title: Run filebeat on windows 10
body: <p>I 'm trying to run filebeat on windows 10 and send to data to elasticsearch and kibana all on localhost. This is my config file filebeat.yml</p>
  <pre><code>###################### Filebeat Configuration Example #########################
  
  # This file is an example configuration file highlighting only the most common
  # options. The filebeat.reference.yml file from the same directory contains all the
  # supported options with more comments. You can use it as a reference.
  #
  # You can find the full configuration reference here:
  # https://www.elastic.co/guide/en/beats/filebeat/index.html
  
  # For more available modules and options, please see the filebeat.reference.yml sample
  # configuration file.
  
  # ============================== Filebeat inputs ===============================
  
  filebeat.inputs:
  
  # Each - is an input. Most options can be set at the input level, so
  # you can use different inputs for various configurations.
  # Below are the input specific configurations.
  
  - type: log
  
    # Change to true to enable this input configuration.
    enabled: true
  
    # Paths that should be crawled and fetched. Glob based paths.
    paths:
      # - /var/log/*.log
      - D:\AppData\Elastic\filebeat\logs
      #- c:\programdata\elasticsearch\logs\*
  
    # Exclude lines. A list of regular expressions to match. It drops the lines that are
    # matching any regular expression from the list.
    #exclude_lines: ['^DBG']
  
    # Include lines. A list of regular expressions to match. It exports the lines that are
    # matching any regular expression from the list.
    #include_lines: ['^ERR', '^WARN']
  
    # Exclude files. A list of regular expressions to match. Filebeat drops the files that
    # are matching any regular expression from the list. By default, no files are dropped.
    #exclude_files: ['.gz$']
  
    # Optional additional fields. These fields can be freely picked
    # to add additional information to the crawled log files for filtering
    #fields:
    #  level: debug
    #  review: 1
  
    ### Multiline options
  
    # Multiline can be used for log messages spanning multiple lines. This is common
    # for Java Stack Traces or C-Line Continuation
  
    # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
    #multiline.pattern: ^\[
  
    # Defines if the pattern set under pattern should be negated or not. Default is false.
    #multiline.negate: false
  
    # Match can be set to &quot;after&quot; or &quot;before&quot;. It is used to define if lines should be append to a pattern
    # that was (not) matched before or after or as long as a pattern is not matched based on negate.
    # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
    #multiline.match: after
  
  # filestream is an input for collecting log messages from files. It is going to replace log input in the future.
  - type: filestream
  
    # Change to true to enable this input configuration.
    enabled: false
  
    # Paths that should be crawled and fetched. Glob based paths.
    paths:
      # - /var/log/*.log
      - D:\AppData\Elastic\filebeat\logs
      #- c:\programdata\elasticsearch\logs\*
  
    # Exclude lines. A list of regular expressions to match. It drops the lines that are
    # matching any regular expression from the list.
    #exclude_lines: ['^DBG']
  
    # Include lines. A list of regular expressions to match. It exports the lines that are
    # matching any regular expression from the list.
    #include_lines: ['^ERR', '^WARN']
  
    # Exclude files. A list of regular expressions to match. Filebeat drops the files that
    # are matching any regular expression from the list. By default, no files are dropped.
    #prospector.scanner.exclude_files: ['.gz$']
  
    # Optional additional fields. These fields can be freely picked
    # to add additional information to the crawled log files for filtering
    #fields:
    #  level: debug
    #  review: 1
  
  # ============================== Filebeat modules ==============================
  
  filebeat.config.modules:
    # Glob pattern for configuration loading
    path: ${path.config}/modules.d/*.yml
  
    # Set to true to enable config reloading
    reload.enabled: false
  
    # Period on which files under path should be checked for changes
    #reload.period: 10s
  
  # ======================= Elasticsearch template setting =======================
  
  setup.template.settings:
    index.number_of_shards: 1
    #index.codec: best_compression
    #_source.enabled: false
  
  
  # ================================== General ===================================
  
  # The name of the shipper that publishes the network data. It can be used to group
  # all the transactions sent by a single shipper in the web interface.
  #name:
  
