# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=480 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 481 --- ## [Newly installed metricbeat=\>logstash 6.0.0 Error (BeatsParser InvalidFrameProtocolException: Invalid Frame Type)](https://discuss.elastic.co/t/newly-installed-metricbeat-logstash-6-0-0-error-beatsparser-invalidframeprotocolexception-invalid-frame-type/115147)
**Author:** [@jamesliu\_london](https://discuss.elastic.co/u/jamesliu_london)\ **Replies:** 4\ **Last updated:** [January 11, 2018, 6:15pm UTC](https://discuss.elastic.co/t/newly-installed-metricbeat-logstash-6-0-0-error-beatsparser-invalidframeprotocolexception-invalid-frame-type/115147 "2018-01-11T18:15:19Z")
When connecting metricbeats to logstash, I'm metricbeats is unable to connect: "Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received" We have EL5.6+Xpack , Kib5.6 +Xpack… --- ## [Can not index events after upgrade](https://discuss.elastic.co/t/can-not-index-events-after-upgrade/115040)
**Author:** [@qubusp](https://discuss.elastic.co/u/qubusp)\ **Replies:** 1\ **Last updated:** [January 11, 2018, 6:09pm UTC](https://discuss.elastic.co/t/can-not-index-events-after-upgrade/115040 "2018-01-11T18:09:59Z")
I am having the following issue: 2018-01-11T08:56:58Z WARN Can not index event (status=400): {"type":"mapper\_parsing\_exception","reason":"Failed to parse mapping \[doc\]: Mapping definition for \[error\] has unsupported par… --- ## [Recommended way of telling Logstash type of logs](https://discuss.elastic.co/t/recommended-way-of-telling-logstash-type-of-logs/115004)
**Author:** [@joshuaspence](https://discuss.elastic.co/u/joshuaspence)\ **Replies:** 1\ **Last updated:** [January 11, 2018, 1:12pm UTC](https://discuss.elastic.co/t/recommended-way-of-telling-logstash-type-of-logs/115004 "2018-01-11T13:12:08Z")
In Filebeat 6 the document\_type field was removed. However, all of the examples that I can find for parsing logs with Logstash rely on the type field being set (which was determined by the document\_type setting on the Fi… --- ## [Response from logstash to pause filebeat?](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880)
**Author:** [@bigbird7821](https://discuss.elastic.co/u/bigbird7821)\ **Replies:** 1\ **Last updated:** [January 11, 2018, 12:34pm UTC](https://discuss.elastic.co/t/response-from-logstash-to-pause-filebeat/114880 "2018-01-11T12:34:31Z")
I have a bunch of filebeat servers pointing to the logstash cluster via a service discovery endpoint (via consul). When I bounce the elasticsearch cluster, I usually start by stopping the filebeats, then the logstash ag… --- ## [Filebeat unable to cope with incoming logs](https://discuss.elastic.co/t/filebeat-unable-to-cope-with-incoming-logs/114454)
**Author:** [@No\_Name](https://discuss.elastic.co/u/No_Name)\ **Replies:** 6\ **Last updated:** [January 11, 2018, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-cope-with-incoming-logs/114454 "2018-01-11T12:30:16Z")
Hello, I have a Filebeat which is processing 10-20GB nginx log file. I can't seem to process \>500 ouput/s (in measurement of over a 6hours period) to Logstash. I've read from existing topics to tune with parameters such… --- ## [Which type to use to just monitor TCP traffic/flows](https://discuss.elastic.co/t/which-type-to-use-to-just-monitor-tcp-traffic-flows/114839)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 5\ **Last updated:** [January 11, 2018, 12:25pm UTC](https://discuss.elastic.co/t/which-type-to-use-to-just-monitor-tcp-traffic-flows/114839 "2018-01-11T12:25:58Z")
Hi all, I am keen to monitor tcp network flows between two servers. Happens to be Tibco EMS traffic and I understand that the selection of protocol types is limited in Packetbeat but it also infers that you can just capt… --- ## [To make a table showing top hosts doing big outbound data transfer](https://discuss.elastic.co/t/to-make-a-table-showing-top-hosts-doing-big-outbound-data-transfer/110756)
**Author:** [@learner](https://discuss.elastic.co/u/learner)\ **Replies:** 6\ **Last updated:** [January 10, 2018, 7:20pm UTC](https://discuss.elastic.co/t/to-make-a-table-showing-top-hosts-doing-big-outbound-data-transfer/110756 "2018-01-10T19:20:44Z")
I want to make a table or a graph that shows top hosts / IPs uploading a large amount of data transfer to the outside domains. Probably I want a table/metric that shows: Out\_Bytes Source IP addresses (of internal … --- ## [Optional Fields Create Mapper Parsing Error](https://discuss.elastic.co/t/optional-fields-create-mapper-parsing-error/114726)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 5\ **Last updated:** [January 10, 2018, 12:41pm UTC](https://discuss.elastic.co/t/optional-fields-create-mapper-parsing-error/114726 "2018-01-10T12:41:14Z")
