# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=485 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 486 --- ## [The Packetbeat use es map how can use offline maps?](https://discuss.elastic.co/t/the-packetbeat-use-es-map-how-can-use-offline-maps/111261)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 1\ **Last updated:** [December 12, 2017, 7:57am UTC](https://discuss.elastic.co/t/the-packetbeat-use-es-map-how-can-use-offline-maps/111261 "2017-12-12T07:57:46Z")
the Packetbeat use es map how can use offline maps? --- ## [Issue with sending to Kafka 0.10.2.1 over TLS](https://discuss.elastic.co/t/issue-with-sending-to-kafka-0-10-2-1-over-tls/111252)
**Author:** [@Pepe](https://discuss.elastic.co/u/Pepe)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 7:23am UTC](https://discuss.elastic.co/t/issue-with-sending-to-kafka-0-10-2-1-over-tls/111252 "2017-12-12T07:23:18Z")
I've been trying to get Filebeat to work with Kafka over TLS and after numerous tries I've gotten Filebeat to connect and receive metadata, but I just can't get it to send messages to Kafka. My log looks something like t… --- ## [Correlation of Windows Event ID's](https://discuss.elastic.co/t/correlation-of-windows-event-ids/108235)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 9\ **Last updated:** [December 12, 2017, 5:45am UTC](https://discuss.elastic.co/t/correlation-of-windows-event-ids/108235 "2017-12-12T05:45:07Z")
I have a list of Windows Event ID's associated with APT activity but I only want it to pop into the dashboard if more than one event happens to the same workstation within a certain amount of time. Is this possible? If… --- ## [The map of kibana can't output](https://discuss.elastic.co/t/the-map-of-kibana-cant-output/111202)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 5:17am UTC](https://discuss.elastic.co/t/the-map-of-kibana-cant-output/111202 "2017-12-12T05:17:19Z")
Coordinate Map: Could not retrieve manifest from the tile service: status -1 \[image\] --- ## [Delete some characters in the line](https://discuss.elastic.co/t/delete-some-characters-in-the-line/111008)
**Author:** [@skywarp](https://discuss.elastic.co/u/skywarp)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 3:06am UTC](https://discuss.elastic.co/t/delete-some-characters-in-the-line/111008 "2017-12-12T03:06:58Z")
Hello! Can I use the "exclude\_lines" option to delete some characters in a string (for example: \<14\>) if I have "filebeat.prospectors: type - udp"? If not, how do I delete the fake characters? Filebeat output: "\<14\>{… --- ## [Metricbeat 6.0.0 modules.d\\windows.yml - missing counter failure to start service](https://discuss.elastic.co/t/metricbeat-6-0-0-modules-d-windows-yml-missing-counter-failure-to-start-service/110569)
**Author:** [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 2:32am UTC](https://discuss.elastic.co/t/metricbeat-6-0-0-modules-d-windows-yml-missing-counter-failure-to-start-service/110569 "2017-12-12T02:32:56Z")
Hi, If you have a defined perfmon counter in here and it does not exist on the machine the agent fails to start. Is this intentional or a bug? Example - 2017-12-06T14:21:06-05:00 CRIT Exiting: 1 error: 1 error: initia… --- ## [Clarifications regarding reload configuration](https://discuss.elastic.co/t/clarifications-regarding-reload-configuration/106284)
**Author:** [@system](https://discuss.elastic.co/u/system)\ **Replies:** 8\ **Last updated:** [December 12, 2017, 1:20am UTC](https://discuss.elastic.co/t/clarifications-regarding-reload-configuration/106284 "2017-12-12T01:20:48Z")
Based on the docs You can configure Filebeat to dynamically reload prospector configuration files when there are changes. To do this, you specify a path (Glob) to watch for prospector configuration changes. When the fi… --- ## [Packet log error tcp data length than packet](https://discuss.elastic.co/t/packet-log-error-tcp-data-length-than-packet/111204)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 0\ **Last updated:** [December 12, 2017, 1:11am UTC](https://discuss.elastic.co/t/packet-log-error-tcp-data-length-than-packet/111204 "2017-12-12T01:11:15Z")
