Use internal collection Settings for internal collection Use Metricbeat collection Secure Grant users access to secured resources Create a setup user Create a monitoring user Create a publishing user Create a reader user Learn more about privileges, roles, and users Grant access using API keys Secure communication with Elasticsearch Secure communication with Logstash Troubleshoot Get Help Debug Understand logged metrics Common problems Dashboard in Kibana is breaking up data fields incorrectly Bogus computer_name fields are reported in some events Error loading config file Found unexpected or unknown characters Logstash connection doesn&#x27;t work Publishing to Logstash fails with &quot;connection reset by peer&quot; message @metadata is missing in Logstash Not sure whether to use Logstash or Beats SSL client fails to connect to Logstash Monitoring UI shows fewer Beats than expected Dashboard could not locate the index-pattern High RSS memory usage due to MADV settings Not sure how to read from .evtx files Contribute Upgrade Community Beats Contribute Elastic logging plugin for Docker Install and configure Configuration options Usage examples Known problems and limitations Logstash Getting started with Logstash Installing Logstash Stashing Your First Event Parsing Logs with Logstash Stitching Together Multiple Input and Output Plugins How Logstash Works Execution Model ECS in Logstash Processing Details Setting up and running Logstash Logstash Directory Layout Logstash Configuration Files logstash.yml Secrets keystore for secure settings Running Logstash from the Command Line Running Logstash as a Service on Debian or RPM Running Logstash on Docker Configuring Logstash for Docker Running Logstash on Kubernetes Running Logstash on Windows Logging Shutting Down Logstash Upgrading Logstash Upgrading using package managers Upgrading using a direct download Upgrading between minor versions Creating a Logstash Pipeline Structure of a pipeline Accessing event data and fields Using environment variables Sending data to Elastic Cloud Hosted Logstash configuration examples Secure your connection Advanced Logstash configurations Multiple Pipelines Pipeline-to-pipeline communication Reloading the Config File Managing Multiline Events Glob Pattern Support Logstash-to-Logstash communications Logstash-to-Logstash: Lumberjack output to Beats input Logstash-to-Logstash: HTTP output to HTTP input Logstash-to-Logstash: Output to Input Managing Logstash Centralized Pipeline Management Configure Centralized Pipeline Management Using Logstash with Elastic integrations Working with Filebeat modules Use ingest pipelines for parsing Example: Set up Filebeat modules to work with Kafka and Logstash Working with Winlogbeat modules Queues and data resiliency Memory queue Persistent queues (PQ) Dead letter queues (DLQ) Transforming data Performing Core Operations Deserializing Data Extracting Fields and Wrangling Data Enriching Data with Lookups Deploying and scaling Logstash Managing GeoIP databases GeoIP Database Management Configure GeoIP Database Management Performance tuning Performance troubleshooting Tuning and profiling logstash pipeline performance Monitoring Logstash with Elastic Agent Collect monitoring data for dashboards Collect monitoring data for dashboards (Serverless ) Collect monitoring data for stack monitoring Monitoring Logstash (Legacy) Metricbeat collection Legacy collection (deprecated) Monitoring UI Pipeline Viewer UI Troubleshooting Monitoring Logstash with APIs Working with plugins Cross-plugin concepts and features Generating plugins Offline Plugin Management Private Gem Repositories Event API Tips and best practices JVM settings Logstash Plugins Integration plugins aws elastic_enterprise_search jdbc kafka logstash rabbitmq snmp Input plugins azure_event_hubs beats cloudwatch couchdb_changes dead_letter_queue elastic_agent elastic_serverless_forwarder elasticsearch exec file ganglia gelf generator github google_cloud_storage google_pubsub graphite heartbeat http http_poller imap irc java_generator java_stdin jdbc jms jmx kafka kinesis logstash log4j lumberjack meetup pipe puppet_facter rabbitmq redis relp rss s3 s3-sns-sqs salesforce snmp snmptrap sqlite sqs stdin stomp syslog tcp twitter udp unix varnishlog websocket wmi xmpp Output plugins boundary circonus cloudwatch csv datadog datadog_metrics dynatrace elastic_app_search elastic_workplace_search elasticsearch email exec file ganglia gelf google_bigquery google_cloud_storage google_pubsub graphite graphtastic http influxdb irc java_stdout juggernaut kafka librato logstash loggly lumberjack metriccatcher mongodb nagios nagios_nsca opentsdb pagerduty pipe rabbitmq redis redmine riak riemann s3 sink sns solr_http sqs statsd stdout stomp syslog tcp timber udp webhdfs websocket xmpp zabbix Filter plugins age aggregate alter bytes cidr cipher clone csv date de_dot dissect dns drop elapsed elastic_integration elasticsearch environment extractnumbers fingerprint geoip grok http i18n java_uuid jdbc_static jdbc_streaming json json_encode kv memcached metricize metrics mutate prune range ruby sleep split syslog_pri threats_classifier throttle tld translate truncate urldecode useragent uuid wurfl_device_detection xml Codec plugins avro cef cloudfront cloudtrail collectd csv dots edn edn_lines es_bulk fluent graphite gzip_lines jdots java_line java_plain json json_lines line msgpack multiline netflow nmap plain protobuf rubydebug Plugin value types Logstash Versioned Plugin Reference Integration plugins aws v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 elastic_enterprise_search v3.0.1 v3.0.0 v2.2.1 v2.2.0 v2.1.2 v2.1.1 v2.1.0 v2.0.0 jdbc v5.5.3 v5.5.2 v5.5.1 v5.5.0 v5.4.11 v5.4.10 v5.4.9 v5.4.8 v5.4.7 v5.4.6 v5.4.5 v5.4.4 v5.4.3 v5.4.2 v5.4.1 v5.4.0 v5.3.0 v5.2.6 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.10 v5.1.8 v5.1.7 v5.1.6 v5.1.5 v5.1.4 v5.1.3 v5.1.2 v5.1.1 v5.1.0 v5.0.7 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 kafka v11.6.3 v11.6.2 v11.6.1 v11.6.0 v11.5.4 v11.5.3 v11.5.2 v11.5.1 v11.5.0 v11.4.2 v11.4.1 v11.4.0 v11.3.4 v11.3.3 v11.3.2 v11.3.1 v11.3.0 v11.2.1 v11.2.0 v11.1.0 v11.0.0 v10.12.2 v10.12.1 v10.12.0 v10.11.0 v10.10.0 v10.9.0 v10.8.2 v10.8.1 v10.8.0 v10.7.7 v10.7.6 v10.7.5 v10.7.4 v10.7.3 v10.7.2 v10.7.1 v10.7.0 v10.6.0 v10.5.3 v10.5.2 v10.5.1 v10.5.0 v10.4.0 v10.3.0 v10.2.0 v10.1.0 v10.0.1 v10.0.0 logstash v1.0.3 v1.0.2 v1.0.1 v1.0.0 v0.0.5 v0.0.4 v0.0.3 v0.0.2 v0.0.1 rabbitmq v7.4.0 v7.3.3 v7.3.2 v7.3.1 v7.3.0 v7.2.0 v7.1.1 v7.1.0 v7.0.3 v7.0.2 v7.0.1 v7.0.0 snmp v4.0.6 v4.0.5 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 Input plugins azure_event_hubs v1.5.1 v1.5.0 v1.4.9 v1.4.8 v1.4.7 v1.4.6 v1.4.5 v1.4.4 v1.4.3 v1.4.2 v1.4.1 v1.4.0 v1.3.0 v1.2.3 v1.2.2 v1.2.1 v1.2.0 v1.1.4 v1.1.3 v1.1.2 v1.1.1 v1.1.0 v1.0.4 v1.0.3 v1.0.1 v1.0.0 beats v7.0.2 v7.0.1 v7.0.0 v6.9.3 v6.9.2 v6.9.1 v6.9.0 v6.8.4 v6.8.3 v6.8.2 v6.8.1 v6.8.0 v6.7.2 v6.7.1 v6.7.0 v6.6.4 v6.6.3 v6.6.2 v6.6.1 v6.6.0 v6.5.0 v6.4.4 v6.4.3 v6.4.1 v6.4.0 v6.3.1 v6.3.0 v6.2.6 v6.2.5 v6.2.4 v6.2.3 v6.2.2 v6.2.1 v6.2.0 v6.1.6 v6.1.5 v6.1.4 v6.1.3 v6.1.2 v6.1.1 v6.1.0 v6.0.14 v6.0.13 v6.0.12 v6.0.11 v6.0.10 v6.0.9 v6.0.8 v6.0.7 v6.0.6 v6.0.5 v6.0.4 v6.0.3 v6.0.2 v6.0.1 v6.0.0 