# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=486 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 487 --- ## [Sending Auditbeat data to Logstash](https://discuss.elastic.co/t/sending-auditbeat-data-to-logstash/110420)
**Author:** [@ramzey1981](https://discuss.elastic.co/u/ramzey1981)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 3:56pm UTC](https://discuss.elastic.co/t/sending-auditbeat-data-to-logstash/110420 "2017-12-08T15:56:23Z")
hello folks Is it possible to send auditbeats data directly to logstash for ingesting rather than directly to elasticsearch. I am doing something similar in filebeats and wanted to know if i can use logastash as an ing… --- ## [Solarwinds logs to Kibana?](https://discuss.elastic.co/t/solarwinds-logs-to-kibana/110861)
**Author:** [@plmartinez](https://discuss.elastic.co/u/plmartinez)\ **Replies:** 0\ **Last updated:** [December 8, 2017, 2:44pm UTC](https://discuss.elastic.co/t/solarwinds-logs-to-kibana/110861 "2017-12-08T14:44:04Z")
Trying to figure out how to forward Solarwinds logs to Kibana --- ## [Filebeat and system time](https://discuss.elastic.co/t/filebeat-and-system-time/110815)
**Author:** [@guillaume-lin](https://discuss.elastic.co/u/guillaume-lin)\ **Replies:** 0\ **Last updated:** [December 8, 2017, 10:05am UTC](https://discuss.elastic.co/t/filebeat-and-system-time/110815 "2017-12-08T10:05:39Z")
I have install filebeat in my testing machine to collect logs to elasticsearch. I found filebeat can not collect my logs, it seems that it's because I change my testing machines' sysmtem periodical. is there any option … --- ## [How to import the load-kibana-dashboards to es (5.6.4)](https://discuss.elastic.co/t/how-to-import-the-load-kibana-dashboards-to-es-5-6-4/110796)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 1\ **Last updated:** [December 8, 2017, 7:26am UTC](https://discuss.elastic.co/t/how-to-import-the-load-kibana-dashboards-to-es-5-6-4/110796 "2017-12-08T07:26:01Z")
how to import the load-kibana-dashboards to es, if not connect to internet. as: https://www.elastic.co/guide/en/beats/metricbeat/5.6/metricbeat-sample-dashboards.html#load-kibana-dashboards --- ## [RabbitMQ Queue metrics](https://discuss.elastic.co/t/rabbitmq-queue-metrics/110518)
**Author:** [@Ric](https://discuss.elastic.co/u/Ric)\ **Replies:** 5\ **Last updated:** [December 8, 2017, 7:19am UTC](https://discuss.elastic.co/t/rabbitmq-queue-metrics/110518 "2017-12-08T07:19:37Z")
Hi, New to ELK, I'm trying to setup RabbitMQ module of MetricBeat. Succeed in the "node" metricsets part: works well. In the doc MetricBeat RabbitMQ Module, there is a second metricsets documented : "queue". Looks li… --- ## [Filebeats\[6.0.0\] : Can not import Dashboard](https://discuss.elastic.co/t/filebeats-6-0-0-can-not-import-dashboard/110394)
**Author:** [@vincentzhang](https://discuss.elastic.co/u/vincentzhang)\ **Replies:** 2\ **Last updated:** [December 7, 2017, 3:43pm UTC](https://discuss.elastic.co/t/filebeats-6-0-0-can-not-import-dashboard/110394 "2017-12-07T15:43:43Z")
After set up the filebeat 6.0.0 version, I do the procedure as: and type the command ./filebeat setup --dashboards but meet the following message: Exiting: Error importing Kibana dashboards: fail to import the das… --- ## [Drop multiple fields with regex on field names using filebeat](https://discuss.elastic.co/t/drop-multiple-fields-with-regex-on-field-names-using-filebeat/110496)
**Author:** [@Haughtton](https://discuss.elastic.co/u/Haughtton)\ **Replies:** 4\ **Last updated:** [December 7, 2017, 2:14pm UTC](https://discuss.elastic.co/t/drop-multiple-fields-with-regex-on-field-names-using-filebeat/110496 "2017-12-07T14:14:13Z")
Hello, I'm trying to send a big json file through filebeat to elasticsearch but I have too many fields so I want to drop a lot a them. I saw on the doc that I can do this using the filebeat processor and I did smthing … --- ## [Error between filebeat and logstash](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311)