2017-12-12T09:09:33+08:00 INFO packet decode failed with: TCP data offset greater than packet length 2017-12-12T09:09:35+08:00 INFO packet decode failed with: TCP data offset greater than packet length 2017-12-12T09:09:3… --- ## [Persistent i/o timeout errors on all beats](https://discuss.elastic.co/t/persistent-i-o-timeout-errors-on-all-beats/111183)
**Author:** [@ben.vanstaveren](https://discuss.elastic.co/u/ben.vanstaveren)\ **Replies:** 0\ **Last updated:** [December 11, 2017, 9:34pm UTC](https://discuss.elastic.co/t/persistent-i-o-timeout-errors-on-all-beats/111183 "2017-12-11T21:34:12Z")
Hi folks, I know, there's plenty of these topics around but they're either old, or have no resolution; and I'm looking for one. I'm seeing persistent i/o errors and connection reset by peer errors across all beats I run. … --- ## [Error: filebeat-5.6.3-x86\_64.rpm cannot be installed](https://discuss.elastic.co/t/error-filebeat-5-6-3-x86-64-rpm-cannot-be-installed/111167)
**Author:** [@marcuy](https://discuss.elastic.co/u/marcuy)\ **Replies:** 4\ **Last updated:** [December 11, 2017, 8:26pm UTC](https://discuss.elastic.co/t/error-filebeat-5-6-3-x86-64-rpm-cannot-be-installed/111167 "2017-12-11T20:26:20Z")
Hello, I´M trying to install filebeat in rhel 5.5 (tikanga) but I can't, this is the error: rpm -ivh filebeat-5.6.3-x86\_64.rpm error: filebeat-5.6.3-x86\_64.rpm: Header V4 RSA/SHA512 signature: BAD, key ID d88e42b4 er… --- ## [Connecting Filebeat to Azure Redis](https://discuss.elastic.co/t/connecting-filebeat-to-azure-redis/110909)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 3\ **Last updated:** [December 11, 2017, 8:01pm UTC](https://discuss.elastic.co/t/connecting-filebeat-to-azure-redis/110909 "2017-12-11T20:01:23Z")
I'm trying to use Filebeat to connect to Azure Redis. Filebeat version is 6.0, and azure redis (platform service) is version 3.2.7 as I see in azure. But, I'm not able to successfully ship any data to redis cache. Whe… --- ## [What is the best query in kibana to select logs just from one app?](https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136)
**Author:** [@przemolb](https://discuss.elastic.co/u/przemolb)\ **Replies:** 0\ **Last updated:** [December 11, 2017, 4:03pm UTC](https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136 "2017-12-11T16:03:30Z")
Hello, having the following filebeat and logstash configuration: # filebeat filebeat.prospectors: - input\_type: log paths: - /var/log/\* fields: type: system exclude\_files: \['\\.gz$', 'btmp\*', 'wtmp\*'\] cl… --- ## [Strange error - Can only start a prospector when all related states are finished](https://discuss.elastic.co/t/strange-error-can-only-start-a-prospector-when-all-related-states-are-finished/110982)
**Author:** [@Flaviu](https://discuss.elastic.co/u/Flaviu)\ **Replies:** 2\ **Last updated:** [December 11, 2017, 4:46pm UTC](https://discuss.elastic.co/t/strange-error-can-only-start-a-prospector-when-all-related-states-are-finished/110982 "2017-12-11T16:46:30Z")
Hello, I am getting this error messages every few minutes in /var/log/filebeat/filebeat 2017-12-10T19:08:52Z ERR Error creating prospector: Can only start a prospector when all related states are finished: {Id: Finish… --- ## [Filebeat dashboard creation via Docker errors on Kibana host](https://discuss.elastic.co/t/filebeat-dashboard-creation-via-docker-errors-on-kibana-host/110951)
**Author:** [@claflico](https://discuss.elastic.co/u/claflico)\ **Replies:** 3\ **Last updated:** [December 11, 2017, 3:49pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-creation-via-docker-errors-on-kibana-host/110951 "2017-12-11T15:49:53Z")
Trying to setup an ELK:6.0.1 stack and \*beat:6.0.1 via CentOS 7, Docker 17.09, & Rancher 1.6.12 for a presentation I'm giving this week at a DevOps MeetUp. Am trying to set everything up without having to create custom i… --- ## [A single global Filebeat.yml file with multiple application based .yml file](https://discuss.elastic.co/t/a-single-global-filebeat-yml-file-with-multiple-application-based-yml-file/110713)