v5.1.11 v5.1.10 v5.1.9 v5.1.8 v5.1.7 v5.1.6 v5.1.5 v5.1.4 v5.1.3 v5.1.0 v5.0.16 v5.0.15 v5.0.14 v5.0.13 v5.0.11 v5.0.10 v5.0.9 v5.0.8 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.0.5 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v3.1.32 v3.1.31 v3.1.30 v3.1.29 v3.1.28 v3.1.27 v3.1.26 v3.1.25 v3.1.24 v3.1.23 v3.1.22 v3.1.21 cloudwatch v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v2.2.4 v2.2.3 v2.2.2 v2.1.1 v2.1.0 v2.0.3 v2.0.2 v2.0.1 couchdb_changes v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 dead_letter_queue v2.0.0 v1.1.12 v1.1.11 v1.1.10 v1.1.9 v1.1.8 v1.1.7 v1.1.6 v1.1.5 v1.1.4 v1.1.2 v1.1.1 v1.1.0 v1.0.6 v1.0.5 v1.0.4 v1.0.3 drupal_dblog v2.0.7 v2.0.6 v2.0.5 elastic_agent elastic_serverless_forwarder v0.1.5 v0.1.4 v0.1.3 v0.1.2 v0.1.1 v0.1.0 elasticsearch v5.2.0 v5.1.0 v5.0.2 v5.0.0 v4.23.0 v4.22.0 v4.21.2 v4.21.1 v4.21.0 v4.20.5 v4.20.4 v4.20.3 v4.20.2 v4.20.1 v4.20.0 v4.19.1 v4.19.0 v4.18.0 v4.17.2 v4.17.1 v4.17.0 v4.16.0 v4.15.0 v4.14.0 v4.13.0 v4.12.3 v4.12.2 v4.12.1 v4.12.0 v4.11.0 v4.10.0 v4.9.3 v4.9.2 v4.9.1 v4.9.0 v4.8.1 v4.8.0 v4.7.1 v4.7.0 v4.6.2 v4.6.1 v4.6.0 v4.5.0 v4.4.0 v4.3.3 v4.3.2 v4.3.1 v4.3.0 v4.2.1 v4.2.0 v4.1.1 v4.1.0 v4.0.6 v4.0.5 v4.0.4 eventlog v4.1.3 v4.1.2 v4.1.1 exec v3.6.0 v3.4.0 v3.3.3 v3.3.2 v3.3.1 v3.3.0 v3.2.0 v3.1.5 v3.1.4 v3.1.3 file v4.4.6 v4.4.5 v4.4.4 v4.4.3 v4.4.2 v4.4.1 v4.4.0 v4.3.1 v4.3.0 v4.2.4 v4.2.3 v4.2.2 v4.2.1 v4.2.0 v4.1.18 v4.1.17 v4.1.16 v4.1.15 v4.1.14 v4.1.13 v4.1.12 v4.1.11 v4.1.10 v4.1.9 v4.1.8 v4.1.7 v4.1.6 v4.1.5 v4.1.4 v4.1.3 v4.1.2 v4.1.1 v4.1.0 v4.0.5 v4.0.3 v4.0.2 ganglia v3.1.4 v3.1.3 v3.1.2 v3.1.1 gelf v3.3.2 v3.3.1 v3.3.0 v3.2.0 v3.1.1 v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.4 gemfire v2.0.7 v2.0.6 v2.0.5 generator v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 github v3.0.11 v3.0.10 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 google_cloud_storage v0.15.0 v0.14.0 v0.13.0 v0.12.0 v0.11.1 v0.10.0 google_pubsub v1.4.0 v1.3.0 v1.2.2 v1.2.1 v1.2.0 v1.1.0 v1.0.6 v1.0.5 v1.0.4 v1.0.3 v1.0.1 graphite v3.0.6 v3.0.4 v3.0.3 heartbeat v3.1.1 v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 heroku v3.0.3 v3.0.2 v3.0.1 http v4.1.2 v4.1.1 v4.1.0 v4.0.0 v3.10.2 v3.10.1 v3.10.0 v3.9.2 v3.9.1 v3.9.0 v3.8.1 v3.8.0 v3.7.3 v3.7.2 v3.7.1 v3.7.0 v3.6.1 v3.6.0 v3.5.1 v3.5.0 v3.4.5 v3.4.4 v3.4.3 v3.4.2 v3.4.1 v3.4.0 v3.3.7 v3.3.6 v3.3.5 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.3.0 v3.2.4 v3.2.3 v3.2.2 v3.2.1 v3.2.0 v3.1.0 v3.0.10 v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 http_poller v6.0.0 v5.6.0 v5.5.1 v5.5.0 v5.4.0 v5.3.1 v5.3.0 v5.2.1 v5.2.0 v5.1.0 v5.0.2 v5.0.1 v5.0.0 v4.0.5 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.3.0 imap v3.2.1 v3.2.0 v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 irc v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 jdbc v5.5.3 v5.5.2 v5.5.1 v5.5.0 v5.4.11 v5.4.10 v5.4.9 v5.4.8 v5.4.7 v5.4.6 v5.4.5 v5.4.4 v5.4.3 v5.4.2 v5.4.1 v5.4.0 v5.3.0 v5.2.6 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.10 v5.1.8 v5.1.7 v5.1.6 v5.1.5 v5.1.4 v5.1.3 v5.1.2 v5.1.1 v5.1.0 v5.0.7 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.3.19 v4.3.18 v4.3.17 v4.3.16 v4.3.14 v4.3.13 v4.3.12 v4.3.11 v4.3.9 v4.3.8 v4.3.7 v4.3.6 v4.3.5 v4.3.4 v4.3.3 v4.3.2 v4.3.1 v4.3.0 v4.2.4 v4.2.3 v4.2.2 v4.2.1 jms v3.3.0 v3.2.2 v3.2.1 v3.2.0 v3.1.2 v3.1.1 v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.2 jmx v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.2 journald v2.0.2 v2.0.1 kafka v11.6.3 v11.6.2 v11.6.1 v11.6.0 v11.5.4 v11.5.3 v11.5.2 v11.5.1 v11.5.0 v11.4.2 v11.4.1 v11.4.0 v11.3.4 v11.3.3 v11.3.2 v11.3.1 v11.3.0 v11.2.1 v11.2.0 v11.1.0 v11.0.0 v10.12.2 v10.12.1 v10.12.0 v10.11.0 v10.10.0 v10.9.0 v10.8.2 v10.8.1 v10.8.0 v10.7.7 v10.7.6 v10.7.5 v10.7.4 v10.7.3 v10.7.2 v10.7.1 v10.7.0 v10.6.0 v10.5.3 v10.5.2 v10.5.1 v10.5.0 v10.4.0 v10.3.0 v10.2.0 v10.1.0 v10.0.1 v10.0.0 v9.1.0 v9.0.1 v9.0.0 v8.3.1 v8.3.0 v8.2.1 v8.2.0 v8.1.1 v8.1.0 v8.0.6 v8.0.4 v8.0.2 v8.0.0 v7.0.0 v6.3.4 v6.3.3 v6.3.2 v6.3.0 kinesis v2.3.0 v2.2.2 v2.2.1 v2.2.0 v2.1.2 v2.1.1 v2.1.0 v2.0.11 v2.0.10 v2.0.8 v2.0.7 v2.0.6 v2.0.5 v2.0.4 log4j v3.1.3 v3.1.2 v3.1.1 v3.1.0 v3.0.6 logstash v1.0.3 v1.0.2 v1.0.1 v1.0.0 v0.0.5 v0.0.4 v0.0.3 v0.0.2 v0.0.1 lumberjack v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 meetup v3.1.1 v3.1.0 v3.0.4 v3.0.3 v3.0.2 v3.0.1 neo4j v2.0.8 v2.0.6 v2.0.5 pipe v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.4 puppet_facter v3.0.4 v3.0.3 v3.0.2 v3.0.1 rabbitmq v7.4.0 v7.3.3 v7.3.2 v7.3.1 v7.3.0 v7.2.0 v7.1.1 v7.1.0 v7.0.3 v7.0.2 v7.0.1 v7.0.0 v6.0.4 v6.0.3 v6.0.2 v6.0.1 v6.0.0 v5.2.5 v5.2.4 rackspace v3.0.5 v3.0.4 v3.0.1 redis v3.7.1 v3.7.0 v3.6.1 v3.6.0 v3.5.1 v3.5.0 v3.4.1 v3.4.0 v3.2.2 v3.2.0 v3.1.6 v3.1.5 v3.1.4 v3.1.3 relp v3.0.4 v3.0.3 v3.0.2 v3.0.1 rss v3.0.5 v3.0.4 v3.0.3 v3.0.2 s3 v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v3.8.4 v3.8.3 v3.8.2 v3.8.1 v3.8.0 v3.7.0 v3.6.0 v3.5.0 v3.4.1 v3.4.0 v3.3.7 v3.3.6 v3.3.5 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.3.0 v3.2.0 v3.1.9 v3.1.8 v3.1.7 v3.1.6 v3.1.5 salesforce v3.2.1 v3.2.0 v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.3 v3.0.2 snmp v4.0.6 v4.0.5 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v1.3.3 v1.3.2 v1.3.1 v1.3.0 v1.2.8 v1.2.7 v1.2.6 v1.2.5 v1.2.4 v1.2.3 v1.2.2 v1.2.1 v1.2.0 v1.1.0 v1.0.1 v1.0.0 snmptrap v4.0.6 v4.0.5 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 sqlite v3.0.4 v3.0.3 v3.0.2 v3.0.1 sqs v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v3.3.2 v3.3.1 v3.3.0 v3.2.0 v3.1.3 v3.1.2 v3.1.1 v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 stdin v3.4.0 v3.3.0 v3.2.6 v3.2.5 v3.2.4 v3.2.3 stomp v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 syslog v3.7.1 v3.7.0 v3.6.0 v3.5.0 v3.4.5 v3.4.4 v3.4.3 v3.4.2 v3.4.1 v3.4.0 v3.3.0 v3.2.4 v3.2.3 v3.2.2 v3.2.1 tcp v7.0.2 v7.0.1 v7.0.0 v6.4.6 v6.4.5 v6.4.4 v6.4.3 v6.4.2 v6.4.1 v6.4.0 v6.3.5 v6.3.4 v6.3.3 v6.3.2 v6.3.1 v6.3.0 v6.2.7 v6.2.6 v6.2.5 v6.2.4 v6.2.3 v6.2.2 v6.2.1 v6.2.0 v6.1.1 v6.1.0 v6.0.10 v6.0.9 v6.0.8 v6.0.7 v6.0.6 v6.0.5 v6.0.4 v6.0.3 v6.0.2 v6.0.1 v6.0.0 v5.2.7 v5.2.6 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.0 v5.0.10 v5.0.9 v5.0.8 v5.0.7 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.2.4 v4.2.3 v4.2.2 v4.1.2 twitter v4.1.0 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 udp v3.5.0 v3.4.1 v3.4.0 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.3.0 v3.2.1 v3.2.0 v3.1.3 v3.1.2 v3.1.1 unix v3.1.2 v3.1.1 v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.4 varnishlog v3.0.4 v3.0.3 v3.0.2 v3.0.1 websocket v4.0.4 v4.0.3 v4.0.2 v4.0.1 wmi v3.0.4 v3.0.3 v3.0.2 v3.0.1 xmpp v3.1.7 v3.1.6 v3.1.5 v3.1.4 v3.1.3 zenoss v2.0.7 v2.0.6 v2.0.5 zeromq v3.0.5 v3.0.3 Output plugins appsearch v1.0.0.beta1 boundary v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.2 circonus v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.1 cloudwatch v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v3.1.0 v3.0.10 v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 csv v3.0.10 v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 datadog v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.1 datadog_metrics v3.0.6 v3.0.5 v3.0.4 v3.0.2 v3.0.1 