  # The tags of the shipper are included in their own field with each
  # transaction published.
  #tags: [&quot;service-X&quot;, &quot;web-tier&quot;]
  
  # Optional fields that you can specify to add additional information to the
  # output.
  #fields:
  #  env: staging
  
  # ================================= Dashboards =================================
  # These settings control loading the sample dashboards to the Kibana index. Loading
  # the dashboards is disabled by default and can be enabled either by setting the
  # options here or by using the `setup` command.
  #setup.dashboards.enabled: false
  
  # The URL from where to download the dashboards archive. By default this URL
  # has a value which is computed based on the Beat name and version. For released
  # versions, this URL points to the dashboard archive on the artifacts.elastic.co
  # website.
  #setup.dashboards.url:
  
  # =================================== Kibana ===================================
  
  # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
  # This requires a Kibana endpoint configuration.
  setup.kibana:
    host: &quot;localhost:5601&quot;
  
    # Kibana Host
    # Scheme and port can be left out and will be set to the default (http and 5601)
    # In case you specify and additional path, the scheme is required: http://localhost:5601/path
    # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
    #host: &quot;localhost:5601&quot;
  
    # Kibana Space ID
    # ID of the Kibana Space into which the dashboards should be loaded. By default,
    # the Default Space will be used.
    #space.id:
  
  # =============================== Elastic Cloud ================================
  
  # These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).
  
  # The cloud.id setting overwrites the `output.elasticsearch.hosts` and
  # `setup.kibana.host` options.
  # You can find the `cloud.id` in the Elastic Cloud web UI.
  #cloud.id:
  
  # The cloud.auth setting overwrites the `output.elasticsearch.username` and
  # `output.elasticsearch.password` settings. The format is `&lt;user&gt;:&lt;pass&gt;`.
  #cloud.auth:
  
  # ================================== Outputs ===================================
  
  # Configure what output to use when sending the data collected by the beat.
  
  # ---------------------------- Elasticsearch Output ----------------------------
  output.elasticsearch:
    # Array of hosts to connect to.
    hosts: [&quot;localhost:9200&quot;]
  
    # Protocol - either `http` (default) or `https`.
    #protocol: &quot;https&quot;
  
    # Authentication credentials - either API key or username/password.
    #api_key: &quot;id:api_key&quot;
    #username: &quot;elastic&quot;
    #password: &quot;changeme&quot;
  
  # ------------------------------ Logstash Output -------------------------------
  #output.logstash:
    # The Logstash hosts
    #hosts: [&quot;localhost:5044&quot;]
  
    # Optional SSL. By default is off.
    # List of root certificates for HTTPS server verifications
    #ssl.certificate_authorities: [&quot;/etc/pki/root/ca.pem&quot;]
  
    # Certificate for SSL client authentication
    #ssl.certificate: &quot;/etc/pki/client/cert.pem&quot;
  
    # Client Certificate Key
    #ssl.key: &quot;/etc/pki/client/cert.key&quot;
  
  # ================================= Processors =================================
  processors:
    - add_host_metadata:
        when.not.contains.tags: forwarded
    - add_cloud_metadata: ~
    - add_docker_metadata: ~
    - add_kubernetes_metadata: ~
  
  # ================================== Logging ===================================
  
  # Sets log level. The default log level is info.
  # Available log levels are: error, warning, info, debug
  #logging.level: debug
  
  # At debug level, you can selectively enable logging only for some components.
  # To enable all selectors use [&quot;*&quot;]. Examples of other selectors are &quot;beat&quot;,
  # &quot;publisher&quot;, &quot;service&quot;.
  #logging.selectors: [&quot;*&quot;]
  
  # ============================= X-Pack Monitoring ==============================
  # Filebeat can export internal metrics to a central Elasticsearch monitoring
  # cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
  # reporting is disabled by default.
  
