# \#filebeat-linux **URL:** https://community.graylog.org/tag/filebeat-linux/19.md [Latest](https://community.graylog.org/latest.md) · [Categories](https://community.graylog.org/categories.md) · [Tags](https://community.graylog.org/tags.md) --- ## [Stream receives messages, but output never gets them](https://community.graylog.org/t/stream-receives-messages-but-output-never-gets-them/37604)
**Author:** [@patrick.othmer\_dm](https://community.graylog.org/u/patrick.othmer_dm)\ **Replies:** 1\ **Last updated:** [October 8, 2026, 1:06pm UTC](https://community.graylog.org/t/stream-receives-messages-but-output-never-gets-them/37604 "2026-10-08T13:06:20Z")
1. Describe your incident: I have two streams, an SSH stream and a Webserver stream. The same output is assigned to both (verified in the UI and via GET /api/streams//outputs). Messages are routed into both streams corr… --- ## [Graylog Sidecar (1.5.1) fails (in fact Filebeat fails)](https://community.graylog.org/t/graylog-sidecar-1-5-1-fails-in-fact-filebeat-fails/36947)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 4\ **Last updated:** [February 5, 2026, 3:59pm UTC](https://community.graylog.org/t/graylog-sidecar-1-5-1-fails-in-fact-filebeat-fails/36947 "2026-02-05T15:59:20Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Filebeat Agent Compatibility Matrix](https://community.graylog.org/t/filebeat-agent-compatibility-matrix/36519)
**Author:** [@freebeasty1801](https://community.graylog.org/u/freebeasty1801)\ **Replies:** 1\ **Last updated:** [October 29, 2025, 3:35pm UTC](https://community.graylog.org/t/filebeat-agent-compatibility-matrix/36519 "2025-10-29T15:35:16Z")
Hi everyone, I have a question. The Filebeat agent version that comes with Graylog 6.3 (Windows Server) and Sidecar is too old for productive use in my environment. It is version 8.9.0, built in July 2023 — so it’s alr… --- ## [Fixing not indexable messages](https://community.graylog.org/t/fixing-not-indexable-messages/36023)
**Author:** [@Gamienator](https://community.graylog.org/u/Gamienator)\ **Replies:** 1\ **Last updated:** [July 18, 2025, 9:01am UTC](https://community.graylog.org/t/fixing-not-indexable-messages/36023 "2025-07-18T09:01:48Z")
1. Describe your incident: I’m receiving a lot of Indexer failures and can’t find the source of it. The Message details: OpenSearchException\[OpenSearch exception \[type=mapper\_parsing\_exception, reason=failed to parse f… --- ## [0 active connection - input is running](https://community.graylog.org/t/0-active-connection-input-is-running/35747)
**Author:** [@Kartika1](https://community.graylog.org/u/Kartika1)\ **Replies:** 0\ **Last updated:** [May 28, 2025, 6:59am UTC](https://community.graylog.org/t/0-active-connection-input-is-running/35747 "2025-05-28T06:59:28Z")
1. Describe your incident: Hello guys, I’m trying to send logs from a Debian VPS using Filebeat to Graylog. The Beats input is running, but no active connections are detected (0 active, 26,500 total). I’ve configured Fi… --- ## [Sidecar 1.5 can't start the filebeat that it is shipped with](https://community.graylog.org/t/sidecar-1-5-cant-start-the-filebeat-that-it-is-shipped-with/30712)
**Author:** [@PeterNagy](https://community.graylog.org/u/PeterNagy)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 1:35am UTC](https://community.graylog.org/t/sidecar-1-5-cant-start-the-filebeat-that-it-is-shipped-with/30712 "2025-01-31T01:35:35Z")
Hi, I’m trying to use Sidecar 1.5 with filebeat on a Linux server. The sidecar runs without problem and i can see it on the admin gui, but when i try to apply the default filebeat on Linux config it don’t start. My co… --- ## [/usr/lib/graylog-sidecar/filebeat: exec format error (Centos 6)](https://community.graylog.org/t/usr-lib-graylog-sidecar-filebeat-exec-format-error-centos-6/34295)
**Author:** [@vangog9](https://community.graylog.org/u/vangog9)\ **Replies:** 2\ **Last updated:** [December 9, 2024, 11:58am UTC](https://community.graylog.org/t/usr-lib-graylog-sidecar-filebeat-exec-format-error-centos-6/34295 "2024-12-09T11:58:35Z")
1. Describe your incident: The problem is - the sidecar computer is seen in Graylog panel, but has issue 2. Describe your environment: OS Information: CentOS 6 Package Version: rpm -Uvh https://packages.grayl… --- ## [Parsing JSON format with Filebeat](https://community.graylog.org/t/parsing-json-format-with-filebeat/34212)
