# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=475 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 476 --- ## [How to monitor network traffic of specific URL by using packebeat](https://discuss.elastic.co/t/how-to-monitor-network-traffic-of-specific-url-by-using-packebeat/116818)
**Author:** [@babu.ganesh0708](https://discuss.elastic.co/u/babu.ganesh0708)\ **Replies:** 9\ **Last updated:** [February 2, 2018, 4:35pm UTC](https://discuss.elastic.co/t/how-to-monitor-network-traffic-of-specific-url-by-using-packebeat/116818 "2018-02-02T16:35:56Z")
Hi All, I am using packetbeat to monitor application server network traffic and building the dashboard based on the data captured. I would like to know is there any way in packetbeat to specify the URL (Ex:- https://ww… --- ## [Log through Filebeat has hex values, but direct to Logstash does not](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123)
**Author:** [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 4:13pm UTC](https://discuss.elastic.co/t/log-through-filebeat-has-hex-values-but-direct-to-logstash-does-not/118123 "2018-02-02T16:13:30Z")
ELK 6.0.0/Filebeat 6.0.0 Logs are single line json: {"msg":"Logger in Debug mode","sev":"DEBUG","ts":"2017-11-15T19:38:44:0223Z"} This works fine: $ nc localhost 5044 \< json-log.log Same file put in Filebeat log dir… --- ## [Error Start Service Packetbeat](https://discuss.elastic.co/t/error-start-service-packetbeat/118051)
**Author:** [@nicolas1](https://discuss.elastic.co/u/nicolas1)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 2:45pm UTC](https://discuss.elastic.co/t/error-start-service-packetbeat/118051 "2018-02-02T14:45:40Z")
Hello, i have a problem for start packetbeat Service I have execute this command D:\\LogHost\\packetbeat-6.1.3-windows-x86\_64\\packetbeat.exe -c D:\\LogHost\\packetbeat-6.1.3-windows-x86\_64\\packetbeat.yml -e -v -d "\*" And i… --- ## [Filebeat addad an entry multiple times](https://discuss.elastic.co/t/filebeat-addad-an-entry-multiple-times/118035)
**Author:** [@Mojster](https://discuss.elastic.co/u/Mojster)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 10:19am UTC](https://discuss.elastic.co/t/filebeat-addad-an-entry-multiple-times/118035 "2018-02-02T10:19:33Z")
I'm running ES stack 6.1.2. Filebeat is adding some lines multiple time from our log. The lines are added with the same @timestamp. How can I prevent this. This never appeared on 5.x versions. --- ## [How to create custom fields filein filebeat to preprocess before transporting to elasticsearch](https://discuss.elastic.co/t/how-to-create-custom-fields-filein-filebeat-to-preprocess-before-transporting-to-elasticsearch/118094)
**Author:** [@akshaynshah](https://discuss.elastic.co/u/akshaynshah)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 12:27pm UTC](https://discuss.elastic.co/t/how-to-create-custom-fields-filein-filebeat-to-preprocess-before-transporting-to-elasticsearch/118094 "2018-02-02T12:27:07Z")
My Log Format: Time Hostname Severity Program Message My log line example: 2018-02-01T21:1147+05:30 freebsd notice sshd Exiting on signal 15 I want filebeat to transfer these logs to elastic search (WITHOUT L… --- ## [Logstash didn't receive Filebeat data](https://discuss.elastic.co/t/logstash-didnt-receive-filebeat-data/117920)
**Author:** [@tracywan](https://discuss.elastic.co/u/tracywan)\ **Replies:** 9\ **Last updated:** [February 2, 2018, 11:04am UTC](https://discuss.elastic.co/t/logstash-didnt-receive-filebeat-data/117920 "2018-02-02T11:04:47Z")
Hi, I configured filebeat on my mac os local, logstash on the vm with public internet. But I didn't see the filebeat client logs coming through, not on the logstash debug logs, not on the kibana either. Logstash was us… --- ## [Filebeat CPU usage 400%+](https://discuss.elastic.co/t/filebeat-cpu-usage-400/116095)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 5\ **Last updated:** [February 1, 2018, 6:18pm UTC](https://discuss.elastic.co/t/filebeat-cpu-usage-400/116095 "2018-02-01T18:18:45Z")
Good Morning, I have installed and started my filebeat(5.5) agent on a set of servers and I am seeing a very high CPU usage by Filebeat. I recently added the stanzas max\_proc: 2 & scan\_frequency: 30s because I read on a… --- ## [Filter when field is missing](https://discuss.elastic.co/t/filter-when-field-is-missing/116719)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 3\ **Last updated:** [February 1, 2018, 5:17pm UTC](https://discuss.elastic.co/t/filter-when-field-is-missing/116719 "2018-02-01T17:17:03Z")