**Author:** [@FreddyRaj](https://discuss.elastic.co/u/FreddyRaj)\ **Replies:** 2\ **Last updated:** [December 11, 2017, 3:39pm UTC](https://discuss.elastic.co/t/a-single-global-filebeat-yml-file-with-multiple-application-based-yml-file/110713 "2017-12-11T15:39:30Z")
Hi All, I have a requirement and trying to understand how to accomplish the same. I am using filebeat 5.5.0 and sending multiple application logs to logstash and Kibana for visualaliation Created a global yml file wit… --- ## [Docker packetbeat:6.0.1Operation not permitted](https://discuss.elastic.co/t/docker-packetbeat-6-0-1operation-not-permitted/110953)
**Author:** [@claflico](https://discuss.elastic.co/u/claflico)\ **Replies:** 2\ **Last updated:** [December 11, 2017, 3:30pm UTC](https://discuss.elastic.co/t/docker-packetbeat-6-0-1operation-not-permitted/110953 "2017-12-11T15:30:37Z")
Trying to run the packetbeat 6.0.1 container and getting an "Operation not permitted" error. docker run docker.elastic.co/beats/packetbeat:6.0.1 setup --template -E output.logstash.enabled=false -E 'output.elasticsearch… --- ## [Drop events if a field does not exist](https://discuss.elastic.co/t/drop-events-if-a-field-does-not-exist/111034)
**Author:** [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 2:10pm UTC](https://discuss.elastic.co/t/drop-events-if-a-field-does-not-exist/111034 "2017-12-11T14:10:05Z")
I would like drop events if a field does not exist in the doc. will the drop\_events config help here? --- ## [Filebeat multiline timeout](https://discuss.elastic.co/t/filebeat-multiline-timeout/110946)
**Author:** [@Shreya\_Chatterjee](https://discuss.elastic.co/u/Shreya_Chatterjee)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-multiline-timeout/110946 "2017-12-11T13:01:39Z")
excerpt from log file: 2017-11-06 11:54:43,333; \[LOG\_LEVEL=ALWAYS, CMPNT\_NM=com.fmr.ifeb.alayer.cache.ehcache.ApplicationCacheImpl, MESSAGE=Initialized cache named 'oscarJdbcDaxCache'\] 2017-11-06 11:54:43,344; \[LOG\_LEVE… --- ## [Filebeat once option does not works for modules](https://discuss.elastic.co/t/filebeat-once-option-does-not-works-for-modules/110973)
**Author:** [@tengattack](https://discuss.elastic.co/u/tengattack)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-once-option-does-not-works-for-modules/110973 "2017-12-11T12:47:35Z")
Hi all, I have a tons of nginx logs wants to transfer to elasticsearch through filebeat =\> logstash However, i want to do it slowly to ensure my elasticsearch functionality and only do only once But it seems not work. … --- ## [Filebeat modules problem](https://discuss.elastic.co/t/filebeat-modules-problem/110962)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 11:58am UTC](https://discuss.elastic.co/t/filebeat-modules-problem/110962 "2017-12-11T11:58:25Z")
EKL\_server:192.168.100.71 cat /etc/filebeat/filebeat.yml filebeat.prospectors: type: log enabled: true paths: /etc/filebeat/modules.d/system.yml reload.enabled: true reload.period: 10s filebeat.config.modul… --- ## [Can I get a hardware specification with metricbeat?](https://discuss.elastic.co/t/can-i-get-a-hardware-specification-with-metricbeat/111055)
**Author:** [@david\_k](https://discuss.elastic.co/u/david_k)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 11:32am UTC](https://discuss.elastic.co/t/can-i-get-a-hardware-specification-with-metricbeat/111055 "2017-12-11T11:32:56Z")
Hi all. Can I get a hardware specification with metricbeat? Or Can I calculate h/w specification with metricbeat system field? Thanks For example CPU - dual core 2.4 GHz RAM - 16 GB Hard Drive - 256 GB --- ## [Parsing the logs](https://discuss.elastic.co/t/parsing-the-logs/108095)
**Author:** [@Sniipe](https://discuss.elastic.co/u/Sniipe)\ **Replies:** 7\ **Last updated:** [December 11, 2017, 11:18am UTC](https://discuss.elastic.co/t/parsing-the-logs/108095 "2017-12-11T11:18:46Z")
Hi, I went to a devOpsDays event and saw ELK for the first time. I've it installed locally to test it out. Its working with filebeat =\> ElasticSearch =\> Kibana. I want to parse the message because it has the useful in… --- ## [Packetbeat use pipeline auto stop 5.6.4](https://discuss.elastic.co/t/packetbeat-use-pipeline-auto-stop-5-6-4/111033)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 0\ **Last updated:** [December 11, 2017, 8:40am UTC](https://discuss.elastic.co/t/packetbeat-use-pipeline-auto-stop-5-6-4/111033 "2017-12-11T08:40:59Z")
