# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=468 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 469 --- ## [Mapper Parsing Exeception after Upgrade to 6.2.2](https://discuss.elastic.co/t/mapper-parsing-exeception-after-upgrade-to-6-2-2/122303)
**Author:** [@hmhall](https://discuss.elastic.co/u/hmhall)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 10:34am UTC](https://discuss.elastic.co/t/mapper-parsing-exeception-after-upgrade-to-6-2-2/122303 "2018-03-12T10:34:01Z")
logstash.outputs.elasticsearch is reporting an error from winlogbeat. Elasticsearch is reporting a mapper parsing error. It failed to parse \[event\_data.param21\]. Our log file says the error type is an "illegal\_argume… --- ## [When set worker to 3 in filebeat config case CPU usege increasing to 100%](https://discuss.elastic.co/t/when-set-worker-to-3-in-filebeat-config-case-cpu-usege-increasing-to-100/123220)
**Author:** [@Feng\_Mi](https://discuss.elastic.co/u/Feng_Mi)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 10:28am UTC](https://discuss.elastic.co/t/when-set-worker-to-3-in-filebeat-config-case-cpu-usege-increasing-to-100/123220 "2018-03-12T10:28:45Z")
Could Any body explain it for me? ES performance show strange too. When set woker to 1 and 3: \[es\_cpunomail\]\[es-cpu100\] This is my logic server cpu usage: \[logicserver\_cpu\_normal\]\[logicservercpu\] --- ## [Can activemq be used as a broker?](https://discuss.elastic.co/t/can-activemq-be-used-as-a-broker/123068)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 5\ **Last updated:** [March 12, 2018, 10:24am UTC](https://discuss.elastic.co/t/can-activemq-be-used-as-a-broker/123068 "2018-03-12T10:24:57Z")
Hi, is it possible to ship data from filebeat to Active MQ? ActiveMQ is already used in our system environment and we have some knowledge about it. Kafka as broker would be new terrain for us, so I am interested if we… --- ## [How to handle log duplications on docker restart](https://discuss.elastic.co/t/how-to-handle-log-duplications-on-docker-restart/123183)
**Author:** [@idangozlan](https://discuss.elastic.co/u/idangozlan)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 10:22am UTC](https://discuss.elastic.co/t/how-to-handle-log-duplications-on-docker-restart/123183 "2018-03-12T10:22:31Z")
Hi, Im trying to understand how to handle cases that filebeat docker is restarted and start collect same logs line again. I guess that there is a way to mount filebeat offset information, I didn't see any information a… --- ## [Unable to compile custom beat based on metricbeat](https://discuss.elastic.co/t/unable-to-compile-custom-beat-based-on-metricbeat/123085)
**Author:** [@dcroonen](https://discuss.elastic.co/u/dcroonen)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 9:18am UTC](https://discuss.elastic.co/t/unable-to-compile-custom-beat-based-on-metricbeat/123085 "2018-03-12T09:18:29Z")
Hi all After upgrading the Beat library from 6.0 to 6.2 I'm unable to package my custom Beat based on Metricbeat. The error message is: Step 4/9 : RUN apt-get -o Acquire::Check-Valid-Until=false update && apt-get in… --- ## [Filebeat new module - missing info](https://discuss.elastic.co/t/filebeat-new-module-missing-info/122462)
**Author:** [@Asher\_Shoshan](https://discuss.elastic.co/u/Asher_Shoshan)\ **Replies:** 4\ **Last updated:** [March 12, 2018, 7:52am UTC](https://discuss.elastic.co/t/filebeat-new-module-missing-info/122462 "2018-03-12T07:52:05Z")
Trying to add a new module to filebeat (parsing some application access log); In documentation, last steps are missing...(after running build create- fileset) how to wrap the new module, recompile filebaet? --- ## [Filebeat 'multiline' multiline pattern](https://discuss.elastic.co/t/filebeat-multiline-multiline-pattern/121030)
**Author:** [@r2cX](https://discuss.elastic.co/u/r2cX)\ **Replies:** 3\ **Last updated:** [March 12, 2018, 7:05am UTC](https://discuss.elastic.co/t/filebeat-multiline-multiline-pattern/121030 "2018-03-12T07:05:10Z")
Filebeat 6.2.2 Has anyone tried a multiline.pattern that can span 2 lines (e.g. include \\n). I have been struggling with this type of log type. This represents a single request-response log. I used to have filebeat send… --- ## [Win 2003 32 bit OS Period(Time) is not correct it is showing default](https://discuss.elastic.co/t/win-2003-32-bit-os-period-time-is-not-correct-it-is-showing-default/118713)