I need to be able to build a drop rule when a filed is missing from the event, I'm not currently able to filter and do not see any conditions that would help with this. Example: processors: - drop\_event.when: and: … --- ## [Parsing HTTP logs](https://discuss.elastic.co/t/parsing-http-logs/114571)
**Author:** [@a\_kasireddy](https://discuss.elastic.co/u/a_kasireddy)\ **Replies:** 14\ **Last updated:** [February 1, 2018, 5:05pm UTC](https://discuss.elastic.co/t/parsing-http-logs/114571 "2018-02-01T17:05:21Z")
Hello All, I'm trying to parse http logs using filebeat and am running into some issues parsing the ip information. We have the X-FORWARDED-FOR header enabled, which is sending two ip's for some of the calls we get (be… --- ## [Packet loss while decoding REDIS protocol data](https://discuss.elastic.co/t/packet-loss-while-decoding-redis-protocol-data/116970)
**Author:** [@zjxian](https://discuss.elastic.co/u/zjxian)\ **Replies:** 8\ **Last updated:** [February 1, 2018, 3:33pm UTC](https://discuss.elastic.co/t/packet-loss-while-decoding-redis-protocol-data/116970 "2018-02-01T15:33:56Z")
We're planning on monitor REDIS protocol communication with packetbeat. What we want from packetbeat is to decode and record REDIS commands between server and clients. The test environment is somewhat like this: Redi… --- ## [Can filebeat alert if the log file is not updated or no fresh logs?](https://discuss.elastic.co/t/can-filebeat-alert-if-the-log-file-is-not-updated-or-no-fresh-logs/117928)
**Author:** [@Vedi](https://discuss.elastic.co/u/Vedi)\ **Replies:** 2\ **Last updated:** [February 1, 2018, 3:18pm UTC](https://discuss.elastic.co/t/can-filebeat-alert-if-the-log-file-is-not-updated-or-no-fresh-logs/117928 "2018-02-01T15:18:11Z")
If there are no fresh logs, does filebeat alert logstash or send some warnings? if not, Is there a way to alert logstash when the logs are not loading in my server because the application is hung or failed.? Any help w… --- ## [How to customize beat host name or beat name](https://discuss.elastic.co/t/how-to-customize-beat-host-name-or-beat-name/117968)
**Author:** [@Lory\_Hou](https://discuss.elastic.co/u/Lory_Hou)\ **Replies:** 3\ **Last updated:** [February 1, 2018, 2:06pm UTC](https://discuss.elastic.co/t/how-to-customize-beat-host-name-or-beat-name/117968 "2018-02-01T14:06:54Z")
I am using metricbeat to collect system performance via docker installation. The beat.name and beat.hostname is the b60271bea7a3 which is not readable. Can I customize it via docker-compose file, like ··· environment: … --- ## [Which file I need to config "path.home: /usr/share/beat path.config: /etc/beat path.data: /var/lib/beat path.logs: /var/log/"](https://discuss.elastic.co/t/which-file-i-need-to-config-path-home-usr-share-beat-path-config-etc-beat-path-data-var-lib-beat-path-logs-var-log/117973)
**Author:** [@Deepak\_Ts](https://discuss.elastic.co/u/Deepak_Ts)\ **Replies:** 1\ **Last updated:** [February 1, 2018, 1:00pm UTC](https://discuss.elastic.co/t/which-file-i-need-to-config-path-home-usr-share-beat-path-config-etc-beat-path-data-var-lib-beat-path-logs-var-log/117973 "2018-02-01T13:00:20Z")
In which file i need to config path.home: /usr/share/beat path.config: /etc/beat path.data: /var/lib/beat path.logs: /var/log/ and what are the prerequisites config before I start these config --- ## [Filebeat and Kubernetes: excluding log files](https://discuss.elastic.co/t/filebeat-and-kubernetes-excluding-log-files/117837)
**Author:** [@jeremievallee](https://discuss.elastic.co/u/jeremievallee)\ **Replies:** 11\ **Last updated:** [February 1, 2018, 11:35am UTC](https://discuss.elastic.co/t/filebeat-and-kubernetes-excluding-log-files/117837 "2018-02-01T11:35:21Z")
Hi there, I'm having trouble configuring filebeat on Kubernetes. Let's say you want filebeat to get the containers logs from Kubernetes, but you would like to exclude some files (for example because you don't want to g… --- ## [Can filebeat export syslogs to remote syslog-server?](https://discuss.elastic.co/t/can-filebeat-export-syslogs-to-remote-syslog-server/117912)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 1\ **Last updated:** [February 1, 2018, 11:26am UTC](https://discuss.elastic.co/t/can-filebeat-export-syslogs-to-remote-syslog-server/117912 "2018-02-01T11:26:15Z")