elastic_app_search v3.0.1 v3.0.0 v2.2.1 v2.2.0 v2.1.2 v2.1.1 v2.1.0 v2.0.0 v1.2.0 v1.1.1 v1.1.0 v1.0.0 elastic_workplace_search v3.0.1 v3.0.0 v2.2.1 v2.2.0 v2.1.2 v2.1.1 v2.1.0 elasticsearch v12.0.5 v12.0.4 v12.0.3 v12.0.2 v12.0.1 v12.0.0 v11.22.12 v11.22.11 v11.22.10 v11.22.9 v11.22.8 v11.22.7 v11.22.6 v11.22.5 v11.22.4 v11.22.3 v11.22.2 v11.22.1 v11.22.0 v11.21.0 v11.20.1 v11.20.0 v11.19.0 v11.18.0 v11.17.0 v11.16.0 v11.15.9 v11.15.8 v11.15.7 v11.15.6 v11.15.5 v11.15.4 v11.15.2 v11.15.1 v11.15.0 v11.14.1 v11.14.0 v11.13.1 v11.13.0 v11.12.4 v11.12.3 v11.12.2 v11.12.1 v11.12.0 v11.11.0 v11.10.0 v11.9.3 v11.9.2 v11.9.1 v11.9.0 v11.8.0 v11.7.0 v11.6.0 v11.5.0 v11.4.2 v11.4.1 v11.4.0 v11.3.3 v11.3.2 v11.3.1 v11.3.0 v11.2.3 v11.2.2 v11.2.1 v11.2.0 v11.1.0 v11.0.5 v11.0.4 v11.0.3 v11.0.2 v11.0.1 v11.0.0 v10.8.6 v10.8.4 v10.8.3 v10.8.2 v10.8.1 v10.8.0 v10.7.3 v10.7.0 v10.6.2 v10.6.1 v10.6.0 v10.5.1 v10.5.0 v10.4.2 v10.4.1 v10.4.0 v10.3.3 v10.3.2 v10.3.1 v10.3.0 v10.2.3 v10.2.2 v10.2.1 v10.2.0 v10.1.0 v10.0.2 v10.0.1 elasticsearch_java v2.1.6 v2.1.4 email v4.1.3 v4.1.2 v4.1.1 v4.1.0 v4.0.6 v4.0.4 exec v3.1.4 v3.1.3 v3.1.2 v3.1.1 file v4.3.0 v4.2.6 v4.2.5 v4.2.4 v4.2.3 v4.2.2 v4.2.1 v4.2.0 v4.1.2 v4.1.1 v4.1.0 v4.0.2 ganglia v3.0.6 v3.0.5 v3.0.4 v3.0.3 gelf v3.1.7 v3.1.4 v3.1.3 gemfire v2.0.7 v2.0.6 v2.0.5 google_bigquery v4.6.0 v4.5.0 v4.4.0 v4.3.0 v4.2.0 v4.1.5 v4.1.4 v4.1.3 v4.1.2 v4.1.1 v4.1.0 v4.0.1 v4.0.0 v3.2.4 v3.2.3 v3.2.2 v3.2.1 google_cloud_storage v4.5.0 v4.4.0 v4.3.0 v4.2.0 v4.1.0 v4.0.1 v4.0.0 v3.3.0 v3.2.1 v3.2.0 v3.1.0 v3.0.5 v3.0.4 v3.0.3 google_pubsub v1.2.0 v1.1.0 v1.0.2 v1.0.1 v1.0.0 graphite v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 graphtastic v3.0.4 v3.0.3 v3.0.2 v3.0.1 hipchat v4.0.6 v4.0.5 v4.0.3 http v6.0.0 v5.7.1 v5.7.0 v5.6.1 v5.6.0 v5.5.0 v5.4.1 v5.4.0 v5.3.0 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.2 v5.1.1 v5.1.0 v5.0.1 v5.0.0 v4.4.0 v4.3.4 v4.3.2 v4.3.1 v4.3.0 influxdb v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 irc v3.0.6 v3.0.5 v3.0.4 v3.0.3 jira v3.0.5 v3.0.4 v3.0.3 v3.0.2 jms v3.0.5 v3.0.3 v3.0.1 juggernaut v3.0.6 v3.0.5 v3.0.4 v3.0.3 kafka v11.6.3 v11.6.2 v11.6.1 v11.6.0 v11.5.4 v11.5.3 v11.5.2 v11.5.1 v11.5.0 v11.4.2 v11.4.1 v11.4.0 v11.3.4 v11.3.3 v11.3.2 v11.3.1 v11.3.0 v11.2.1 v11.2.0 v11.1.0 v11.0.0 v10.12.2 v10.12.1 v10.12.0 v10.11.0 v10.10.0 v10.9.0 v10.8.2 v10.8.1 v10.8.0 v10.7.7 v10.7.6 v10.7.5 v10.7.4 v10.7.3 v10.7.2 v10.7.1 v10.7.0 v10.6.0 v10.5.3 v10.5.2 v10.5.1 v10.5.0 v10.4.0 v10.3.0 v10.2.0 v10.1.0 v10.0.1 v10.0.0 v8.1.0 v8.0.2 v8.0.1 v8.0.0 v7.3.2 v7.3.1 v7.3.0 v7.2.1 v7.2.0 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.10 v7.0.8 v7.0.7 v7.0.6 v7.0.4 v7.0.3 v7.0.1 v7.0.0 v6.2.4 v6.2.2 v6.2.1 v6.2.0 librato v3.0.6 v3.0.5 v3.0.4 v3.0.2 loggly v6.0.0 v5.0.0 v4.0.0 v3.0.5 v3.0.4 v3.0.3 v3.0.2 v3.0.1 logstash v1.0.3 v1.0.2 v1.0.1 v1.0.0 v0.0.5 v0.0.4 v0.0.3 v0.0.2 v0.0.1 lumberjack v3.1.9 v3.1.8 v3.1.7 v3.1.5 v3.1.3 metriccatcher v3.0.4 v3.0.3 v3.0.2 v3.0.1 monasca_log_api v2.0.1 v2.0.0 v1.0.4 v1.0.3 v1.0.2 mongodb v3.1.8 v3.1.7 v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 v3.1.1 nagios v3.0.6 v3.0.5 v3.0.4 v3.0.3 nagios_nsca v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 neo4j v2.0.5 null v3.0.5 v3.0.4 v3.0.3 opentsdb v3.1.5 v3.1.4 v3.1.3 v3.1.2 pagerduty v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 pipe v3.0.6 v3.0.5 v3.0.4 v3.0.3 rabbitmq v7.4.0 v7.3.3 v7.3.2 v7.3.1 v7.3.0 v7.2.0 v7.1.1 v7.1.0 v7.0.3 v7.0.2 v7.0.1 v7.0.0 v5.1.1 v5.1.0 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.0.11 v4.0.10 v4.0.9 v4.0.8 rackspace v2.0.8 v2.0.7 v2.0.5 redis v5.2.0 v5.0.0 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.0.5 v3.0.4 redmine v3.0.4 v3.0.3 v3.0.2 v3.0.1 riak v3.0.4 v3.0.3 v3.0.2 v3.0.1 riemann v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 v3.0.2 v3.0.1 s3 v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v4.4.1 v4.4.0 v4.3.7 v4.3.6 v4.3.5 v4.3.4 v4.3.3 v4.3.2 v4.3.1 v4.3.0 v4.2.0 v4.1.10 v4.1.9 v4.1.8 v4.1.7 v4.1.6 v4.1.5 v4.1.4 v4.1.3 v4.1.2 v4.1.1 v4.1.0 v4.0.13 v4.0.12 v4.0.11 v4.0.10 v4.0.9 v4.0.8 slack v2.2.0 v2.1.1 v2.1.0 v2.0.3 sns v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v4.0.8 v4.0.7 v4.0.6 v4.0.5 v4.0.4 solr_http v3.0.5 v3.0.4 v3.0.3 v3.0.2 sqs v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v6.0.0 v5.1.2 v5.1.1 v5.1.0 v5.0.2 v5.0.1 v5.0.0 v4.0.3 v4.0.2 statsd v3.2.0 v3.1.5 v3.1.4 v3.1.3 v3.1.2 stdout v3.1.4 v3.1.3 v3.1.2 v3.1.1 stomp v3.0.9 v3.0.8 v3.0.7 v3.0.5 syslog v3.0.5 v3.0.4 v3.0.3 v3.0.2 tcp v7.0.1 v7.0.0 v6.2.2 v6.2.1 v6.2.0 v6.1.2 v6.1.1 v6.1.0 v6.0.3 v6.0.2 v6.0.1 v6.0.0 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.0.2 v4.0.1 timber v1.0.3 udp v3.2.0 v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 webhdfs v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 websocket v3.1.0 v3.0.5 v3.0.4 v3.0.3 v3.0.2 xmpp v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 zabbix v3.0.5 v3.0.4 v3.0.3 v3.0.2 zeromq v3.1.3 v3.1.2 v3.1.1 Filter plugins age v1.0.3 v1.0.2 v1.0.1 aggregate v2.10.0 v2.9.2 v2.9.1 v2.9.0 v2.8.0 v2.7.2 v2.7.1 v2.7.0 v2.6.4 v2.6.3 v2.6.1 v2.6.0 alter v3.0.3 v3.0.2 v3.0.1 anonymize v3.0.7 v3.0.6 v3.0.5 v3.0.4 bytes v1.0.3 v1.0.2 v1.0.1 v1.0.0 checksum v3.0.4 v3.0.3 cidr v3.1.3 v3.1.2 v3.1.1 v3.0.1 cipher v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.0.1 v3.0.0 v2.0.7 v2.0.6 clone v4.2.0 v4.1.1 v4.1.0 v4.0.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 collate v2.0.6 v2.0.5 csv v3.1.1 v3.1.0 v3.0.10 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 date v3.1.15 v3.1.14 v3.1.13 v3.1.12 v3.1.11 v3.1.9 v3.1.8 v3.1.7 de_dot v1.1.0 v1.0.4 v1.0.3 v1.0.2 v1.0.1 dissect v1.2.5 v1.2.4 v1.2.3 v1.2.2 v1.2.1 v1.2.0 v1.1.4 v1.1.2 v1.1.1 v1.0.12 v1.0.11 v1.0.9 dns v3.2.0 v3.1.5 v3.1.4 v3.1.3 v3.1.2 v3.1.1 v3.1.0 v3.0.14 v3.0.13 v3.0.12 v3.0.11 v3.0.10 v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 drop v3.0.5 v3.0.4 v3.0.3 elapsed v4.1.0 v4.0.5 v4.0.4 v4.0.3 v4.0.2 elastic_integration v9.1.0 v9.0.1 v9.0.0 v8.19.0 v8.18.1 v8.18.0 v8.17.2 v8.17.1 v8.17.0 v8.16.1 v8.16.0 v0.1.17 v0.1.16 v0.1.15 v0.1.14 v0.1.13 v0.1.12 v0.1.11 v0.1.10 v0.1.9 v0.1.8 v0.1.7 v0.1.6 v0.1.5 v0.1.4 v0.1.3 v0.1.2 v0.1.0 v0.0.3 v0.0.2 v0.0.1 elasticsearch v4.2.0 v4.1.1 v4.1.0 v4.0.0 v3.18.0 v3.17.1 v3.17.0 v3.16.2 v3.16.1 v3.16.0 v3.15.3 v3.15.2 v3.15.1 v3.15.0 v3.14.0 v3.13.0 v3.12.0 v3.11.1 v3.11.0 v3.10.0 v3.9.5 v3.9.4 v3.9.3 v3.9.0 v3.8.0 v3.7.1 v3.7.0 v3.6.1 v3.6.0 v3.5.0 v3.4.0 v3.3.1 v3.3.0 v3.2.1 v3.2.0 v3.1.6 v3.1.5 v3.1.4 v3.1.3 emoji v1.0.2 v1.0.1 environment v3.0.3 v3.0.2 v3.0.1 extractnumbers v3.0.3 v3.0.2 v3.0.1 fingerprint v3.4.4 v3.4.3 v3.4.2 v3.4.1 v3.4.0 v3.3.2 v3.3.1 v3.3.0 v3.2.4 v3.2.3 v3.2.2 v3.2.1 v3.2.0 v3.1.2 v3.1.1 v3.1.0 v3.0.4 geoip v7.3.1 v7.3.0 v7.2.13 v7.2.12 v7.2.11 v7.2.10 v7.2.9 v7.2.8 v7.2.7 v7.2.6 v7.2.5 v7.2.4 v7.2.3 v7.2.2 v7.2.1 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v6.0.5 v6.0.3 v6.0.2 v6.0.1 v6.0.0 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.3.1 v4.3.0 v4.2.1 v4.2.0 v4.1.1 grok v4.4.3 v4.4.2 v4.4.1 v4.4.0 v4.3.0 v4.2.0 v4.1.1 v4.1.0 v4.0.4 v4.0.3 v4.0.2 v4.0.1 v4.0.0 v3.4.4 v3.4.3 v3.4.2 v3.4.1 hashid v0.1.4 v0.1.3 v0.1.2 http v2.0.0 v1.6.0 v1.5.1 v1.5.0 v1.4.3 v1.4.2 