**Author:** [@dilip](https://discuss.elastic.co/u/dilip)\ **Replies:** 6\ **Last updated:** [March 12, 2018, 6:57am UTC](https://discuss.elastic.co/t/win-2003-32-bit-os-period-time-is-not-correct-it-is-showing-default/118713 "2018-03-12T06:57:10Z")
Hi, I am using Metricbeat 6.0.0 on WIn 2003 OS 32 Bit .with System module to collect the performance data. everything is working fine except Period Interval .its taking default as 10s instead of custom like 2m. Please… --- ## [Problem with multiline filebeat docker prospector (,\\n)](https://discuss.elastic.co/t/problem-with-multiline-filebeat-docker-prospector-n/122261)
**Author:** [@meril](https://discuss.elastic.co/u/meril)\ **Replies:** 4\ **Last updated:** [March 12, 2018, 6:42am UTC](https://discuss.elastic.co/t/problem-with-multiline-filebeat-docker-prospector-n/122261 "2018-03-12T06:42:01Z")
Hi I configured filebeat 6.2.1 like this: filebeat.prospectors: - type: docker document\_type: eoclog4j paths: - '/var/lib/docker/containers/\*/\*.log' containers.ids: - '\*' multiline: pattern: '(\[0-9\]{4}-… --- ## [Multiline pattern for DateTime not working when logs are comming with high rate](https://discuss.elastic.co/t/multiline-pattern-for-datetime-not-working-when-logs-are-comming-with-high-rate/122399)
**Author:** [@rudok](https://discuss.elastic.co/u/rudok)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 6:40am UTC](https://discuss.elastic.co/t/multiline-pattern-for-datetime-not-working-when-logs-are-comming-with-high-rate/122399 "2018-03-12T06:40:48Z")
Hello I am trying to get tomcat log messages base on date time pattern: multiline.pattern: '^\[\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2} \[0-9\]{2}:\[0-9\]{2}:\[0-9\]{2}.\[0-9\]{3} ' multiline.negate: true multiline.match: after When logs… --- ## [Filebeat 6.2.2 Cannot find nginx module](https://discuss.elastic.co/t/filebeat-6-2-2-cannot-find-nginx-module/122053)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 4\ **Last updated:** [March 12, 2018, 6:39am UTC](https://discuss.elastic.co/t/filebeat-6-2-2-cannot-find-nginx-module/122053 "2018-03-12T06:39:01Z")
Hi I cannot load the nginx module in using /usr/share/filebeat/bin/filebeat /usr/share/filebeat/bin/filebeat version filebeat version 6.2.2 (amd64), libbeat 6.2.2 /etc/filebeat# /usr/share/filebeat/bin/filebeat modul… --- ## [Configure metric collection frequency dynamically](https://discuss.elastic.co/t/configure-metric-collection-frequency-dynamically/122796)
**Author:** [@musician](https://discuss.elastic.co/u/musician)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 1:22am UTC](https://discuss.elastic.co/t/configure-metric-collection-frequency-dynamically/122796 "2018-03-12T01:22:24Z")
It is possible to configure the collection frequency dynamically? A use case would be to decrease the frequency during night and restore during the day. --- ## [Filebeat to send to Multiple Logstash Sever](https://discuss.elastic.co/t/filebeat-to-send-to-multiple-logstash-sever/123145)
**Author:** [@srcpro](https://discuss.elastic.co/u/srcpro)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 1:19am UTC](https://discuss.elastic.co/t/filebeat-to-send-to-multiple-logstash-sever/123145 "2018-03-12T01:19:09Z")
I am trying to send logs using filebeats to multiple logstash server. Same logs in 2 different logstash server. |----\> logstash01 Filebeat ----\> | |----\> logsstash02 Is it some… --- ## [Collecting logs from docker hosts](https://discuss.elastic.co/t/collecting-logs-from-docker-hosts/123216)
**Author:** [@jbacic](https://discuss.elastic.co/u/jbacic)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 1:12am UTC](https://discuss.elastic.co/t/collecting-logs-from-docker-hosts/123216 "2018-03-12T01:12:45Z")
Hey I need some consultation here whether my current setup is the right way to go. I want to make sure that logs are not lost in case some parts of the system are temporarily unavailable. Thanks in advance for help. C… --- ## [Logstash index setting now requires version](https://discuss.elastic.co/t/logstash-index-setting-now-requires-version/122095)