  # Set to true to enable the monitoring reporter.
  #monitoring.enabled: false
  
  # Sets the UUID of the Elasticsearch cluster under which monitoring data for this
  # Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
  # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
  #monitoring.cluster_uuid:
  
  # Uncomment to send the metrics to Elasticsearch. Most settings from the
  # Elasticsearch output are accepted here as well.
  # Note that the settings should point to your Elasticsearch *monitoring* cluster.
  # Any setting that is not set is automatically inherited from the Elasticsearch
  # output configuration, so if you have the Elasticsearch output configured such
  # that it is pointing to your Elasticsearch monitoring cluster, you can simply
  # uncomment the following line.
  #monitoring.elasticsearch:
  
  # ============================== Instrumentation ===============================
  
  # Instrumentation support for the filebeat.
  #instrumentation:
      # Set to true to enable instrumentation of filebeat.
      #enabled: false
  
      # Environment in which filebeat is running on (eg: staging, production, etc.)
      #environment: &quot;&quot;
  
      # APM Server hosts to report instrumentation results to.
      #hosts:
      #  - http://localhost:8200
  
      # API Key for the APM Server(s).
      # If api_key is set then secret_token will be ignored.
      #api_key:
  
      # Secret token for the APM Server(s).
      #secret_token:
  
  
  # ================================= Migration ==================================
  
  # This allows to enable 6.7 migration aliases
  #migration.6_to_7.enabled: true
  </code></pre>
  <p>i 've run</p>
  <pre><code>./filebeat -c filebeat.yml -e
  </code></pre>
  <p>This is the result</p>
  <pre><code>2021-09-20T09:55:05.324+0700    INFO    instance/beat.go:665    Home path: [D:\AppData\Elastic\filebeat] Config path: [D:\AppData\Elastic\filebeat] Data path: [D:\AppData\Elastic\filebeat\data] Logs path: [D:\AppData\Elastic\filebeat\logs]
  2021-09-20T09:55:05.327+0700    INFO    instance/beat.go:673    Beat ID: 3957662b-f353-4de0-a6a7-3260cb6481ba
  2021-09-20T09:55:05.375+0700    INFO    [beat]  instance/beat.go:1014   Beat info       {&quot;system_info&quot;: {&quot;beat&quot;: {&quot;path&quot;: {&quot;config&quot;: &quot;D:\\AppData\\Elastic\\filebeat&quot;, &quot;data&quot;: &quot;D:\\AppData\\Elastic\\filebeat\\data&quot;, &quot;home&quot;: &quot;D:\\AppData\\Elastic\\filebeat&quot;, &quot;logs&quot;: &quot;D:\\AppData\\Elastic\\filebeat\\logs&quot;}, &quot;type&quot;: &quot;filebeat&quot;, &quot;uuid&quot;: &quot;3957662b-f353-4de0-a6a7-3260cb6481ba&quot;}}}
  2021-09-20T09:55:05.376+0700    INFO    [beat]  instance/beat.go:1023   Build info      {&quot;system_info&quot;: {&quot;build&quot;: {&quot;commit&quot;: &quot;703d589a09cfdbfd7f84c1d990b50b6b7f62ac29&quot;, &quot;libbeat&quot;: &quot;7.14.1&quot;, &quot;time&quot;: &quot;2021-08-26T09:12:57.000Z&quot;, &quot;version&quot;: &quot;7.14.1&quot;}}}
  2021-09-20T09:55:05.376+0700    INFO    [beat]  instance/beat.go:1026   Go runtime info {&quot;system_info&quot;: {&quot;go&quot;: {&quot;os&quot;:&quot;windows&quot;,&quot;arch&quot;:&quot;amd64&quot;,&quot;max_procs&quot;:12,&quot;version&quot;:&quot;go1.16.6&quot;}}}