v1.4.1 v1.4.0 v1.3.0 v1.2.1 v1.2.0 v1.1.0 v1.0.2 v1.0.1 v1.0.0 v0.1.0 i18n v3.0.3 v3.0.2 v3.0.1 jdbc_static v5.5.3 v5.5.2 v5.5.1 v5.5.0 v5.4.11 v5.4.10 v5.4.9 v5.4.8 v5.4.7 v5.4.6 v5.4.5 v5.4.4 v5.4.3 v5.4.2 v5.4.1 v5.4.0 v5.3.0 v5.2.6 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.10 v5.1.8 v5.1.7 v5.1.6 v5.1.5 v5.1.4 v5.1.3 v5.1.2 v5.1.1 v5.1.0 v5.0.7 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v1.1.0 v1.0.7 v1.0.6 v1.0.5 v1.0.4 v1.0.3 v1.0.2 v1.0.1 v1.0.0 jdbc_streaming v5.5.3 v5.5.2 v5.5.1 v5.5.0 v5.4.11 v5.4.10 v5.4.9 v5.4.8 v5.4.7 v5.4.6 v5.4.5 v5.4.4 v5.4.3 v5.4.2 v5.4.1 v5.4.0 v5.3.0 v5.2.6 v5.2.5 v5.2.4 v5.2.3 v5.2.2 v5.2.1 v5.2.0 v5.1.10 v5.1.8 v5.1.7 v5.1.6 v5.1.5 v5.1.4 v5.1.3 v5.1.2 v5.1.1 v5.1.0 v5.0.7 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v1.0.10 v1.0.9 v1.0.7 v1.0.6 v1.0.5 v1.0.4 v1.0.3 v1.0.2 v1.0.1 json v3.2.1 v3.2.0 v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 json_encode v3.0.3 v3.0.2 v3.0.1 kv v4.7.0 v4.6.0 v4.5.0 v4.4.1 v4.4.0 v4.3.3 v4.3.2 v4.3.1 v4.3.0 v4.2.1 v4.2.0 v4.1.2 v4.1.1 v4.1.0 v4.0.3 v4.0.2 v4.0.1 math v1.1.1 v1.1.0 memcached v1.2.0 v1.1.0 v1.0.2 v1.0.1 v1.0.0 v0.1.2 v0.1.1 v0.1.0 metaevent v2.0.7 v2.0.5 metricize v3.0.3 v3.0.2 v3.0.1 metrics v4.0.7 v4.0.6 v4.0.5 v4.0.4 v4.0.3 multiline v3.0.4 v3.0.3 mutate v3.5.7 v3.5.6 v3.5.5 v3.5.4 v3.5.3 v3.5.2 v3.5.1 v3.5.0 v3.4.0 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.2.0 v3.1.7 v3.1.6 v3.1.5 oui v3.0.2 v3.0.1 prune v3.0.4 v3.0.3 v3.0.2 v3.0.1 punct v2.0.6 v2.0.5 range v3.0.3 v3.0.2 v3.0.1 ruby v3.1.8 v3.1.7 v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 v3.1.1 v3.1.0 v3.0.4 v3.0.3 sleep v3.0.7 v3.0.6 v3.0.5 v3.0.4 split v3.1.8 v3.1.7 v3.1.6 v3.1.5 v3.1.4 v3.1.3 v3.1.2 syslog_pri v3.2.1 v3.2.0 v3.1.1 v3.1.0 v3.0.5 v3.0.4 v3.0.3 throttle v4.0.4 v4.0.3 v4.0.2 tld v3.1.3 v3.1.2 v3.1.1 v3.1.0 v3.0.3 v3.0.2 v3.0.1 translate v3.4.2 v3.4.1 v3.4.0 v3.3.1 v3.3.0 v3.2.3 v3.2.2 v3.2.1 v3.2.0 v3.1.0 v3.0.4 v3.0.3 v3.0.2 truncate v1.0.6 v1.0.5 v1.0.4 v1.0.3 v1.0.2 unique v3.0.0 v2.0.6 v2.0.5 urldecode v3.0.6 v3.0.5 v3.0.4 useragent v3.3.5 v3.3.4 v3.3.3 v3.3.2 v3.3.1 v3.2.4 v3.2.3 v3.2.2 v3.2.1 v3.2.0 v3.1.3 v3.1.1 v3.1.0 uuid v3.0.5 v3.0.4 v3.0.3 xml v4.3.1 v4.3.0 v4.2.1 v4.2.0 v4.1.3 v4.1.2 v4.1.1 v4.1.0 v4.0.7 v4.0.6 v4.0.5 v4.0.4 v4.0.3 yaml v1.0.0 v0.1.1 zeromq v3.0.2 v3.0.1 Codec plugins avro v3.4.1 v3.4.0 v3.3.1 v3.3.0 v3.2.4 v3.2.3 v3.2.2 v3.2.1 v3.2.0 cef v6.2.8 v6.2.7 v6.2.6 v6.2.5 v6.2.4 v6.2.3 v6.2.2 v6.2.1 v6.2.0 v6.1.2 v6.1.1 v6.1.0 v6.0.1 v6.0.0 v5.0.6 v5.0.5 v5.0.4 v5.0.3 v5.0.2 v5.0.1 v5.0.0 v4.1.4 v4.1.3 cloudfront v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v3.0.3 v3.0.2 v3.0.1 cloudtrail v7.2.1 v7.2.0 v7.1.8 v7.1.7 v7.1.6 v7.1.5 v7.1.4 v7.1.3 v7.1.2 v7.1.1 v7.1.0 v7.0.1 v7.0.0 v3.0.5 v3.0.4 v3.0.3 v3.0.2 collectd v3.1.0 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 compress_spooler v2.0.6 v2.0.5 csv v1.1.0 v1.0.0 v0.1.4 v0.1.3 dots v3.0.6 v3.0.5 v3.0.3 edn v3.1.0 v3.0.6 v3.0.5 v3.0.3 edn_lines v3.1.0 v3.0.6 v3.0.5 v3.0.3 es_bulk v3.1.0 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 fluent v3.4.3 v3.4.2 v3.4.1 v3.4.0 v3.3.0 v3.2.0 v3.1.5 v3.1.4 v3.1.3 v3.1.2 graphite v3.0.6 v3.0.5 v3.0.4 v3.0.3 gzip_lines v3.0.4 v3.0.3 v3.0.2 v3.0.1 v3.0.0 json v3.1.1 v3.1.0 v3.0.5 v3.0.4 v3.0.3 json_lines v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 line v3.1.1 v3.1.0 v3.0.8 v3.0.7 v3.0.6 v3.0.5 v3.0.4 v3.0.3 msgpack v3.1.0 v3.0.7 v3.0.6 v3.0.5 v3.0.3 multiline v3.1.2 v3.1.1 v3.1.0 v3.0.11 v3.0.10 v3.0.9 v3.0.8 v3.0.7 v3.0.6 v3.0.5 netflow v4.3.2 v4.3.1 v4.3.0 v4.2.2 v4.2.1 v4.2.0 v4.1.2 v4.1.1 v4.1.0 v4.0.2 v4.0.1 v4.0.0 v3.14.1 v3.14.0 v3.13.2 v3.13.1 v3.13.0 v3.12.0 v3.11.4 v3.11.3 v3.11.2 v3.11.1 v3.11.0 v3.10.0 v3.9.1 v3.9.0 v3.8.3 v3.8.1 v3.8.0 v3.7.1 v3.7.0 v3.6.0 v3.5.2 v3.5.1 v3.5.0 v3.4.1 nmap v0.0.21 v0.0.20 v0.0.19 oldlogstashjson v2.0.7 v2.0.5 plain v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 protobuf v1.3.0 v1.2.9 v1.2.8 v1.2.5 v1.2.2 v1.2.1 v1.1.0 v1.0.5 v1.0.3 v1.0.2 rubydebug v3.1.0 v3.0.6 v3.0.5 v3.0.4 v3.0.3 s3plain v2.0.7 v2.0.6 v2.0.5 Elastic Serverless Forwarder for AWS Deploy serverless forwarder Configuration options Content connectors Connectors references Azure Blob Storage Box Confluence Dropbox GitHub Gmail Google Cloud Storage Google Drive GraphQL Jira Microsoft SQL MongoDB MySQL Network drive Notion OneDrive OpenText Documentum Oracle Outlook PostgreSQL Redis S3 Salesforce ServiceNow SharePoint Online SharePoint Server Slack Teams Zoom Self-managed connectors Running from a Docker container Running from the source code Docker Compose quickstart Tutorial Elastic managed connectors Build and customize connectors Connectors UI Connector APIs API tutorial Content syncs Extract and transform Content extraction Sync rules Document level security How DLS works DLS in Search Applications Management topics Scalability Security Troubleshooting Logs Use cases Internal knowledge search Known issues Release notes Elasticsearch for Apache Hadoop Setup and requirements Key features Requirements Installation Reference Architecture Configuration Runtime options Security Logging Map/Reduce integration Apache Hive integration Apache Spark support Mapping and types Error handlers Kerberos Hadoop metrics Performance considerations Cloud or restricted environments Resources License Elastic integrations Integrations quick reference 1Password Abnormal Security ActiveMQ Active Directory Entity Analytics Admin By Request EPM integration Airflow Akamai Apache Apache HTTP Server Apache metrics from OpenTelemetry Collector Apache Spark Apache Tomcat Tomcat NetWitness Logs API (custom) Arista NG Firewall Armis Atlassian Atlassian Bitbucket Atlassian Confluence Atlassian Jira Auditd Auditd Logs Auditd Manager Auth0 authentik AWS Amazon CloudFront AWS CUR 2.0 Billing Amazon DynamoDB Amazon EBS Amazon EC2 Amazon ECS Amazon EMR AWS API Gateway AWS Config Amazon GuardDuty AWS Health Amazon Kinesis Data Firehose Amazon Kinesis Data Stream Amazon MQ Amazon Managed Streaming for Apache Kafka (MSK) Amazon NAT Gateway Amazon RDS Amazon Redshift Amazon S3 Amazon S3 Storage Lens Amazon Security Lake Amazon SNS Amazon SQS Amazon VPC Amazon VPN AWS Bedrock AWS Billing AWS CloudTrail AWS CloudWatch AWS ELB AWS Fargate AWS Inspector AWS Lambda AWS Logs (custom) AWS Network Firewall AWS Route 53 AWS Security Hub AWS Transit Gateway AWS Usage AWS WAF Azure Activity logs App Service Application Gateway Application Insights metrics Application Insights metrics overview Application State Insights metrics Azure AI Foundry Integration Azure logs (v2 preview) Azure OpenAI Billing metrics Container instance metrics Container registry metrics Container service metrics Custom Azure Logs Custom Blob Storage Input Database Account metrics Event Hub input Firewall logs Frontdoor Functions Microsoft Entra ID Monitor metrics Network Watcher VNet Network Watcher NSG Platform logs Resource metrics Spring Cloud logs Storage Account metrics Virtual machines metrics Virtual machines scaleset metrics Barracuda Barracuda WAF CloudGen Firewall logs Beelzebub Integration BeyondInsight and Password Safe Integration BeyondTrust PRA BitDefender Bitwarden blacklens.io BBOT (Bighuge BLS OSINT Tool) Box