Without using Logstash, is there a way to export syslog messages using Filebeat to Remote Syslog-server ? Looking at filebeat documentation for output options, I dont see remote logging to syslog-server. Looks like log… --- ## [Cannot setup SSL for Filebeat to Logstash](https://discuss.elastic.co/t/cannot-setup-ssl-for-filebeat-to-logstash/117785)
**Author:** [@Luke\_Briner](https://discuss.elastic.co/u/Luke_Briner)\ **Replies:** 8\ **Last updated:** [February 1, 2018, 11:08am UTC](https://discuss.elastic.co/t/cannot-setup-ssl-for-filebeat-to-logstash/117785 "2018-02-01T11:08:33Z")
Filebeat version 6.1 for Windows Logstash version 6.1 on Ubuntu 16:04 Curl running from Ubuntu 16:04 I've followed the instructions https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html … --- ## [Flag redefinition crash](https://discuss.elastic.co/t/flag-redefinition-crash/117850)
**Author:** [@sujithattinad](https://discuss.elastic.co/u/sujithattinad)\ **Replies:** 5\ **Last updated:** [February 1, 2018, 8:45am UTC](https://discuss.elastic.co/t/flag-redefinition-crash/117850 "2018-02-01T08:45:39Z")
while executing custom metric beat it shows the following error log run command : ./cantiz-iot-beat-cassandra -e Out put ./cantiz-iot-beat-cassandra flag redefined: v \`panic: ./cantiz-iot-beat-cassandra flag r… --- ## [Reading packet from a lot of .pcap file?](https://discuss.elastic.co/t/reading-packet-from-a-lot-of-pcap-file/117746)
**Author:** [@wangyufeng0615](https://discuss.elastic.co/u/wangyufeng0615)\ **Replies:** 2\ **Last updated:** [February 1, 2018, 5:04am UTC](https://discuss.elastic.co/t/reading-packet-from-a-lot-of-pcap-file/117746 "2018-02-01T05:04:17Z")
Hello everyone, I have a lot of .pcap file in one folder (~10,000). I want import this data to elasticsearch. As I know, flag "-I" can import just one .pcap file at one time. Is there any way I can do this? Thanks a l… --- ## [Packetbeat Error: x509 Certificate is valid for X, not Y](https://discuss.elastic.co/t/packetbeat-error-x509-certificate-is-valid-for-x-not-y/116121)
**Author:** [@adam.wendling](https://discuss.elastic.co/u/adam.wendling)\ **Replies:** 12\ **Last updated:** [January 31, 2018, 5:47pm UTC](https://discuss.elastic.co/t/packetbeat-error-x509-certificate-is-valid-for-x-not-y/116121 "2018-01-31T17:47:41Z")
I had packetbeat running no problem until I introduced SSL into the mix. I changed my server name in the mix of this. Packetbeat is looking for the certificate for "oldeservername" and I need it to be "newservername". Th… --- ## [Load metricbeat sample dashboards in 6.1.2](https://discuss.elastic.co/t/load-metricbeat-sample-dashboards-in-6-1-2/116753)
**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\ **Replies:** 3\ **Last updated:** [January 31, 2018, 3:39pm UTC](https://discuss.elastic.co/t/load-metricbeat-sample-dashboards-in-6-1-2/116753 "2018-01-31T15:39:53Z")
just wondering so many options changed in ES 6.1.2 version wondersing how to load beats-dashboards-6.1.2.zip now previously in 5.X followed like this \[root@localhost\]# pwd /usr/share/metricbeat/scripts \[root@localhost\]… --- ## [Get timestamp from log lines](https://discuss.elastic.co/t/get-timestamp-from-log-lines/117816)
**Author:** [@tkzv](https://discuss.elastic.co/u/tkzv)\ **Replies:** 3\ **Last updated:** [January 31, 2018, 3:38pm UTC](https://discuss.elastic.co/t/get-timestamp-from-log-lines/117816 "2018-01-31T15:38:13Z")
I'm using Filebeat to read logs in two different formats. Each portion of information is prefixed with timestamp in either "YYYYMMDD-hhmmss" or "MM.DD.YY hh:mm:ss" format. I use 2 different prospectors to merge lines for… --- ## [Filebeat setup question](https://discuss.elastic.co/t/filebeat-setup-question/117740)
**Author:** [@hongkei](https://discuss.elastic.co/u/hongkei)\ **Replies:** 1\ **Last updated:** [January 31, 2018, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-setup-question/117740 "2018-01-31T15:28:05Z")
Is it a program that works continuously without running it again once it's installed? When you run an Apache Kafka customer, it looks like a filebeat runs automatically. Is there a problem? --- ## [Transport to logstash over HTTP](https://discuss.elastic.co/t/transport-to-logstash-over-http/117757)