  2021-09-20T09:55:05.403+0700    INFO    [beat]  instance/beat.go:1030   Host info       {&quot;system_info&quot;: {&quot;host&quot;: {&quot;architecture&quot;:&quot;x86_64&quot;,&quot;boot_time&quot;:&quot;2021-09-20T08:27:03.12+07:00&quot;,&quot;name&quot;:&quot;nnhai2&quot;,&quot;ip&quot;:[&quot;fe80::6036:7939:ebe1:1d3e/64&quot;,&quot;192.168.82.42/23&quot;,&quot;fe80::984a:b076:b82f:bedf/64&quot;,&quot;169.254.190.223/16&quot;,&quot;fe80::d148:87f2:9bc8:8452/64&quot;,&quot;169.254.132.82/16&quot;,&quot;fe80::c4c:5978:a65:9c2a/64&quot;,&quot;169.254.156.42/16&quot;,&quot;fe80::488c:c4a3:51de:f987/64&quot;,&quot;169.254.249.135/16&quot;,&quot;fe80::e1fb:7ed2:192d:c665/64&quot;,&quot;169.254.198.101/16&quot;,&quot;::1/128&quot;,&quot;127.0.0.1/8&quot;,&quot;fe80::a42f:ed21:3139:b3a7/64&quot;,&quot;172.28.96.1/20&quot;],&quot;kernel_version&quot;:&quot;10.0.19041.1237 (WinBuild.160101.0800)&quot;,&quot;mac&quot;:[&quot;70:b5:e8:5a:d1:0a&quot;,&quot;ac:82:47:8d:80:2e&quot;,&quot;ac:82:47:8d:80:2f&quot;,&quot;ae:82:47:8d:80:2e&quot;,&quot;00:09:0f:fe:00:01&quot;,&quot;ac:82:47:8d:80:32&quot;,&quot;00:15:5d:d4:9f:62&quot;],&quot;os&quot;:{&quot;type&quot;:&quot;windows&quot;,&quot;family&quot;:&quot;windows&quot;,&quot;platform&quot;:&quot;windows&quot;,&quot;name&quot;:&quot;Windows 10 Pro&quot;,&quot;version&quot;:&quot;10.0&quot;,&quot;major&quot;:10,&quot;minor&quot;:0,&quot;patch&quot;:0,&quot;build&quot;:&quot;19042.1237&quot;},&quot;timezone&quot;:&quot;+07&quot;,&quot;timezone_offset_sec&quot;:25200,&quot;id&quot;:&quot;85952915-f150-4943-835a-55ae79b7bcb0&quot;}}}
  2021-09-20T09:55:05.404+0700    INFO    [beat]  instance/beat.go:1059   Process info    {&quot;system_info&quot;: {&quot;process&quot;: {&quot;cwd&quot;: &quot;D:\\AppData\\Elastic\\filebeat&quot;, &quot;exe&quot;: &quot;D:\\AppData\\Elastic\\filebeat\\filebeat.exe&quot;, &quot;name&quot;: &quot;filebeat.exe&quot;, &quot;pid&quot;: 15268, &quot;ppid&quot;: 21388, &quot;start_time&quot;: &quot;2021-09-20T09:55:04.931+0700&quot;}}}
  2021-09-20T09:55:05.405+0700    INFO    instance/beat.go:309    Setup Beat: filebeat; Version: 7.14.1
  2021-09-20T09:55:05.405+0700    INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.14.1' as ILM is enabled.
  2021-09-20T09:55:05.405+0700    INFO    [esclientleg]   eslegclient/connection.go:100   elasticsearch url: http://localhost:9200
  2021-09-20T09:55:05.406+0700    INFO    [publisher]     pipeline/module.go:113  Beat name: nnhai2
  2021-09-20T09:55:05.410+0700    INFO    instance/beat.go:473    filebeat start running.
  2021-09-20T09:55:05.410+0700    INFO    [monitoring]    log/log.go:118  Starting metrics logging every 30s
  2021-09-20T09:55:05.418+0700    INFO    memlog/store.go:119     Loading data file of 'D:\AppData\Elastic\filebeat\data\registry\filebeat' succeeded. Active transaction id=0
  2021-09-20T09:55:05.418+0700    INFO    memlog/store.go:124     Finished loading transaction log file for 'D:\AppData\Elastic\filebeat\data\registry\filebeat'. Active transaction id=0
  2021-09-20T09:55:05.420+0700    INFO    [registrar]     registrar/registrar.go:109      States Loaded from registrar: 0
  2021-09-20T09:55:05.420+0700    INFO    [crawler]       beater/crawler.go:71    Loading Inputs: 2
  2021-09-20T09:55:05.420+0700    INFO    [input] log/input.go:164        Configured paths: [D:\AppData\Elastic\filebeat\logs]    {&quot;input_id&quot;: &quot;444806ec-503a-4a80-812f-a8c78e3f69a4&quot;}