Events Bravura Monitor Broadcom ProxySG Canva Cassandra CEL Custom API Ceph Check Point Check Point Email Check Point Harmony Endpoint Cilium Tetragon CISA Known Exploited Vulnerabilities Cisco Aironet ASA Duo FTD IOS ISE Meraki Nexus Secure Email Gateway Secure Endpoint Umbrella Cisco Meraki Metrics Citrix ADC Web App Firewall Claroty CTD Claroty xDome Cloudflare Cloudflare Cloudflare Logpush Cloud Asset Inventory CockroachDB Metrics Common Event Format (CEF) Containerd CoreDNS Corelight Couchbase CouchDB Cribl CrowdStrike CrowdStrike CrowdStrike Falcon Intelligence Cyberark CyberArk EPM Privileged Access Security Privileged Threat Analytics Cybereason CylanceProtect Logs Cyware Intel Exchange Custom Websocket logs Darktrace Data Exfiltration Detection DGA Digital Guardian Docker Docker OpenTelemetry Assets DomainTools Real Time Unified Feeds Elastic APM Elastic Fleet Server Elastic Security Elastic Defend Elastic Security Defend for Containers Prebuilt Security Detection Rules Security Posture Management Cloud Native Vulnerability Management (CNVM) Cloud Security Posture Management (CSPM) Kubernetes Security Posture Management (KSPM) Threat intelligence utilities Elastic Stack monitoring Beats Elasticsearch Elastic Agent Elastic Package Registry Kibana Logstash Elasticsearch Service Billing Endace Entro Envoy Proxy ESET PROTECT ESET Threat Intelligence etcd Falco F5 BIG-IP File Integrity Monitoring Filestream (custom) FireEye Network Security First EPSS Forcepoint Web Security ForgeRock Fortinet FortiEDR Logs FortiGate Firewall Logs FortiMail FortiManager Logs Fortinet FortiProxy Gigamon GitHub GitLab Golang Google Google Santa Google SecOps Google Threat Intelligence Google Workspace Google Cloud Custom GCS Input GCP GCP Audit logs GCP Billing metrics GCP Cloud Run metrics GCP CloudSQL metrics GCP Compute metrics GCP Dataproc metrics GCP DNS logs GCP Firestore metrics GCP Firewall logs GCP GKE metrics GCP Load Balancing metrics GCP Metrics Input GCP PubSub logs (custom) GCP PubSub metrics GCP Redis metrics GCP Security Command Center GCP Storage metrics GCP VPC Flow logs GCP Vertex AI GoFlow2 logs GreyNoise Hadoop HAProxy Hashicorp Vault Host Traffic Anomalies HPE Aruba CX HTTP Endpoint logs (custom) IBM MQ IIS Imperva Imperva Cloud WAF Imperva SecureSphere Logs InfluxDb Infoblox BloxOne DDI NIOS Threat Defense Iptables Istio Jamf Compliance Reporter Jamf Pro Jamf Protect Jolokia Input Journald logs (custom) JumpCloud Kafka Kafka Kafka Logs (custom) Keycloak Kubernetes Kubernetes API Server metrics Audit logs Container logs Controller Manager metrics Event metrics Kube-state metrics Kubelet metrics OpenTelemetry Assets Proxy metrics Scheduler metrics LastPass Lateral Movement Detection Linux Metrics Living off the Land Attack Detection Logs (custom) Lumos Lyve Cloud macOS Unified Logs (custom) Mattermost Memcached Menlo Security Microsoft Microsoft 365 Microsoft Defender for Cloud Microsoft Defender for Endpoint Microsoft DHCP Microsoft DNS Server Microsoft Entra ID Entity Analytics Microsoft Exchange Online Message Trace Microsoft Exchange Server Microsoft Graph Activity Logs Microsoft M365 Defender Microsoft Office 365 Metrics Integration Microsoft Sentinel Microsoft SQL Server Mimecast Miniflux integration ModSecurity Audit MongoDB MongoDB Atlas MySQL MySQL MySQL Enterprise MySQL metrics for OpenTelemetry Collector Nagios XI NATS NetFlow Records Netskope Network Beaconing Identification Network Packet Capture Nginx Nginx Nginx Ingress Controller Logs Nginx Ingress Controller OpenTelemetry Logs Nginx metrics from OpenTelemetry Collector Nozomi Networks Nvidia GPU Monitoring Okta Okta Okta Entity Analytics Oracle Oracle Oracle WebLogic OpenAI OpenCanary Osquery Osquery Logs Osquery Manager Palo Alto Cortex XDR Networks Metrics Next-Gen Firewall Prisma Cloud Prisma Access pfSense PHP-FPM PingOne PingFederate Pleasant Password Server PostgreSQL Privileged Access Detection Prometheus Prometheus Promethues Input Proofpoint Proofpoint TAP Proofpoint On Demand Proofpoint Insider Threat Management (ITM) Pulse Connect Secure Qualys Global AssetView (GAV) Qualys VMDR Qualys Web Application Scanning (WAS) QNAP NAS RabbitMQ Logs Rapid7 Rapid7 InsightVM Rapid7 Threat Command Redis Redis Redis Enterprise Rubrik RSC Metrics Integration Sailpoint Identity Security Cloud Salesforce Security AI Prompts SentinelOne SentinelOne SentinelOne Cloud Funnel ServiceNow Slack Logs Snort Snyk SonicWall Firewall Sophos Sophos Sophos Central Spring Boot Splunk SpyCloud Enterprise Protection SQL Input Squid Logs SRX STAN Statsd Input StormShield SNS Sublime Security Suricata Swimlane Turbine Symantec Endpoint Protection Symantec Endpoint Security Sysmon for Linux Sysdig Syslog Router Integration System System Audit System OpenTelemetry Assets Tanium TCP Logs (custom) Teleport Tenable Tenable.io Tenable.sc Tenable OT Security Tencent Cloud &#x96C6;&#x6210; Threat intelligence AbuseCH AlienVault OTX Anomali Collective Intelligence Framework Custom Threat Intelligence Cybersixgill EclecticIQ Maltiverse Mandiant Advantage MISP OpenCTI Recorded Future ThreatQuotient ThreatConnect Threat Map Thycotic Secret Server Tines Traefik Trellix Trellix EDR Cloud Trellix ePO Cloud Trend Micro Trend Micro Vision One TYCHON Agentless UDP Logs (custom) Universal Profiling Universal Profiling Agent Universal Profiling Collector Universal Profiling Symbolizer Varonis integration Vectra Detect Vectra RUX VMware Carbon Black Cloud Carbon Black EDR vSphere WatchGuard Firebox WebSphere Application Server Windows Windows Custom Windows ETW logs Windows Event Logs (custom) Wiz Zeek ZeroFox Zero Networks ZooKeeper Metrics Zoom Zscaler Zscaler Internet Access Zscaler Private Access Kibana Kibana Accessibility Statement (USA, Europe, and Beyond) Configuration Elastic Cloud Kibana settings General settings AI Assistant settings Alerting and action settings APM settings in Kibana Banners settings Cases settings Fleet settings i18n settings Logging settings Logs settings Map settings Metrics settings Monitoring settings Reporting settings Search sessions settings Security settings Spaces settings Task Manager settings Telemetry settings URL drilldown settings Product intercept settings Sharing settings Advanced settings Kibana audit events Connectors Amazon Bedrock Cases CrowdStrike D3 Security Elastic Managed LLM Email Google Gemini IBM Resilient Index Jira Microsoft Defender for Endpoint Microsoft Teams Observability AI Assistant OpenAI Opsgenie PagerDuty SentinelOne Server log ServiceNow ITSM ServiceNow SecOps ServiceNow ITOM Swimlane Slack TheHive Tines Torq Webhook Webhook - Case Management xMatters XSOAR Preconfigured connectors Kibana plugins Command line tools kibana-encryption-keys kibana-verification-code Osquery exported fields Osquery Manager prebuilt packs Query languages QueryDSL Query and filter context Compound queries Boolean Boosting Constant score Disjunction max Function score Full text queries Intervals Match Match boolean prefix Match phrase Match phrase prefix Combined fields Multi-match Query string Simple query string Geo queries Geo-bounding box Geo-distance Geo-grid Geo-polygon Geoshape Shape queries Shape Joining queries Nested Has child Has parent