**Author:** [@akshaynshah](https://discuss.elastic.co/u/akshaynshah)\ **Replies:** 1\ **Last updated:** [January 31, 2018, 3:01pm UTC](https://discuss.elastic.co/t/transport-to-logstash-over-http/117757 "2018-01-31T15:01:27Z")
I want to transport the logs using Filebeat on a FreeBSD box to a logstash server over HTTP due to some restrictions Is there a way to use HTTP (port 80)? --- ## [Mysql & ssl](https://discuss.elastic.co/t/mysql-ssl/117726)
**Author:** [@piingluo](https://discuss.elastic.co/u/piingluo)\ **Replies:** 1\ **Last updated:** [January 31, 2018, 2:57pm UTC](https://discuss.elastic.co/t/mysql-ssl/117726 "2018-01-31T14:57:09Z")
i have a doubt in packetbeat， Does packetbeat support monitor the 3306 port if mysql used SSL? --- ## [Periodically updated log file](https://discuss.elastic.co/t/periodically-updated-log-file/117215)
**Author:** [@ahirri](https://discuss.elastic.co/u/ahirri)\ **Replies:** 8\ **Last updated:** [January 31, 2018, 2:00pm UTC](https://discuss.elastic.co/t/periodically-updated-log-file/117215 "2018-01-31T14:00:38Z")
Hello We're using FileBeat 5.6.5 to handle a specific application logs. This log file is updated every 15 minutes using SSH mirror: every 15 minutes, the file is replaced with a new one from a remote server. FileBeat d… --- ## [Multiple metricbeat index for each host](https://discuss.elastic.co/t/multiple-metricbeat-index-for-each-host/117674)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 4\ **Last updated:** [January 31, 2018, 12:42pm UTC](https://discuss.elastic.co/t/multiple-metricbeat-index-for-each-host/117674 "2018-01-31T12:42:03Z")
Currently i am sending metricbeat data from all the server directly to elastichost:9200. This way metricbeat data from all the server sends data to single metricbeat-dataIs it possible to create separate index for metric… --- ## [Filebeat is taking too long to pick up new files](https://discuss.elastic.co/t/filebeat-is-taking-too-long-to-pick-up-new-files/117450)
**Author:** [@shankar1](https://discuss.elastic.co/u/shankar1)\ **Replies:** 3\ **Last updated:** [January 31, 2018, 6:32am UTC](https://discuss.elastic.co/t/filebeat-is-taking-too-long-to-pick-up-new-files/117450 "2018-01-31T06:32:40Z")
Problem : Initially the time taken between posting a new file and picking up by the filebeat harvester was fast (seconds). After a week I realized that filebeat speed of picking up got reduced (minutes / hours) and few… --- ## [Add\_locale is inserting wrong timezone](https://discuss.elastic.co/t/add-locale-is-inserting-wrong-timezone/117259)
**Author:** [@John\_Lofgren](https://discuss.elastic.co/u/John_Lofgren)\ **Replies:** 6\ **Last updated:** [January 30, 2018, 11:36pm UTC](https://discuss.elastic.co/t/add-locale-is-inserting-wrong-timezone/117259 "2018-01-30T23:36:03Z")
I am using filebeat -\> logstash -\> elasticsearch. I am trying to harvest a log file that uses timestamps in the machine's local timezone, but without any explicit indication of what the timezone is. Example: \[2018-01-2… --- ## [\[RequestConfiguration\] No configuration found for configured tags!](https://discuss.elastic.co/t/requestconfiguration-no-configuration-found-for-configured-tags/117543)
**Author:** [@daytonpa](https://discuss.elastic.co/u/daytonpa)\ **Replies:** 8\ **Last updated:** [January 30, 2018, 8:59pm UTC](https://discuss.elastic.co/t/requestconfiguration-no-configuration-found-for-configured-tags/117543 "2018-01-30T20:59:38Z")
I have been playing aoround with this error for some time now, but I cannot seem to resolve it. /var/log/graylog/collector-sidecar/collector\_sidecar.log: time="2018-01-29T22:23:01Z" level=info msg="Stopping signal dist… --- ## [Step 3 - Init and create the metricset failure](https://discuss.elastic.co/t/step-3-init-and-create-the-metricset-failure/112046)
**Author:** [@rvigeant](https://discuss.elastic.co/u/rvigeant)\ **Replies:** 13\ **Last updated:** [January 30, 2018, 8:39pm UTC](https://discuss.elastic.co/t/step-3-init-and-create-the-metricset-failure/112046 "2018-01-30T20:39:18Z")
Hi, I know the same problem has been reported before but what I do is exactly what apparently solved the problem for the other developer. I am trying to create a beat based on metricbeat and I am following the recipe d… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=474) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=476)