one instance is auto stop ,the other instance is can running.. \[root@hostname packetbeat-5.6.4-linux-x86\_64\]# ./packetbeat panic: runtime error: index out of range goroutine 25 \[running\]: panic(0xadbb60, 0xc42000c120)… --- ## [Clarification on transferred flows](https://discuss.elastic.co/t/clarification-on-transferred-flows/110586)
**Author:** [@learner](https://discuss.elastic.co/u/learner)\ **Replies:** 0\ **Last updated:** [December 7, 2017, 12:00am UTC](https://discuss.elastic.co/t/clarification-on-transferred-flows/110586 "2017-12-07T00:00:35Z")
Update: Although this thread has been closed with no response, my issue below has been resolved by adding a filter "final: true". The data transfer numbers in bytes are no longer backward-cumulative and now make sense wi… --- ## [Combining multiple beats into a single beat](https://discuss.elastic.co/t/combining-multiple-beats-into-a-single-beat/110781)
**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 10:06pm UTC](https://discuss.elastic.co/t/combining-multiple-beats-into-a-single-beat/110781 "2017-12-08T22:06:56Z")
Hi there, I know this topic has been discussed before (and I'd add to it if it wasn't closed Combining multiple beats into a single agent). However, I'd like to investigate how hard it would be for me as a developer (wi… --- ## [Duplication in Filebeat to Elasticsearch data pushing](https://discuss.elastic.co/t/duplication-in-filebeat-to-elasticsearch-data-pushing/110605)
**Author:** [@john.akash](https://discuss.elastic.co/u/john.akash)\ **Replies:** 4\ **Last updated:** [December 8, 2017, 7:05pm UTC](https://discuss.elastic.co/t/duplication-in-filebeat-to-elasticsearch-data-pushing/110605 "2017-12-08T19:05:09Z")
Hi Team, I am using a solution that reads JSON logs by filebeat and push the data to ES without logstasg. While I am checking I can see duplication in documentation. Could you please let us know how can we configure a… --- ## [Grok regular expression support in Filebeats](https://discuss.elastic.co/t/grok-regular-expression-support-in-filebeats/110880)
**Author:** [@ramon\_garcia](https://discuss.elastic.co/u/ramon_garcia)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 5:49pm UTC](https://discuss.elastic.co/t/grok-regular-expression-support-in-filebeats/110880 "2017-12-08T17:49:01Z")
Hello, I have developed Grok expression support in Beats. You can get the code from https://github.com/ramon-garcia/beats/tree/extend-processors/ (branch extended-processors). You can see the documentation here https:… --- ## [Filebeat x Logstash load balancing](https://discuss.elastic.co/t/filebeat-x-logstash-load-balancing/109927)
**Author:** [@eperpetuo](https://discuss.elastic.co/u/eperpetuo)\ **Replies:** 0\ **Last updated:** [December 1, 2017, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-x-logstash-load-balancing/109927 "2017-12-01T12:30:05Z")
Is is possible to use a load balancer (such as BigIP) between the filebeat and logstash instances? This way, in case I add a new Logstash instance it wouldn't be necessary to update the filebeat configs. --- ## [Content-Type header \[application/x-www-form-urlencoded\] is not supported","status":406](https://discuss.elastic.co/t/content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/110346)
**Author:** [@ravirjn](https://discuss.elastic.co/u/ravirjn)\ **Replies:** 1\ **Last updated:** [December 8, 2017, 4:06pm UTC](https://discuss.elastic.co/t/content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/110346 "2017-12-08T16:06:38Z")
Hi, I am installing a fresh ELK stack, when I am trying to load dashboard using load.sh script, I am getting error: Content-Type header \[application/x-www-form-urlencoded\] is not supported","status":406 My elastic sea… --- ## [Reload config](https://discuss.elastic.co/t/reload-config/110766)
**Author:** [@turnlikeawheel](https://discuss.elastic.co/u/turnlikeawheel)\ **Replies:** 1\ **Last updated:** [December 8, 2017, 4:04pm UTC](https://discuss.elastic.co/t/reload-config/110766 "2017-12-08T16:04:07Z")
Apologies if this has been answered before but I couldn't find anything in the docs or by searching the forums/Google. Does Winlogbeat have an automatic config reload option like Filebeat does? I need to make changes to… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=484) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=486)