**Author:** [@mromeo](https://community.graylog.org/u/mromeo)\ **Replies:** 1\ **Last updated:** [December 2, 2024, 1:05pm UTC](https://community.graylog.org/t/parsing-json-format-with-filebeat/34212 "2024-12-02T13:05:47Z")
Hi I am having a little trouble understanding how the parsing of JSON format works, when using filebeat as a collector. I have gone through a few forum posts and docs and can’t seem to get things looking right. Current… --- ## [Rsyslog template](https://community.graylog.org/t/rsyslog-template/34021)
**Author:** [@brettjouw](https://community.graylog.org/u/brettjouw)\ **Replies:** 1\ **Last updated:** [November 6, 2024, 6:41pm UTC](https://community.graylog.org/t/rsyslog-template/34021 "2024-11-06T18:41:05Z")
Rsyslog Template Our environment has syslog collectors that use rsyslog to listen and write the events to disk in JSON format. The events are then picked up by Filebeats and shipped to Graylog. Just wanted to share my co… --- ## [Messages not populating, files found in Graylog sidecars and filebeat in docker](https://community.graylog.org/t/messages-not-populating-files-found-in-graylog-sidecars-and-filebeat-in-docker/33213)
**Author:** [@sashah](https://community.graylog.org/u/sashah)\ **Replies:** 0\ **Last updated:** [August 7, 2024, 8:52pm UTC](https://community.graylog.org/t/messages-not-populating-files-found-in-graylog-sidecars-and-filebeat-in-docker/33213 "2024-08-07T20:52:22Z")
1. Describe your incident: I’m trying to ingest a log file in a docker environment using filebeat and graylog sidecar. I’ve managed to get the filebeat client container talking to the graylog host container, the sideca… --- ## [Search domain to match any occurrence on string](https://community.graylog.org/t/search-domain-to-match-any-occurrence-on-string/32403)
**Author:** [@Gabao-Farias](https://community.graylog.org/u/Gabao-Farias)\ **Replies:** 0\ **Last updated:** [May 14, 2024, 1:59pm UTC](https://community.graylog.org/t/search-domain-to-match-any-occurrence-on-string/32403 "2024-05-14T13:59:21Z")
Hi guys! I still could not understand why while searching in the graylog a specific domain, it cannot match the subdomain address containing the domain searched… Am I searching it wrong or this way of searching would s… --- ## [Graylog security alerting with Beats](https://community.graylog.org/t/graylog-security-alerting-with-beats/31802)
**Author:** [@perfecto25](https://community.graylog.org/u/perfecto25)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 9:52pm UTC](https://community.graylog.org/t/graylog-security-alerting-with-beats/31802 "2024-03-13T21:52:47Z")
fyi if anyone needs, how to setup basic security alerting for linux using GL, filebeat, auditbeat --- ## [Filebeat javascript processors](https://community.graylog.org/t/filebeat-javascript-processors/31670)
**Author:** [@Gabao-Farias](https://community.graylog.org/u/Gabao-Farias)\ **Replies:** 3\ **Last updated:** [March 6, 2024, 3:01pm UTC](https://community.graylog.org/t/filebeat-javascript-processors/31670 "2024-03-06T15:01:33Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Pthread\_create failed: Operation not permitted](https://community.graylog.org/t/pthread-create-failed-operation-not-permitted/30985)
**Author:** [@s0p4L1N](https://community.graylog.org/u/s0p4L1N)\ **Replies:** 5\ **Last updated:** [December 21, 2023, 7:49am UTC](https://community.graylog.org/t/pthread-create-failed-operation-not-permitted/30985 "2023-12-21T07:49:56Z")
1. Describe your incident: Try to run filebeat-linux with either journald or log as type , and I got same error everytime: runtime/cgo: pthread\_create failed: Operation not permitted SIGABRT: abort PC=0x7f9782d1f58c m=… --- ## [Indexer Errors Because of mapper\_parsing\_exception](https://community.graylog.org/t/indexer-errors-because-of-mapper-parsing-exception/30938)
**Author:** [@maxried](https://community.graylog.org/u/maxried)\ **Replies:** 2\ **Last updated:** [December 18, 2023, 10:18am UTC](https://community.graylog.org/t/indexer-errors-because-of-mapper-parsing-exception/30938 "2023-12-18T10:18:38Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Address already in use when use static\_fields in Beats in Graylog 4.2](https://community.graylog.org/t/address-already-in-use-when-use-static-fields-in-beats-in-graylog-4-2/30919)
**Author:** [@hoveiser](https://community.graylog.org/u/hoveiser)\ **Replies:** 2\ **Last updated:** [December 12, 2023, 2:03pm UTC](https://community.graylog.org/t/address-already-in-use-when-use-static-fields-in-beats-in-graylog-4-2/30919 "2023-12-12T14:03:46Z")
I am experiencing a strange issue with Graylog. When attempting to use “static\_fields” on Beats as an input, I am encountering an “address already in use” error.Can you please advise on how to troubleshoot and resolve th… --- ## [Sending local log from Sidecar and Filebeat to Graylog](https://community.graylog.org/t/sending-local-log-from-sidecar-and-filebeat-to-graylog/30639)