  2021-09-20T09:55:05.421+0700    INFO    [crawler]       beater/crawler.go:141   Starting input (ID: 1263043090716372778)
  2021-09-20T09:55:05.456+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_deprecation.log c:\ProgramData\Elastic\Elasticsearch\logs\*_deprecation.json]    {&quot;input_id&quot;: &quot;aa771bd1-e31c-4061-bfe6-2897ff20dde4&quot;}
  2021-09-20T09:55:05.456+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\gc.log.* c:\ProgramData\Elastic\Elasticsearch\logs\gc.log] {&quot;input_id&quot;: &quot;5c90cdc0-ca6b-4d51-a33c-3ce661ff324b&quot;}
  2021-09-20T09:55:05.457+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*.log c:\ProgramData\Elastic\Elasticsearch\logs\*_server.json]     {&quot;input_id&quot;: &quot;c7ba61e1-c4cb-42e6-8d9e-7acaa5c0d982&quot;}
  2021-09-20T09:55:05.457+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_index_search_slowlog.log c:\ProgramData\Elastic\Elasticsearch\logs\*_index_indexing_slowlog.log c:\ProgramData\Elastic\Elasticsearch\logs\*_index_search_slowlog.json c:\ProgramData\Elastic\Elasticsearch\logs\*_index_indexing_slowlog.json]    {&quot;input_id&quot;: &quot;a83c170f-f55c-4de2-b6e3-969a3686c403&quot;}
  2021-09-20T09:55:05.458+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_access.log c:\ProgramData\Elastic\Elasticsearch\logs\*_audit.log c:\ProgramData\Elastic\Elasticsearch\logs\*_audit.json]  {&quot;input_id&quot;: &quot;0696e6da-a676-4e5b-a550-0165db7b89af&quot;}
  2021-09-20T09:55:05.472+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\MySQL\MySQL Server*\error.log*]       {&quot;input_id&quot;: &quot;cc0b720d-c796-47a2-87e7-7a3244fe8174&quot;}
  2021-09-20T09:55:05.472+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\MySQL\MySQL Server*\mysql-slow.log*]  {&quot;input_id&quot;: &quot;2129affd-14ec-4468-8710-39eccfffb356&quot;}
  2021-09-20T09:55:05.487+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\nginx\logs\*access.log*]      {&quot;input_id&quot;: &quot;44009138-8a88-4b07-8bd2-d04ab9d520bd&quot;}
  2021-09-20T09:55:05.487+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\nginx\logs\error.log*]        {&quot;input_id&quot;: &quot;daa74eb0-538d-45fc-b657-13431186e186&quot;}
  2021-09-20T09:55:05.488+0700    INFO    [crawler]       beater/crawler.go:108   Loading and starting Inputs completed. Enabled inputs: 1
  2021-09-20T09:55:05.488+0700    INFO    cfgfile/reload.go:164   Config reloader started
  2021-09-20T09:55:05.498+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*.log c:\ProgramData\Elastic\Elasticsearch\logs\*_server.json]     {&quot;input_id&quot;: &quot;77a9d5c1-6f98-414d-b368-dec4f7163ed2&quot;}
  2021-09-20T09:55:05.499+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_index_search_slowlog.log c:\ProgramData\Elastic\Elasticsearch\logs\*_index_indexing_slowlog.log c:\ProgramData\Elastic\Elasticsearch\logs\*_index_search_slowlog.json c:\ProgramData\Elastic\Elasticsearch\logs\*_index_indexing_slowlog.json]    {&quot;input_id&quot;: &quot;beaa87b1-8ce8-4374-bee5-7372846a1968&quot;}
  2021-09-20T09:55:05.500+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_access.log c:\ProgramData\Elastic\Elasticsearch\logs\*_audit.log c:\ProgramData\Elastic\Elasticsearch\logs\*_audit.json]  {&quot;input_id&quot;: &quot;b6c46042-3acf-440e-b788-3dfdaf789c10&quot;}