**Author:** [@raamee](https://discuss.elastic.co/u/raamee)\ **Replies:** 4\ **Last updated:** [March 11, 2018, 8:07pm UTC](https://discuss.elastic.co/t/logstash-index-setting-now-requires-version/122095 "2018-03-11T20:07:04Z")
Hi, I am trying to upgrade my ELK setup from 5.6.5 to 6.2.1. So I am with the help of interactive guide Upgrade to Elastic 8.11.1 | Elastic Installation and Upgrade Guide \[8.11\] | Elastic, checking the manual upgrade st… --- ## [Ingest XML from http](https://discuss.elastic.co/t/ingest-xml-from-http/122955)
**Author:** [@musician](https://discuss.elastic.co/u/musician)\ **Replies:** 1\ **Last updated:** [March 11, 2018, 1:43pm UTC](https://discuss.elastic.co/t/ingest-xml-from-http/122955 "2018-03-11T13:43:41Z")
Is it possible to accept XML output from invoking an HTTP URL in the http module? --- ## [Filebeat 6.2.2 doesn't harvest .txt files!](https://discuss.elastic.co/t/filebeat-6-2-2-doesnt-harvest-txt-files/122457)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 1\ **Last updated:** [March 11, 2018, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-6-2-2-doesnt-harvest-txt-files/122457 "2018-03-11T13:13:46Z")
I'm trying to ship tomcat access logs using filebeat. The problem is that filebeat doesn't read log messages. I've tested many things and finally found out the problem is caused by the files suffix!!! - type: log enab… --- ## [Apache2 module | Filebeat - No results found](https://discuss.elastic.co/t/apache2-module-filebeat-no-results-found/120897)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 6\ **Last updated:** [March 11, 2018, 1:55am UTC](https://discuss.elastic.co/t/apache2-module-filebeat-no-results-found/120897 "2018-03-11T01:55:56Z")
I'm trying to Configure the module and even though I see events inside of my %{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-%{+YYYY.MM.dd} whenever I open Filebeat Apache2 Dashboard via Kibana all I see is: No results fo… --- ## [MySQL SHOW PROCESSLIST?](https://discuss.elastic.co/t/mysql-show-processlist/122943)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 1\ **Last updated:** [March 9, 2018, 6:51pm UTC](https://discuss.elastic.co/t/mysql-show-processlist/122943 "2018-03-09T18:51:27Z")
Does Metricbeat have the ability to SHOW PROCESSLIST and output it ES currently? --- ## [Send collected metrics to a custom collector](https://discuss.elastic.co/t/send-collected-metrics-to-a-custom-collector/122795)
**Author:** [@musician](https://discuss.elastic.co/u/musician)\ **Replies:** 1\ **Last updated:** [March 9, 2018, 6:13pm UTC](https://discuss.elastic.co/t/send-collected-metrics-to-a-custom-collector/122795 "2018-03-09T18:13:45Z")
Is it possible to configure Metricsbeat to send the collected metrics to a custom collector running on a remote machine? --- ## [Auditbeat with Redis](https://discuss.elastic.co/t/auditbeat-with-redis/122336)
**Author:** [@run4fun3](https://discuss.elastic.co/u/run4fun3)\ **Replies:** 2\ **Last updated:** [March 9, 2018, 4:17pm UTC](https://discuss.elastic.co/t/auditbeat-with-redis/122336 "2018-03-09T16:17:01Z")
I'm wanting to setup auditbeat to do file integrity monitoring and want to send it to my already existing ELK stack. Right now I have logstash going to redis then logstash pulls the logs down and sends them to elasticsea… --- ## [Filebeat disk usage exception](https://discuss.elastic.co/t/filebeat-disk-usage-exception/122431)
**Author:** [@timchenxiaoyu](https://discuss.elastic.co/u/timchenxiaoyu)\ **Replies:** 1\ **Last updated:** [March 9, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-disk-usage-exception/122431 "2018-03-09T14:10:22Z")
version 6.0.0-alpha1 Operating System: centos7.1 Steps to Reproduce: root@slave-219 ~\]# lsof | grep delete | wc -l 15963 \[root@slave-219 ~\]# docker restart 6c093d9fbbae (filebeat container) 6c093d9fbbae \[root@slav… --- ## [Filebeat with local log apache2](https://discuss.elastic.co/t/filebeat-with-local-log-apache2/123267)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 1\ **Last updated:** [March 9, 2018, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-with-local-log-apache2/123267 "2018-03-09T13:54:59Z")