**Author:** [@Okizeme](https://community.graylog.org/u/Okizeme)\ **Replies:** 3\ **Last updated:** [November 21, 2023, 10:30pm UTC](https://community.graylog.org/t/sending-local-log-from-sidecar-and-filebeat-to-graylog/30639 "2023-11-21T22:30:16Z")
Good morning guys, I’m stuck getting my log transfered to Graylog and I would love to have your help ! So far, I installed Graylog 5.1, Mongodb and Opensearch on only one instance. I also installed filebeat and graylod… --- ## [Filebeat stops working after OS reboot](https://community.graylog.org/t/filebeat-stops-working-after-os-reboot/29921)
**Author:** [@ofentselogger](https://community.graylog.org/u/ofentselogger)\ **Replies:** 2\ **Last updated:** [August 25, 2023, 7:13pm UTC](https://community.graylog.org/t/filebeat-stops-working-after-os-reboot/29921 "2023-08-25T19:13:20Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Xml decoder filebeat linux](https://community.graylog.org/t/xml-decoder-filebeat-linux/29626)
**Author:** [@tijaabo](https://community.graylog.org/u/tijaabo)\ **Replies:** 5\ **Last updated:** [August 2, 2023, 4:16pm UTC](https://community.graylog.org/t/xml-decoder-filebeat-linux/29626 "2023-08-02T16:16:39Z")
Hello Community, I have an issue in xml decoder, I’m trying to decode sysmon for linuxs logs i’m using filebeat to send the logs from ubuntu server to my graylog everything works great however filebeat is decoding the ke… --- ## [Extract data from "message" into filebeat](https://community.graylog.org/t/extract-data-from-message-into-filebeat/29696)
**Author:** [@francemic](https://community.graylog.org/u/francemic)\ **Replies:** 4\ **Last updated:** [August 2, 2023, 1:18pm UTC](https://community.graylog.org/t/extract-data-from-message-into-filebeat/29696 "2023-08-02T13:18:31Z")
Good morning everyone. I’ve searched the forum a lot and also tried a lot, but I haven’t found any solution (I’m a newbie). I have an ubuntu server (22.04) which sends filebeats to another ubuntu server with graylog 5.… --- ## [Sidecar 1.4.0 with filebeat doesn't change path.data & path.logs](https://community.graylog.org/t/sidecar-1-4-0-with-filebeat-doesnt-change-path-data-path-logs/29717)
**Author:** [@zyxep](https://community.graylog.org/u/zyxep)\ **Replies:** 4\ **Last updated:** [August 1, 2023, 9:52pm UTC](https://community.graylog.org/t/sidecar-1-4-0-with-filebeat-doesnt-change-path-data-path-logs/29717 "2023-08-01T21:52:30Z")
Hey, I am using filebeat 8.9 with graylog-sidecar 1.4.0 on ubuntu servers. when the systemd service graylog-sidecar starts, it starts a process like: /usr/share/filebeat/bin/filebeat --path.home /usr/share/filebeat --… --- ## [How to configure graylog to display logs from elasticsearch](https://community.graylog.org/t/how-to-configure-graylog-to-display-logs-from-elasticsearch/29687)
**Author:** [@charan.guddu](https://community.graylog.org/u/charan.guddu)\ **Replies:** 6\ **Last updated:** [July 31, 2023, 5:10pm UTC](https://community.graylog.org/t/how-to-configure-graylog-to-display-logs-from-elasticsearch/29687 "2023-07-31T17:10:13Z")
1. Describe your incident: I am newbie to graylog and I am trying to setup graylog to display application logs in the graylog UI. Tools used are graylog, elasticsearch and filebeat. I have installed and configured the… --- ## [Filebeat for auditd logs using opensearch/graylog fails on address binding](https://community.graylog.org/t/filebeat-for-auditd-logs-using-opensearch-graylog-fails-on-address-binding/29555)
**Author:** [@alexandro](https://community.graylog.org/u/alexandro)\ **Replies:** 2\ **Last updated:** [July 21, 2023, 3:19pm UTC](https://community.graylog.org/t/filebeat-for-auditd-logs-using-opensearch-graylog-fails-on-address-binding/29555 "2023-07-21T15:19:51Z")
1. Describe your incident: I am trying to get auditd (locally installed) logs to graylog. Installed graylog docs - red\_hat\_installation (sry, only 2 links). First I did try with rsyslog but it seems to be incompatible w… --- ## [Not "Show Messages from the Only SideCar reporting to the Graylog Server](https://community.graylog.org/t/not-show-messages-from-the-only-sidecar-reporting-to-the-graylog-server/29537)