I use optional fields in Heartbeat and since the 6.x release I have been getting mapper\_parsing errors that fail to index the event on Elastic Search because of any optional field, once they are removed everything works. … --- ## [Multiline matching keeps failing](https://discuss.elastic.co/t/multiline-matching-keeps-failing/114867)
**Author:** [@atombob](https://discuss.elastic.co/u/atombob)\ **Replies:** 0\ **Last updated:** [January 10, 2018, 12:31pm UTC](https://discuss.elastic.co/t/multiline-matching-keeps-failing/114867 "2018-01-10T12:31:17Z")
I've been going at this for weeks now and I can't seem to wrap my head around what's wrong about this. I'm trying to get all of these lines to fit into a multiline match with grok, but it only picks up the last one, and… --- ## [Packetbeat installation issues](https://discuss.elastic.co/t/packetbeat-installation-issues/114528)
**Author:** [@purpleturtle99](https://discuss.elastic.co/u/purpleturtle99)\ **Replies:** 6\ **Last updated:** [January 10, 2018, 12:20pm UTC](https://discuss.elastic.co/t/packetbeat-installation-issues/114528 "2018-01-10T12:20:04Z")
I have installed Elastic search and Kibana on Fedora 27 and got them to work. But I would like to do network monitoring with packetbeat. When I follow the rpm install instructions as per : https://www.elastic.co/guide/e… --- ## [Feature Request - Process Information for Windows](https://discuss.elastic.co/t/feature-request-process-information-for-windows/114846)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 1\ **Last updated:** [January 10, 2018, 12:17pm UTC](https://discuss.elastic.co/t/feature-request-process-information-for-windows/114846 "2018-01-10T12:17:08Z")
Packetbeat has a nifty process monitor that can track flows even down to between processes running on the same server: packetbeat.procs: enabled: true monitored: - process: mysqld cmdline\_grep: mysqld Unfortunately… --- ## [Filebeat stops if there is any failure in ingest pipeline](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 3\ **Last updated:** [January 10, 2018, 7:59am UTC](https://discuss.elastic.co/t/filebeat-stops-if-there-is-any-failure-in-ingest-pipeline/114681 "2018-01-10T07:59:40Z")
Hi , I'm using filebeat --\>ingest pipeline --\>elasticsearch , and i'm using grok processor with set of log patterns under ingest pipeline . If there any log event which is not matching with grok processor patterns the… --- ## [Is document\_type in filebeat same as type in logstash filter?](https://discuss.elastic.co/t/is-document-type-in-filebeat-same-as-type-in-logstash-filter/114624)
**Author:** [@elkcurious](https://discuss.elastic.co/u/elkcurious)\ **Replies:** 2\ **Last updated:** [January 9, 2018, 7:34pm UTC](https://discuss.elastic.co/t/is-document-type-in-filebeat-same-as-type-in-logstash-filter/114624 "2018-01-09T19:34:54Z")
Hi, In 5.2.2 (filebeat & logstash), is the document\_type setting in filebeat accessible as the type in the logstash filter? I tried this based on the documentation and few other threads, but the logstash fingerprint blo… --- ## [org.elasticsearch.index.mapper.MapperParsingException: failed to parse \[error\]](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 4\ **Last updated:** [January 9, 2018, 4:47pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-failed-to-parse-error/113487 "2018-01-09T16:47:06Z")
I followed MySQL module | Filebeat Reference \[6.1\] | Elastic to configure filebeat's module: \[root@7svdbm01 ~\]# cat /etc/filebeat/modules.d/mysql.yml - module: mysql # Error logs error: enabled: true # Set… --- ## [Filebeat missing from 5.x repo for Red Hat](https://discuss.elastic.co/t/filebeat-missing-from-5-x-repo-for-red-hat/114731)
**Author:** [@erikpatton](https://discuss.elastic.co/u/erikpatton)\ **Replies:** 0\ **Last updated:** [January 9, 2018, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-missing-from-5-x-repo-for-red-hat/114731 "2018-01-09T16:05:47Z")
The filebeat RPM seems to have gone missing from the 5.x yum repo: # yum repository-packages logstash list all . . Available Packages elasticsearch.noarch 5.6.5-1 logstash … --- ## [Filebeat different logfiles to different backends](https://discuss.elastic.co/t/filebeat-different-logfiles-to-different-backends/114533)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [January 9, 2018, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-different-logfiles-to-different-backends/114533 "2018-01-09T15:03:39Z")