Parent ID Match all Span queries Span containing Span field masking Span first Span multi-term Span near Span not Span or Span term Span within Vector queries Knn Sparse vector Semantic Text expansion Weighted tokens Specialized queries Distance feature more_like_this Percolate Rank feature Script Script score Wrapper Pinned query Rule Term-level queries Exists Fuzzy IDs Prefix Range Regexp Term Terms Terms set Wildcard minimum_should_match parameter rewrite parameter Regular expression syntax ES|QL Syntax reference Basic syntax Commands Source commands FROM ROW SHOW Processing commands CHANGE_POINT COMPLETION DISSECT DROP ENRICH EVAL FORK GROK KEEP LIMIT LOOKUP JOIN MV_EXPAND RENAME RERANK SAMPLE SORT STATS WHERE Functions and operators Aggregation functions Grouping functions Conditional functions and expressions Date-time functions IP functions Math functions Search functions Spatial functions String functions Type conversion functions Multivalue functions Operators Advanced workflows Extract data with DISSECT and GROK Combine data with ENRICH Join data with LOOKUP JOIN Types and fields Implicit casting Time spans Metadata fields Multivalued fields Limitations Examples Troubleshooting Query log SQL SQL language Lexical structure SQL commands DESCRIBE TABLE SELECT SHOW CATALOGS SHOW COLUMNS SHOW FUNCTIONS SHOW TABLES Data types Index patterns Frozen indices Functions and operators Comparison operators Logical operators Math operators Cast operators LIKE and RLIKE operators Aggregate functions Grouping functions Date/time and interval functions and operators Full-text search functions Mathematical functions String functions Type conversion functions Geo functions Conditional functions and expressions System functions Reserved keywords SQL limitations EQL Syntax reference Function reference Pipe reference Kibana Query Language Scripting languages Painless A brief painless walkthrough Use painless scripts in runtime fields Using datetime in Painless How painless dispatches function Painless debugging Painless API examples Using ingest processors in Painless Painless language specification Comments Keywords Literals Identifiers Variables Types Casting Operators Operators: General Operators: Numeric Operators: Boolean Operators: Reference Operators: Array Statements Scripts Functions Lambdas Regexes Painless contexts Context example data Runtime fields context Ingest processor context Update context Update by query context Reindex context Sort context Similarity context Weight context Score context Field context Filter context Minimum should match context Metric aggregation initialization context Metric aggregation map context Metric aggregation combine context Metric aggregation reduce context Bucket script aggregation context Bucket selector aggregation context Analysis Predicate Context Watcher condition context Watcher transform context ECS reference Using ECS Getting started Guidelines and best practices Conventions Implementation patterns Mapping network events Design principles Custom fields ECS field reference Base fields Agent fields Autonomous System fields Client fields Cloud fields Cloud fields usage and examples Code Signature fields Container fields Data Stream fields Destination fields Device fields DLL fields DNS fields ECS fields ELF Header fields Email fields Error fields Event fields FaaS fields File fields Gen AI fields Geo fields Group fields Hash fields Host fields HTTP fields Interface fields Log fields Mach-O Header fields Network fields Observer fields Orchestrator fields Organization fields Operating System fields Package fields PE Header fields Process fields Registry fields Related fields Risk information fields Rule fields Server fields Service fields Service fields usage and examples Source fields Threat fields Threat fields usage and examples TLS fields Tracing fields URL fields User fields User fields usage and examples User agent fields VLAN fields Volume fields Vulnerability fields x509 Certificate fields ECS categorization fields event.kind event.category event.type event.outcome Using the categorization fields Migrating to ECS Products and solutions that support ECS Map custom data to ECS ECS &amp; OpenTelemetry OTel Alignment Overview Field &amp; Attributes Alignment Additional information Questions and answers Contributing to ECS Generated artifacts Release notes ECS logging libraries ECS Logging .NET Get started .NET model of ECS Usage A note on the Metadata property Extending EcsDocument Formatters Serilog formatter NLog layout log4net Data shippers Elasticsearch security ECS ingest channels Elastic.Serilog.Sinks Elastic.Extensions.Logging BenchmarkDotnet exporter Enrichers APM serilog enricher APM NLog layout ECS Logging Go (Logrus) Get started ECS Logging Go (Zap) Get started ECS Logging Go (Zerolog) Get started ECS Logging Java Get started Structured logging with log4j2 ECS Logging Node.js ECS Logging with Pino ECS Logging with Winston ECS Logging with Morgan ECS Logging PHP Get started ECS Logging Python Installation ECS Logging Ruby Get started Data analysis Supplied configurations Apache anomaly detection configurations APM anomaly detection configurations Auditbeat anomaly detection configurations Logs anomaly detection configurations Metricbeat anomaly detection configurations Metrics anomaly detection configurations Nginx anomaly detection configurations Security anomaly detection configurations Uptime anomaly detection configurations Function reference Count functions Geographic functions Information content functions Metric functions Rare functions Sum functions Time functions Metrics reference Host metrics Container metrics Kubernetes pod metrics AWS metrics Canvas function reference TinyMath functions Text analysis components Analyzer reference Fingerprint Keyword Language Pattern Simple Standard Stop Whitespace Tokenizer reference Character group Classic Edge n-gram Keyword Letter Lowercase N-gram Path hierarchy Pattern Simple pattern Simple pattern split Standard Thai UAX URL email Whitespace Token filter reference Apostrophe ASCII folding CJK bigram CJK width Classic Common grams Conditional Decimal digit Delimited payload Dictionary decompounder Edge n-gram Elision Fingerprint Flatten graph Hunspell Hyphenation decompounder Keep types Keep words Keyword marker Keyword repeat KStem Length Limit token count Lowercase MinHash Multiplexer N-gram Normalization Pattern capture Pattern replace Phonetic Porter stem Predicate script Remove duplicates Reverse Shingle Snowball Stemmer Stemmer override Stop Synonym Synonym graph Trim Truncate Unique Uppercase Word delimiter Word delimiter graph Character filter reference HTML strip Mapping Pattern replace Normalizers Search UI Ecommerce Autocomplete Product Carousels Category Page Product Detail Page Search Page Tutorials Search UI with Elasticsearch Setup Elasticsearch Setup an Index Install Connector Configure and Run Search UI Using in Production Customise Request Search UI with App Search Search UI with Workplace Search Basic usage Using search-as-you-type Adding search bar to header Debugging Advanced usage Conditional Facets Changing component behavior Analyzing performance Creating Components Building a custom connector NextJS