  2021-09-20T09:55:05.500+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\*_deprecation.log c:\ProgramData\Elastic\Elasticsearch\logs\*_deprecation.json]    {&quot;input_id&quot;: &quot;d673b872-e9b2-496d-96b5-1e9792169b76&quot;}
  2021-09-20T09:55:05.501+0700    INFO    [input] log/input.go:164        Configured paths: [c:\ProgramData\Elastic\Elasticsearch\logs\gc.log.* c:\ProgramData\Elastic\Elasticsearch\logs\gc.log] {&quot;input_id&quot;: &quot;5e4465a8-9ffb-42c6-ab6f-c9d269419ed4&quot;}
  2021-09-20T09:55:05.501+0700    INFO    [esclientleg]   eslegclient/connection.go:100   elasticsearch url: http://localhost:9200
  2021-09-20T09:55:08.389+0700    INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:101    add_cloud_metadata: hosting provider type not detected.
  2021-09-20T09:55:15.302+0700    INFO    [esclientleg]   eslegclient/connection.go:273   Attempting to connect to Elasticsearch version 7.14.1
  2021-09-20T09:55:15.454+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-gc-pipeline&quot;}
  2021-09-20T09:55:15.874+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-server-pipeline&quot;}
  2021-09-20T09:55:15.986+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-server-pipeline-plaintext&quot;}
  2021-09-20T09:55:16.108+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-server-pipeline-json&quot;}
  2021-09-20T09:55:16.227+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-slowlog-pipeline&quot;}
  2021-09-20T09:55:16.335+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-slowlog-pipeline-plaintext&quot;}
  2021-09-20T09:55:16.450+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-slowlog-pipeline-json&quot;}
  2021-09-20T09:55:16.558+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-audit-pipeline&quot;}
  2021-09-20T09:55:16.674+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-audit-pipeline-json&quot;}
  2021-09-20T09:55:16.789+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-audit-pipeline-plaintext&quot;}
  2021-09-20T09:55:16.898+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-deprecation-pipeline&quot;}
  2021-09-20T09:55:17.003+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-deprecation-pipeline-plaintext&quot;}
  2021-09-20T09:55:17.111+0700    INFO    [modules]       fileset/pipelines.go:133        Elasticsearch pipeline loaded.  {&quot;pipeline&quot;: &quot;filebeat-7.14.1-elasticsearch-deprecation-pipeline-json&quot;}
  2021-09-20T09:55:17.116+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\MySQL\MySQL Server*\error.log*]       {&quot;input_id&quot;: &quot;0043e24c-4f0f-487a-ab3e-2d2254e613ac&quot;}
  2021-09-20T09:55:17.117+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\MySQL\MySQL Server*\mysql-slow.log*]  {&quot;input_id&quot;: &quot;eddd4b6e-3b7e-4cca-a0b0-e5422c6b7ccf&quot;}
  2021-09-20T09:55:17.117+0700    INFO    [esclientleg]   eslegclient/connection.go:100   elasticsearch url: http://localhost:9200
  2021-09-20T09:55:17.120+0700    INFO    [esclientleg]   eslegclient/connection.go:273   Attempting to connect to Elasticsearch version 7.14.1
  2021-09-20T09:55:17.137+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\nginx\logs\*access.log*]      {&quot;input_id&quot;: &quot;4af5fcde-53a7-4e67-9819-c153919b5f05&quot;}