Hello, I am trying to use filebeat and send differnet log types but they need to end up in different indexes. My idea was to create different rules on logstash by listning on different ports and have them send every log… --- ## [Filebeat throws error while sending the logs to logstash](https://discuss.elastic.co/t/filebeat-throws-error-while-sending-the-logs-to-logstash/114724)
**Author:** [@gauravbhutani30](https://discuss.elastic.co/u/gauravbhutani30)\ **Replies:** 0\ **Last updated:** [January 9, 2018, 3:02pm UTC](https://discuss.elastic.co/t/filebeat-throws-error-while-sending-the-logs-to-logstash/114724 "2018-01-09T15:02:42Z")
Hi, I am trying to send logs from filebeat \> logstash and getting the following error: ERR Connecting error publishing events (retrying): dial tcp 127.0.0.1:5044: connectex: No connection could be made because the targ… --- ## [Missing field accessing 'path' accessing 'filebeat' (source:'filebeat.yml')](https://discuss.elastic.co/t/missing-field-accessing-path-accessing-filebeat-source-filebeat-yml/112849)
**Author:** [@teejayuu](https://discuss.elastic.co/u/teejayuu)\ **Replies:** 5\ **Last updated:** [January 9, 2018, 2:46pm UTC](https://discuss.elastic.co/t/missing-field-accessing-path-accessing-filebeat-source-filebeat-yml/112849 "2018-01-09T14:46:14Z")
Trying to work out why filebeat 6.1.0 is not shipping logs and ran the following from powershell .\\filebeat -v -e -d "config" and this was returned: PS D:\\Program Files\\filebeat-6.1.0\> .\\filebeat -v -e -d "config" fileb… --- ## [Beat autodiscover docker.sock permission denied on AWS ECS](https://discuss.elastic.co/t/beat-autodiscover-docker-sock-permission-denied-on-aws-ecs/114597)
**Author:** [@iseyer\_alx](https://discuss.elastic.co/u/iseyer_alx)\ **Replies:** 1\ **Last updated:** [January 9, 2018, 2:42pm UTC](https://discuss.elastic.co/t/beat-autodiscover-docker-sock-permission-denied-on-aws-ecs/114597 "2018-01-09T14:42:25Z")
Trying to use Autodiscover for both filebeat and metricbeat on AWS ECS cluster. However, I am getting /var/run/docker.sock/ Operation not committed when attempting to run both manually and with a task definition. I have … --- ## [Cannot see filebeat dashboards in kibana after installing and configuring them as per docs](https://discuss.elastic.co/t/cannot-see-filebeat-dashboards-in-kibana-after-installing-and-configuring-them-as-per-docs/114595)
**Author:** [@sconrod](https://discuss.elastic.co/u/sconrod)\ **Replies:** 1\ **Last updated:** [January 9, 2018, 2:26pm UTC](https://discuss.elastic.co/t/cannot-see-filebeat-dashboards-in-kibana-after-installing-and-configuring-them-as-per-docs/114595 "2018-01-09T14:26:39Z")
Hi I would greatly appreciate some help:0) I have installed filebeat, created the index, and I am receiving data to the index successfully. I have configured kibana to load the filebeat dashboards yet I am not seeing the… --- ## [New Feature: reading chunks of data in harvester](https://discuss.elastic.co/t/new-feature-reading-chunks-of-data-in-harvester/114390)
**Author:** [@r-ms](https://discuss.elastic.co/u/r-ms)\ **Replies:** 3\ **Last updated:** [January 9, 2018, 2:08pm UTC](https://discuss.elastic.co/t/new-feature-reading-chunks-of-data-in-harvester/114390 "2018-01-09T14:08:19Z")
Task: I want to use Filebeat for reading and processing log files, which consist of fixed size structures. In other words, each consecutive 120 bytes in that kind of files represent new chunk of data. I want to read th… --- ## [Incomplete data in ES](https://discuss.elastic.co/t/incomplete-data-in-es/113079)
**Author:** [@LoZio](https://discuss.elastic.co/u/LoZio)\ **Replies:** 10\ **Last updated:** [January 9, 2018, 10:06am UTC](https://discuss.elastic.co/t/incomplete-data-in-es/113079 "2018-01-09T10:06:08Z")
Using filebeat 6.1.1 to gather apache logs. It all started when I tried to change the index name for filebeat, and this seems to be a damn complicated thing despite seemingly an easy task in my mind. BTW I eventually re… --- ## [Filebeat, Logstash connection reset by peer](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479)