Integration API reference Core API Configuration State Actions React API WithSearch &amp; withSearch useSearch hook React components Results Result ResultsPerPage Facet Sorting Paging PagingInfo ErrorBoundary Connectors API Elasticsearch Connector Site Search Connector Workplace Search Connector Plugins Troubleshooting Cloud Elastic Cloud Enterprise RESTful API API calls How to access the API Access the API using Elastic Cloud Control Access the API from the command line Access the API using a REST application Access the API using the Elastic Cloud Terraform provider Create an API client API examples Setting up your environment A first API call: What deployments are there? Create your first deployment: Elasticsearch and Kibana Applying a new plan: Resize and add high availability Updating a deployment: Checking on progress Applying a new deployment configuration: Upgrade Enable more stack features: Add Enterprise Search to a deployment Dipping a toe into platform automation: Generate a roles token Customize your deployment Remove unwanted deployment templates and instance configurations Secure your settings Changes to index allocation and API Scripts elastic-cloud-enterprise.sh install elastic-cloud-enterprise.sh upgrade elastic-cloud-enterprise.sh reset-adminconsole-password elastic-cloud-enterprise.sh add-stack-version Third party dependencies Elastic Cloud Hosted Hardware GCP instance VM configurations Selecting the right configuration for you GCP default provider Regional availability AWS VM configurations VM configurations (FedRAMP Moderate Authorized) Selecting the right configuration for you AWS default Regional availability Azure VM configurations Selecting the right configuration for you Azure default Regional availability Regions Available regions, deployment templates, and instance configurations RESTful API Principles Rate limiting Work with Elastic APIs Access the Elasticsearch API console How to access the API Access the API using Elastic Cloud Control Access the API from the command line Access the API using a REST application Access the API using the Elastic Cloud Terraform provider API examples Deployment CRUD operations Other deployment operations Organization operations Changes to index allocation and API Elastic Cloud on Kubernetes API Reference (moved) API Reference 3.1.0 current 3.0.0 Third-party dependencies 3.1.0 current 3.0.0 ECK configuration flags Elasticsearch upgrade predicates Elastic cloud control (ECCTL) Installing Configuring Authentication Example: A shared configuration file Environment variables Multiple configuration files Output format Custom formatting Usage examples List deployments Create a deployment Update a deployment Delete a deployment Command reference ecctl ecctl auth ecctl auth key ecctl auth key create ecctl auth key delete ecctl auth key list ecctl auth key show ecctl comment ecctl comment create ecctl comment delete ecctl comment list ecctl comment show ecctl comment update ecctl deployment ecctl deployment create ecctl deployment delete ecctl deployment elasticsearch ecctl deployment elasticsearch keystore ecctl deployment elasticsearch keystore show ecctl deployment elasticsearch keystore update ecctl deployment extension ecctl deployment extension create ecctl deployment extension delete ecctl deployment extension list ecctl deployment extension show ecctl deployment extension update ecctl deployment list ecctl deployment plan ecctl deployment plan cancel ecctl deployment resource ecctl deployment resource delete ecctl deployment resource restore ecctl deployment resource shutdown ecctl deployment resource start-maintenance ecctl deployment resource start ecctl deployment resource stop-maintenance ecctl deployment resource stop ecctl deployment resource upgrade ecctl deployment restore ecctl deployment resync ecctl deployment search ecctl deployment show ecctl deployment shutdown ecctl deployment template ecctl deployment template create ecctl deployment template delete ecctl deployment template list ecctl deployment template show ecctl deployment template update ecctl deployment traffic-filter ecctl deployment traffic-filter association ecctl deployment traffic-filter association create ecctl deployment traffic-filter association delete ecctl deployment traffic-filter create ecctl deployment traffic-filter delete ecctl deployment traffic-filter list ecctl deployment traffic-filter show ecctl deployment traffic-filter update ecctl deployment update ecctl generate ecctl generate completions ecctl generate docs ecctl init ecctl platform ecctl platform allocator ecctl platform allocator list ecctl platform allocator maintenance ecctl platform allocator metadata ecctl platform allocator metadata delete ecctl platform allocator metadata set ecctl platform allocator metadata show ecctl platform allocator search ecctl platform allocator show ecctl platform allocator vacate ecctl platform constructor ecctl platform constructor list ecctl platform constructor maintenance ecctl platform constructor resync ecctl platform constructor show ecctl platform enrollment-token ecctl platform enrollment-token create ecctl platform enrollment-token delete ecctl platform enrollment-token list ecctl platform info ecctl platform instance-configuration ecctl platform instance-configuration create ecctl platform instance-configuration delete ecctl platform instance-configuration list ecctl platform instance-configuration pull ecctl platform instance-configuration show ecctl platform instance-configuration update ecctl platform proxy ecctl platform proxy filtered-group ecctl platform proxy filtered-group create ecctl platform proxy filtered-group delete ecctl platform proxy filtered-group list ecctl platform proxy filtered-group show ecctl platform proxy filtered-group update ecctl platform proxy list ecctl platform proxy settings ecctl platform proxy settings show ecctl platform proxy settings update ecctl platform proxy show ecctl platform repository ecctl platform repository create ecctl platform repository delete ecctl platform repository list ecctl platform repository show ecctl platform role ecctl platform role create ecctl platform role delete ecctl platform role list ecctl platform role show ecctl platform role update ecctl platform runner ecctl platform runner list ecctl platform runner resync ecctl platform runner search ecctl platform runner show ecctl stack ecctl stack delete ecctl stack list ecctl stack show ecctl stack upload ecctl user ecctl user create ecctl user delete ecctl user disable ecctl user enable ecctl user key ecctl user key delete ecctl user key list ecctl user key show ecctl user list ecctl user show ecctl user update ecctl version Contributing Release notes Glossary View as markdown Edit this page Report an issue On this page Kubernetes deploy manifests for Filebeat Settings Running Filebeat on control plane nodes Red Hat OpenShift configuration Load Kibana dashboards Deploy Parsing json logs Logrotation Loading Elastic Docs / … / Filebeat / Set up and run / Run Filebeat on Kubernetes Stack You can use Filebeat Docker images on Kubernetes to retrieve and ship container logs. Tip Running Elastic Cloud on Kubernetes? See Run Beats on ECK . Kubernetes deploy manifests