  2021-09-20T09:55:17.137+0700    INFO    [input] log/input.go:164        Configured paths: [c:\programdata\nginx\logs\error.log*]        {&quot;input_id&quot;: &quot;f4dafaa1-89cf-48d8-927e-eb292c5b186f&quot;}
  2021-09-20T09:55:17.137+0700    INFO    [esclientleg]   eslegclient/connection.go:100   elasticsearch url: http://localhost:9200
  2021-09-20T09:55:17.141+0700    INFO    [esclientleg]   eslegclient/connection.go:273   Attempting to connect to Elasticsearch version 7.14.1
  2021-09-20T09:55:17.153+0700    INFO    cfgfile/reload.go:224   Loading of config files completed.
  2021-09-20T09:55:35.468+0700    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {&quot;monitoring&quot;: {&quot;metrics&quot;: {&quot;beat&quot;:{&quot;cpu&quot;:{&quot;system&quot;:{&quot;ticks&quot;:78,&quot;time&quot;:{&quot;ms&quot;:93}},&quot;total&quot;:{&quot;ticks&quot;:390,&quot;time&quot;:{&quot;ms&quot;:405},&quot;value&quot;:390},&quot;user&quot;:{&quot;ticks&quot;:312,&quot;time&quot;:{&quot;ms&quot;:312}}},&quot;handles&quot;:{&quot;open&quot;:306},&quot;info&quot;:{&quot;ephemeral_id&quot;:&quot;f9fdf685-5d19-459c-a646-fceea8d53c4e&quot;,&quot;uptime&quot;:{&quot;ms&quot;:30152},&quot;version&quot;:&quot;7.14.1&quot;},&quot;memstats&quot;:{&quot;gc_next&quot;:19839152,&quot;memory_alloc&quot;:12307216,&quot;memory_sys&quot;:34381016,&quot;memory_total&quot;:62482208,&quot;rss&quot;:62062592},&quot;runtime&quot;:{&quot;goroutines&quot;:78}},&quot;filebeat&quot;:{&quot;harvester&quot;:{&quot;open_files&quot;:0,&quot;running&quot;:0}},&quot;libbeat&quot;:{&quot;config&quot;:{&quot;module&quot;:{&quot;running&quot;:3,&quot;starts&quot;:3},&quot;reloads&quot;:1,&quot;scans&quot;:1},&quot;output&quot;:{&quot;events&quot;:{&quot;active&quot;:0},&quot;type&quot;:&quot;elasticsearch&quot;},&quot;pipeline&quot;:{&quot;clients&quot;:10,&quot;events&quot;:{&quot;active&quot;:0},&quot;queue&quot;:{&quot;max_events&quot;:4096}}},&quot;registrar&quot;:{&quot;states&quot;:{&quot;current&quot;:0}},&quot;system&quot;:{&quot;cpu&quot;:{&quot;cores&quot;:12}}}}}       
  2021-09-20T09:56:05.478+0700    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {&quot;monitoring&quot;: {&quot;metrics&quot;: {&quot;beat&quot;:{&quot;cpu&quot;:{&quot;system&quot;:{&quot;ticks&quot;:109,&quot;time&quot;:{&quot;ms&quot;:32}},&quot;total&quot;:{&quot;ticks&quot;:421,&quot;time&quot;:{&quot;ms&quot;:32},&quot;value&quot;:421},&quot;user&quot;:{&quot;ticks&quot;:312}},&quot;handles&quot;:{&quot;open&quot;:307},&quot;info&quot;:{&quot;ephemeral_id&quot;:&quot;f9fdf685-5d19-459c-a646-fceea8d53c4e&quot;,&quot;uptime&quot;:{&quot;ms&quot;:60164},&quot;version&quot;:&quot;7.14.1&quot;},&quot;memstats&quot;:{&quot;gc_next&quot;:19839152,&quot;memory_alloc&quot;:12714808,&quot;memory_total&quot;:62889800,&quot;rss&quot;:62160896},&quot;runtime&quot;:{&quot;goroutines&quot;:78}},&quot;filebeat&quot;:{&quot;harvester&quot;:{&quot;open_files&quot;:0,&quot;running&quot;:0}},&quot;libbeat&quot;:{&quot;config&quot;:{&quot;module&quot;:{&quot;running&quot;:3}},&quot;output&quot;:{&quot;events&quot;:{&quot;active&quot;:0}},&quot;pipeline&quot;:{&quot;clients&quot;:10,&quot;events&quot;:{&quot;active&quot;:0}}},&quot;registrar&quot;:{&quot;states&quot;:{&quot;current&quot;:0}}}}}