**Author:** [@kevin.didier](https://discuss.elastic.co/u/kevin.didier)\ **Replies:** 7\ **Last updated:** [December 7, 2017, 12:51pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311 "2017-12-07T12:51:12Z")
Hello, I have a problem to parse log from a windows sevrer 2012 with filebeat. The logstash is in a ubuntu server. The stack work fine beacause log from other linux server arrived correctly. I'm using ELK v6. I think… --- ## [Creating kafka topic automatically while sending logs from filebeat](https://discuss.elastic.co/t/creating-kafka-topic-automatically-while-sending-logs-from-filebeat/110563)
**Author:** [@Ferdous\_Shibly](https://discuss.elastic.co/u/Ferdous_Shibly)\ **Replies:** 1\ **Last updated:** [December 7, 2017, 12:42pm UTC](https://discuss.elastic.co/t/creating-kafka-topic-automatically-while-sending-logs-from-filebeat/110563 "2017-12-07T12:42:31Z")
is it possible to create kafka topic automatically based on the fields while sending logs from filebeat? I want to send logs from hosts through filebeat to kafka and it will create the topics automatically. And logstash … --- ## [Getsockopt: connection refused error while trying from Docker vm](https://discuss.elastic.co/t/getsockopt-connection-refused-error-while-trying-from-docker-vm/110460)
**Author:** [@Firdaus](https://discuss.elastic.co/u/Firdaus)\ **Replies:** 3\ **Last updated:** [December 7, 2017, 12:38pm UTC](https://discuss.elastic.co/t/getsockopt-connection-refused-error-while-trying-from-docker-vm/110460 "2017-12-07T12:38:25Z")
I have installed filebeat in a docker machine and trying to connect to ELK server but i get below error \[tomluser@tomlvmtest etc\]$ sudo systemctl status filebeat ● filebeat.service - filebeat Loaded: loaded (/usr/lib/… --- ## [Filebeat port configuration](https://discuss.elastic.co/t/filebeat-port-configuration/110578)
**Author:** [@Shreya\_Chatterjee](https://discuss.elastic.co/u/Shreya_Chatterjee)\ **Replies:** 3\ **Last updated:** [December 7, 2017, 6:08am UTC](https://discuss.elastic.co/t/filebeat-port-configuration/110578 "2017-12-07T06:08:20Z")
Hi! Im new to elastic search, I wish to send log files from filebeat to logstash. Filebeat log shows connection refused error as follows: 2017-12-07T02:43:07+05:30 ERR Failed to connect: dial tcp 127.0.0.1:9600: connect… --- ## [Filebeat 6.0.0 prospectors and fields](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602)
**Author:** [@panic](https://discuss.elastic.co/u/panic)\ **Replies:** 2\ **Last updated:** [December 7, 2017, 5:35am UTC](https://discuss.elastic.co/t/filebeat-6-0-0-prospectors-and-fields/110602 "2017-12-07T05:35:27Z")
Hi, I'm currently using filebeat 5.6.5 to extract data from specific log types with using the following configuration: filebeat.prospectors: - type: log paths: - /logfiles/x.log fields: document\_type: x … --- ## [Json Parsing to Elastic Search using filebeat](https://discuss.elastic.co/t/json-parsing-to-elastic-search-using-filebeat/110557)
**Author:** [@john.akash](https://discuss.elastic.co/u/john.akash)\ **Replies:** 1\ **Last updated:** [December 7, 2017, 3:54am UTC](https://discuss.elastic.co/t/json-parsing-to-elastic-search-using-filebeat/110557 "2017-12-07T03:54:19Z")
Hi Team, I am trying to push some audit logs which are in json format to ES from a docker container. Could you please let us know how can we perform it using filebeat (without logstash)? Filebeat Version: 6.0.0 Elasti… --- ## [GB/m transferred over time between hosts (internal & external)](https://discuss.elastic.co/t/gb-m-transferred-over-time-between-hosts-internal-external/110434)