for Filebeat You deploy Filebeat as a DaemonSet to ensure there’s a running instance on each node of the cluster. The container logs host folder ( /var/log/containers ) is mounted on the Filebeat container. Filebeat starts an input for the files and begins harvesting them as soon as they appear in the folder. Everything is deployed under the kube-system namespace by default. To change the namespace, modify the manifest file. To download the manifest file, run: curl -L -O https://raw.githubusercontent.com/elastic/beats/9.1/deploy/kubernetes/filebeat-kubernetes.yaml Warning If you are using Kubernetes 1.7 or earlier: Filebeat uses a hostPath volume to persist internal data. It’s located under /var/lib/filebeat-data . The manifest uses folder autocreation ( DirectoryOrCreate ), which was introduced in Kubernetes 1.8. You need to remove type: DirectoryOrCreate from the manifest and create the host folder yourself. Settings By default, Filebeat sends events to an existing Elasticsearch deployment, if present. To specify a different destination, change the following parameters in the manifest file: - name: ELASTICSEARCH_HOST value: elasticsearch - name: ELASTICSEARCH_PORT value: &quot;9200&quot; - name: ELASTICSEARCH_USERNAME value: elastic - name: ELASTICSEARCH_PASSWORD value: changeme Running Filebeat on control plane nodes Kubernetes control plane nodes can use taints to limit the workloads that can run on them. To run Filebeat on control plane nodes you may need to update the Daemonset spec to include proper tolerations: spec: tolerations: - key: node-role.kubernetes.io/control-plane effect: NoSchedule Red Hat OpenShift configuration If you are using Red Hat OpenShift, you need to specify additional settings in the manifest file and enable the container to run as privileged. Filebeat needs to run as a privileged container to mount logs written on the node (hostPath) and read them. Modify the DaemonSet container spec in the manifest file: securityContext: runAsUser: 0 privileged: true Grant the filebeat service account access to the privileged SCC: oc adm policy add-scc-to-user privileged system:serviceaccount:kube-system:filebeat This command enables the container to be privileged as an administrator for OpenShift. Override the default node selector for the kube-system namespace (or your custom namespace) to allow for scheduling on any node: oc patch namespace kube-system -p \ '{&quot;metadata&quot;: {&quot;annotations&quot;: {&quot;openshift.io/node-selector&quot;: &quot;&quot;}}}' This command sets the node selector for the project to an empty string. If you don’t run this command, the default node selector will skip control plane nodes. In order to support runtime environments with Openshift (eg. CRI-O, containerd) you need to configure following path: filebeat.inputs: - type: container paths: - '/var/log/containers/*.log' Same path needs to be configured in case autodiscovery needs to be enabled: filebeat.autodiscover: providers: - type: kubernetes node: ${NODE_NAME} hints.enabled: true hints.default_config: type: container paths: - /var/log/containers/*.log Note /var/log/containers/\*.log is normally a symlink to /var/log/pods/*/*.log , so above paths can be edited accordingly Load Kibana dashboards Filebeat comes packaged with various pre-built Kibana dashboards that you can use to visualize logs from your Kubernetes environment. If these dashboards are not already loaded into Kibana, you must install Filebeat on any system that can connect to the Elastic Stack, and then run the setup command to load the dashboards. To learn how, see Load Kibana dashboards . The setup command does not load the ingest pipelines used to parse log lines. By default, ingest pipelines are set up automatically the first time you run Filebeat and connect to Elasticsearch. Important If you are using a different output other than Elasticsearch, such as Logstash, you need to: Load the index template manually Load Kibana dashboards Load ingest pipelines Deploy To deploy Filebeat to Kubernetes, run: kubectl create -f filebeat-kubernetes.yaml To check the status, run: $ kubectl --namespace=kube-system get ds/filebeat NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE-SELECTOR AGE filebeat 32 32 0 32 0 &lt;none&gt; 1m Log events should start flowing to Elasticsearch. The events are annotated with metadata added by the add_kubernetes_metadata processor. Parsing json logs It is common case when collecting logs from workloads running on Kubernetes that these applications are logging in json format. In these case, special handling can be applied so as to parse these json logs properly and decode them into fields. Bellow there are provided 2 different ways of configuring filebeat’s autodiscover so as to identify and parse json logs. We will use an example of one Pod with 2 containers where only one of these logs in json format. Example log: {&quot;type&quot;:&quot;log&quot;,&quot;@timestamp&quot;:&quot;2020-11-16T14:30:13+00:00&quot;,&quot;tags&quot;:[&quot;warning&quot;,&quot;plugins&quot;,&quot;licensing&quot;],&quot;pid&quot;:7,&quot;message&quot;:&quot;License information could not be obtained from Elasticsearch due to Error: No Living connections error&quot;} Using json.* options with templates filebeat.autodiscover: providers: - type: kubernetes node: ${NODE_NAME} templates: - condition: contains: kubernetes.container.name: &quot;no-json-logging&quot; config: - type: container paths: - &quot;/var/log/containers/*-${data.kubernetes.container.id}.log&quot; - condition: contains: kubernetes.container.name: &quot;json-logging&quot; config: - type: container paths: - &quot;/var/log/containers/*-${data.kubernetes.container.id}.log&quot; json.keys_under_root: true json.add_error_key: true json.message_key: message Using json.* options with hints Key part here is to properly annotate the Pod to only parse logs of the correct container as json logs. In this, annotation should be constructed like this: co.elastic.logs.&lt;container_name&gt;/json.keys_under_root: &quot;true&quot; Autodiscovery configuration: filebeat.autodiscover: providers: - type: kubernetes node: ${NODE_NAME} hints.enabled: true hints.default_config: type: container paths: - /var/log/containers/*${data.kubernetes.container.id}.log Then annotate the pod properly: annotations: co.elastic.logs.json-logging/json.keys_under_root: &quot;true&quot; co.elastic.logs.json-logging/json.add_error_key: &quot;true&quot; co.elastic.logs.json-logging/json.message_key: &quot;message&quot; Logrotation According to kubernetes documentation Kubernetes is not responsible for rotating logs, but rather a deployment tool should set up a solution to address that . Different logrotation strategies can cause issues that might make Filebeat losing events or even duplicating events. Users can find more information about Filebeat’s logrotation best practises at Filebeat’s log rotation specific documentation Previous Run Filebeat on Docker Next Run Filebeat on Cloud Foundry Trademarks Terms of Use Privacy Sitemap © 2025 Elasticsearch B.V. All Rights Reserved. This content is available in different formats for convenience only. All original licensing terms apply. Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.