**Author:** [@beauvalon](https://community.graylog.org/u/beauvalon)\ **Replies:** 2\ **Last updated:** [July 18, 2023, 8:16am UTC](https://community.graylog.org/t/not-show-messages-from-the-only-sidecar-reporting-to-the-graylog-server/29537 "2023-07-18T08:16:47Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [What Logstash can that Graylog cannot?](https://community.graylog.org/t/what-logstash-can-that-graylog-cannot/28912)
**Author:** [@roman.potato](https://community.graylog.org/u/roman.potato)\ **Replies:** 4\ **Last updated:** [May 25, 2023, 9:30pm UTC](https://community.graylog.org/t/what-logstash-can-that-graylog-cannot/28912 "2023-05-25T21:30:06Z")
Hi, I’ve spend the last few days reading about ELK and Graylog and I have a few questions about Filebeat+Graylog setup that I can not understand from the documentation. This part of documentation explains how to manage … --- ## [Collector-sidecar logging level?](https://community.graylog.org/t/collector-sidecar-logging-level/28784)
**Author:** [@SalC](https://community.graylog.org/u/SalC)\ **Replies:** 2\ **Last updated:** [May 15, 2023, 2:27pm UTC](https://community.graylog.org/t/collector-sidecar-logging-level/28784 "2023-05-15T14:27:43Z")
Hello, trying to set the verbosity of the logging messages output by filebeat to /var/log/messages to “warning” instead of “info” via the sidecar configuration within Graylog itself. I’ve tried modifying the sidecar con… --- ## [Found the solution to our problem with Filebeat](https://community.graylog.org/t/found-the-solution-to-our-problem-with-filebeat/28753)
**Author:** [@ContriaConnect](https://community.graylog.org/u/ContriaConnect)\ **Replies:** 0\ **Last updated:** [May 11, 2023, 2:39pm UTC](https://community.graylog.org/t/found-the-solution-to-our-problem-with-filebeat/28753 "2023-05-11T14:39:14Z")
Since I can’t reply to my previous topic. We found the cause for our problem in this topic: The problem was that the VMs had a “large” backlog of logs. Around 2-4 GB each. Filebeat then parsed the logs and send them u… --- ## [@timestamp field format in Graylog GUI Search doesn't show as UTC ISO8601 sent by filebeat beat](https://community.graylog.org/t/timestamp-field-format-in-graylog-gui-search-doesnt-show-as-utc-iso8601-sent-by-filebeat-beat/28600)
**Author:** [@armesh](https://community.graylog.org/u/armesh)\ **Replies:** 8\ **Last updated:** [April 29, 2023, 3:29am UTC](https://community.graylog.org/t/timestamp-field-format-in-graylog-gui-search-doesnt-show-as-utc-iso8601-sent-by-filebeat-beat/28600 "2023-04-29T03:29:40Z")
Environment: Ubuntu 22.04.2 LTS Graylog 5.0.6 Filebeat 8.7.0 Incident: I made an input to receive logs from Filebeat. Filebeat is picking telegram\*.txt Filebeat sent over the log at 2023-04-28 12:26:27 PM GMT +8. … --- ## [Graylog logs are not receiving log with filebeat](https://community.graylog.org/t/graylog-logs-are-not-receiving-log-with-filebeat/28488)
**Author:** [@abntkpi](https://community.graylog.org/u/abntkpi)\ **Replies:** 3\ **Last updated:** [April 25, 2023, 9:40pm UTC](https://community.graylog.org/t/graylog-logs-are-not-receiving-log-with-filebeat/28488 "2023-04-25T21:40:26Z")
I’m not receiving linux logs,with filebeat every time check alert there is exclamation next to graylog gl2\_source\_collector:3158f974-c860-4765-ac89-4454a5516eff and says Unknown field: Query contains unknown field: g… --- ## [Filebeat spams our Graylog server](https://community.graylog.org/t/filebeat-spams-our-graylog-server/28302)
**Author:** [@ContriaConnect](https://community.graylog.org/u/ContriaConnect)\ **Replies:** 4\ **Last updated:** [April 4, 2023, 6:27am UTC](https://community.graylog.org/t/filebeat-spams-our-graylog-server/28302 "2023-04-04T06:27:06Z")
1. Describe your incident: We have various servers which create multi line PHP stack traces. To collect these we use Filebeat. We have a working config (see below) but it works only on one server as soon as we apply i… [Next page](https://community.graylog.org/tag/filebeat-linux/19.md?match_all_tags=true&page=1&tags%5B%5D=filebeat-linux)