**Author:** [@learner](https://discuss.elastic.co/u/learner)\ **Replies:** 4\ **Last updated:** [December 6, 2017, 12:30am UTC](https://discuss.elastic.co/t/gb-m-transferred-over-time-between-hosts-internal-external/110434 "2017-12-06T00:30:40Z")
I tried using Packetbeat to make a dashboard to show how much GB/m or TB/h transferred between various hosts in LAN and other hosts in and out, whether between internal hosts or between internal and external hosts. When… --- ## [Sanitizing Logs Before Shipping](https://discuss.elastic.co/t/sanitizing-logs-before-shipping/109134)
**Author:** [@Ossie](https://discuss.elastic.co/u/Ossie)\ **Replies:** 7\ **Last updated:** [December 6, 2017, 4:55pm UTC](https://discuss.elastic.co/t/sanitizing-logs-before-shipping/109134 "2017-12-06T16:55:06Z")
Hi, I currently have a situation where an application sometimes logs sensitive data to a file. I want to ship these logs using Filebeat but would prefer to sanitize the sensitive fields before they reach Elasticsearch.… --- ## [Put an intentional delay in event transmission to Logstash](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 8\ **Last updated:** [December 6, 2017, 4:24pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813 "2017-12-06T16:24:40Z")
I have a use-case where I want to delay individual events being transmitted via Filebeat to Logstash. This is due to a race condition I'm encountering with another monitoring mechanism. I've looked through the config op… --- ## [Problem about pushing oracle alert.log to es](https://discuss.elastic.co/t/problem-about-pushing-oracle-alert-log-to-es/110510)
**Author:** [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Replies:** 1\ **Last updated:** [December 6, 2017, 2:49pm UTC](https://discuss.elastic.co/t/problem-about-pushing-oracle-alert-log-to-es/110510 "2017-12-06T14:49:32Z")
Hi Guys, I'm trying to push oracle alert.log to es,like this: alert log-\>filebeat-\>logstash-\>elasticsearch alert log format like blow: Sun Mar 19 16:55:27 2017 DBRM started with pid=7, OS id=21297 Sun Mar 19 16:58:… --- ## [Send the updated lines of file to logstash without re-running the filebeat](https://discuss.elastic.co/t/send-the-updated-lines-of-file-to-logstash-without-re-running-the-filebeat/110347)
**Author:** [@npasha](https://discuss.elastic.co/u/npasha)\ **Replies:** 8\ **Last updated:** [December 6, 2017, 2:45pm UTC](https://discuss.elastic.co/t/send-the-updated-lines-of-file-to-logstash-without-re-running-the-filebeat/110347 "2017-12-06T14:45:29Z")
I configured the filebeat.yml with the prospector and sends the output to logstash parse and then send to elastic search. All worked fine. My question is if i append or modify the file, is it possible to send only the … --- ## [The load balancing algorithm followed by filebeat](https://discuss.elastic.co/t/the-load-balancing-algorithm-followed-by-filebeat/110376)
**Author:** [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\ **Replies:** 3\ **Last updated:** [December 6, 2017, 2:01pm UTC](https://discuss.elastic.co/t/the-load-balancing-algorithm-followed-by-filebeat/110376 "2017-12-06T14:01:28Z")
Hi The question I have is that , I have two Logstash Instances, running on same configuration VMs, with filebeat forwarding data to both the logstash instances. But I could find that one of the VM is indexing 22 MB dat… --- ## [Avoid buffer flush when no multiline pattern matches](https://discuss.elastic.co/t/avoid-buffer-flush-when-no-multiline-pattern-matches/110367)