Good evening I have a problem with loading access apache2. I installed filebeat and I did the following command sudo filebeat setup -e sudo filebeat modules enable apache2 At the end I did the command sudo filebeat… --- ## [Can Auditbeat help to tell the difference between a read and a copy of files?](https://discuss.elastic.co/t/can-auditbeat-help-to-tell-the-difference-between-a-read-and-a-copy-of-files/123233)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 2\ **Last updated:** [March 9, 2018, 1:41pm UTC](https://discuss.elastic.co/t/can-auditbeat-help-to-tell-the-difference-between-a-read-and-a-copy-of-files/123233 "2018-03-09T13:41:22Z")
The primary reason for creating the monitoring that we are putting in place is to check when people are copying code from the server for improper reasons. From what I can see, there is very little difference, if any, be… --- ## [SOAP Request 415 error](https://discuss.elastic.co/t/soap-request-415-error/122877)
**Author:** [@rams134](https://discuss.elastic.co/u/rams134)\ **Replies:** 1\ **Last updated:** [March 8, 2018, 9:58pm UTC](https://discuss.elastic.co/t/soap-request-415-error/122877 "2018-03-08T21:58:57Z")
Hi , I am trying heartbeat feature for sending the soap request to listen the custom response. I am getting 415 exception. Kindly help . both .svc and ?wsl url's are showing same error. when i am running this wuth curl,… --- ## [Unable to change index name for Filebeat](https://discuss.elastic.co/t/unable-to-change-index-name-for-filebeat/122890)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 2\ **Last updated:** [March 8, 2018, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-change-index-name-for-filebeat/122890 "2018-03-08T20:25:18Z")
Hello, I am trying to change index name for filebeat configuration and it still complain about missing template name and pattern. After googling and checking documentation I have finished with this configration syntax: … --- ## [How to enable system.process.cpu.total.norm.pct?](https://discuss.elastic.co/t/how-to-enable-system-process-cpu-total-norm-pct/122724)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 1\ **Last updated:** [March 8, 2018, 5:46pm UTC](https://discuss.elastic.co/t/how-to-enable-system-process-cpu-total-norm-pct/122724 "2018-03-08T17:46:44Z")
Version 6.2.2 I've looked through the docs but can't seem to find how to enable this. We'd like to use this since processes in the dashboard are showing currently at several hundred percent utilization. Update: I've go… --- ## [Create full single log file in one message event through filebeat?](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049)
**Author:** [@zakkhan](https://discuss.elastic.co/u/zakkhan)\ **Replies:** 2\ **Last updated:** [March 8, 2018, 12:44pm UTC](https://discuss.elastic.co/t/create-full-single-log-file-in-one-message-event-through-filebeat/123049 "2018-03-08T12:44:52Z")
By default, Filebeat parse log files line by line and create message events after every new line. Is there any way i can have whole log file in one message event instead of chunks in elastic search. --- ## [Filebeat include\_lines problem](https://discuss.elastic.co/t/filebeat-include-lines-problem/122200)
**Author:** [@beitiantian](https://discuss.elastic.co/u/beitiantian)\ **Replies:** 2\ **Last updated:** [March 7, 2018, 1:56am UTC](https://discuss.elastic.co/t/filebeat-include-lines-problem/122200 "2018-03-07T01:56:22Z")
I want to extract the logs that include the "FaceLogBean" ，Configuration file is： filebeat.prospectors: - input\_type: log document\_type: cloud paths: - /usr/logs/\*.log include\_lines:\["F… --- ## [How to use rolllover index in filebeat configuration](https://discuss.elastic.co/t/how-to-use-rolllover-index-in-filebeat-configuration/121557)
**Author:** [@Rohit\_Vyavahare](https://discuss.elastic.co/u/Rohit_Vyavahare)\ **Replies:** 5\ **Last updated:** [March 6, 2018, 8:37pm UTC](https://discuss.elastic.co/t/how-to-use-rolllover-index-in-filebeat-configuration/121557 "2018-03-06T20:37:08Z")
I am using filebeat to put all logs from kubernetes into elasticsearch. Here is snippet of my filebeat config file : output.elasticsearch: hosts: \['${ELASTICSEARCH\_HOST:elasticsearch}:${ELASTICSEARCH\_PORT:920… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=467) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=469)