  2021-09-20T09:56:35.470+0700    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {&quot;monitoring&quot;: {&quot;metrics&quot;: {&quot;beat&quot;:{&quot;cpu&quot;:{&quot;system&quot;:{&quot;ticks&quot;:140,&quot;time&quot;:{&quot;ms&quot;:46}},&quot;total&quot;:{&quot;ticks&quot;:452,&quot;time&quot;:{&quot;ms&quot;:46},&quot;value&quot;:452},&quot;user&quot;:{&quot;ticks&quot;:312}},&quot;handles&quot;:{&quot;open&quot;:304},&quot;info&quot;:{&quot;ephemeral_id&quot;:&quot;f9fdf685-5d19-459c-a646-fceea8d53c4e&quot;,&quot;uptime&quot;:{&quot;ms&quot;:90157},&quot;version&quot;:&quot;7.14.1&quot;},&quot;memstats&quot;:{&quot;gc_next&quot;:19839152,&quot;memory_alloc&quot;:13110648,&quot;memory_total&quot;:63285640,&quot;rss&quot;:62164992},&quot;runtime&quot;:{&quot;goroutines&quot;:72}},&quot;filebeat&quot;:{&quot;harvester&quot;:{&quot;open_files&quot;:0,&quot;running&quot;:0}},&quot;libbeat&quot;:{&quot;config&quot;:{&quot;module&quot;:{&quot;running&quot;:3}},&quot;output&quot;:{&quot;events&quot;:{&quot;active&quot;:0}},&quot;pipeline&quot;:{&quot;clients&quot;:10,&quot;events&quot;:{&quot;active&quot;:0}}},&quot;registrar&quot;:{&quot;states&quot;:{&quot;current&quot;:0}}}}}
  </code></pre>
  <p>but i have n't seen any data in kibana.</p>
  <p>This is the result of GET _cat/indices?v</p>
  <pre><code>#! Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See https://www.elastic.co/guide/en/elasticsearch/reference/7.14/security-minimal-setup.html to enable security.
  health status index                             uuid                   pri rep docs.count docs.deleted store.size pri.store.size
  green  open   .geoip_databases                  qeZJyRoKRlW7Xu7EE2ytcw   1   0         42            0     40.8mb         40.8mb
  green  open   .apm-custom-link                  5aba-WkIS5yl-Eui7vpfcQ   1   0          0            0       208b           208b
  green  open   .kibana_task_manager_7.14.1_001   1zkRA6c6SXiMcqCtSyrSqQ   1   0         14          344      1.4mb          1.4mb
  green  open   .apm-agent-configuration          dppb9LlKQLWTzYBiLZjViA   1   0          0            0       208b           208b
  yellow open   filebeat-7.14.1-2021.09.19-000001 TpsVGELhRwC-_dxGH7nGKQ   1   1          0            0       208b           208b
  green  open   .async-search                     KZgq-leNT_qt_dM8TOUQ6A   1   0          0            0       231b           231b
  green  open   .kibana_7.14.1_001                D4UISLPMQlGmCjNgGIrOTw   1   0       2251           11      2.7mb          2.7mb
  green  open   .kibana-event-log-7.14.1-000001   cspR3zh9T1emwvNA131noQ   1   0          3            0     16.4kb         16.4kb
  green  open   .tasks                            5dHd_BZpSVilDmVQy6kE7w   1   0          4            0     27.3kb         27.3kb
  </code></pre>
  <p>is it required specific structure log file or i can put any thing in there or where can i get sample log file to test the connection to put in my folder at D:\AppData\Elastic\filebeat\logs ?</p>
  <p>Also, where can i find some best practice to config filebeat, i 've read the document at <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html</a>. But it is too simple, many things were not explained like how to config and test modules (we have dozens modules pensando, postgresql, proofpoint, rabbitmq,....)</p>