**Author:** [@DavidDebray](https://discuss.elastic.co/u/DavidDebray)\ **Replies:** 2\ **Last updated:** [January 9, 2018, 8:56am UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/114479 "2018-01-09T08:56:31Z")
Hi everyone! I'm new to ELK stack and have encountered a problem I can't seem to figure out... I currently have three machines in my ELK environment : syslog server (Logstash, ElasticSearch, Kibana) WAPT server (sofw… --- ## [Filebeat with Qradar](https://discuss.elastic.co/t/filebeat-with-qradar/114653)
**Author:** [@atangirala](https://discuss.elastic.co/u/atangirala)\ **Replies:** 0\ **Last updated:** [January 9, 2018, 7:06am UTC](https://discuss.elastic.co/t/filebeat-with-qradar/114653 "2018-01-09T07:06:46Z")
I want to forward my application logs to qradar SIEM tool using logstash/filebeat. How ever I can forward syslogs without any issue, can anyone help me with the setup? --- ## [New Install ELK 6.1.0 & Filebeat 6.1.0](https://discuss.elastic.co/t/new-install-elk-6-1-0-filebeat-6-1-0/112680)
**Author:** [@teejayuu](https://discuss.elastic.co/u/teejayuu)\ **Replies:** 3\ **Last updated:** [January 9, 2018, 5:01am UTC](https://discuss.elastic.co/t/new-install-elk-6-1-0-filebeat-6-1-0/112680 "2018-01-09T05:01:31Z")
I have just created a new install of ELK 6.1.0 and am trying to use Filebeat to ship IIS logs to logstash. The ELK stack appears to be working and the filebeat service has started. I've vreated firrewall exceptions on … --- ## [Metricbeat odd CPU percentage values](https://discuss.elastic.co/t/metricbeat-odd-cpu-percentage-values/114420)
**Author:** [@Zappelphilipp](https://discuss.elastic.co/u/Zappelphilipp)\ **Replies:** 3\ **Last updated:** [January 8, 2018, 11:57pm UTC](https://discuss.elastic.co/t/metricbeat-odd-cpu-percentage-values/114420 "2018-01-08T23:57:07Z")
hi, i am pretty new to the beats family and i am using metricbeat in a small invironment with Graylog and Kibana. There is one maschine which inputs me very strange values for the following items. i added some real valu… --- ## [Filebeat compress output to file not working](https://discuss.elastic.co/t/filebeat-compress-output-to-file-not-working/114434)
**Author:** [@Omair\_Khalid](https://discuss.elastic.co/u/Omair_Khalid)\ **Replies:** 4\ **Last updated:** [January 8, 2018, 10:46pm UTC](https://discuss.elastic.co/t/filebeat-compress-output-to-file-not-working/114434 "2018-01-08T22:46:22Z")
Hello, I am reading logs from a log file (as below) and then emitting the output into another file. Note: i am not emitting the output to ES or kafka e.t.c. But another file on some other location. I have been able to … --- ## [Metricbeat service terminates when \`or\` condition in \`drop\_event\`](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365)
**Author:** [@amjadcas](https://discuss.elastic.co/u/amjadcas)\ **Replies:** 2\ **Last updated:** [January 8, 2018, 10:45pm UTC](https://discuss.elastic.co/t/metricbeat-service-terminates-when-or-condition-in-drop-event/114365 "2018-01-08T22:45:13Z")
I'm using Metricbeat 6.1.1 on a Windows Server 2012. My goal is to monitor services, but not all. I'm using the drop\_event processor to exclude events and the or condition to specify the services to exclude. - module:… --- ## [Trying to get some more throughput from Winlogbeat](https://discuss.elastic.co/t/trying-to-get-some-more-throughput-from-winlogbeat/114606)
**Author:** [@John\_Schoonover](https://discuss.elastic.co/u/John_Schoonover)\ **Replies:** 1\ **Last updated:** [January 8, 2018, 8:24pm UTC](https://discuss.elastic.co/t/trying-to-get-some-more-throughput-from-winlogbeat/114606 "2018-01-08T20:24:15Z")
Hey all: I've recently installed Winlogbeat \[5.6\] to a server and am trying to increase throughput. It seems that I'm unable to get it to send \>300 events per second (as evidenced by my ELK monitoring cluster looking at… --- ## [Filebeat multiline splitting events - which timeout to tweak?](https://discuss.elastic.co/t/filebeat-multiline-splitting-events-which-timeout-to-tweak/114427)
**Author:** [@tehowe](https://discuss.elastic.co/u/tehowe)\ **Replies:** 2\ **Last updated:** [January 8, 2018, 3:59pm UTC](https://discuss.elastic.co/t/filebeat-multiline-splitting-events-which-timeout-to-tweak/114427 "2018-01-08T15:59:59Z")
Hey, I'm using Filebeat 6.1.1 on a number of Linux hosts. I'm prospecting apt-get logs, which look like this usually Start-Date: 2018-01-03 20:45:26 Commandline: /usr/bin/apt-get -y -o Dpkg::Options::=--force-confdef -… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=479) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=481)