**Author:** [@d32d7320202863361efe](https://discuss.elastic.co/u/d32d7320202863361efe)\ **Replies:** 3\ **Last updated:** [December 6, 2017, 1:50pm UTC](https://discuss.elastic.co/t/avoid-buffer-flush-when-no-multiline-pattern-matches/110367 "2017-12-06T13:50:15Z")
I encountered a certain problem when trying to create the multiline features in filebeat. I dont have online access to the examples right now, so I'll just present an abstraction of the situation. I have a certain log f… --- ## [Winlogbeats service sugestion](https://discuss.elastic.co/t/winlogbeats-service-sugestion/110436)
**Author:** [@AlvaroRivero](https://discuss.elastic.co/u/AlvaroRivero)\ **Replies:** 2\ **Last updated:** [December 6, 2017, 12:08pm UTC](https://discuss.elastic.co/t/winlogbeats-service-sugestion/110436 "2017-12-06T12:08:25Z")
HI everyone, this is my first post so be kind if im wrong (also excuse my non native english). Where do i make sugestion for Winlogbeat (or any other ELK part)?? So i was instaling my first ELK lab, version 5.6.2 was th… --- ## [Define localhost when loading sample Metricbeats dashboard](https://discuss.elastic.co/t/define-localhost-when-loading-sample-metricbeats-dashboard/110479)
**Author:** [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Replies:** 1\ **Last updated:** [December 6, 2017, 10:16am UTC](https://discuss.elastic.co/t/define-localhost-when-loading-sample-metricbeats-dashboard/110479 "2017-12-06T10:16:26Z")
Hi. I'm trying to load the sample Metricbeats dashboard using the setup command from this tutorial . However, I am using SSH to connect to the server. whenever I try to set the setup command it tell me it fails to conn… --- ## [Issue with Filbeat Config File](https://discuss.elastic.co/t/issue-with-filbeat-config-file/110288)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 2\ **Last updated:** [December 6, 2017, 6:02am UTC](https://discuss.elastic.co/t/issue-with-filbeat-config-file/110288 "2017-12-06T06:02:27Z")
Hi All, Below is my configuration file , ###################### Filebeat Configuration Example ######################### This file is an example configuration file highlighting only the most common options. The filebe… --- ## [Collecting data from Filebeat](https://discuss.elastic.co/t/collecting-data-from-filebeat/110354)
**Author:** [@Atul\_Harsha](https://discuss.elastic.co/u/Atul_Harsha)\ **Replies:** 1\ **Last updated:** [December 6, 2017, 4:03am UTC](https://discuss.elastic.co/t/collecting-data-from-filebeat/110354 "2017-12-06T04:03:22Z")
Hi! How can I use filebeat to collect data from a server, and configure the ELK stack to receive data from the filebeat? --- ## [Winlogbeat 6.0.0 Registry File](https://discuss.elastic.co/t/winlogbeat-6-0-0-registry-file/110384)
**Author:** [@KRasekhi](https://discuss.elastic.co/u/KRasekhi)\ **Replies:** 4\ **Last updated:** [December 5, 2017, 9:47pm UTC](https://discuss.elastic.co/t/winlogbeat-6-0-0-registry-file/110384 "2017-12-05T21:47:19Z")
Hi, I noticed that in 6.0 the registry file in c:\\ProgramData\\winlogbeat.winlogbeat.yml isn't populating the same - am i missing something or is this intentional? 6.0.0 update\_time: 2017-12-05T15:16:38.2530588Z event\_… --- ## [Output to Logstash - connection was forcibly closed by the remote host](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194)
**Author:** [@rudee](https://discuss.elastic.co/u/rudee)\ **Replies:** 2\ **Last updated:** [December 5, 2017, 9:05pm UTC](https://discuss.elastic.co/t/output-to-logstash-connection-was-forcibly-closed-by-the-remote-host/110194 "2017-12-05T21:05:02Z")
Hi I am trying to test the winlogbeat and Elasticsearch the version is 5.6.4 I am new to Elastic, so still finding my way around. (I have managed to get filebeat working and can see syslogs so the setup is working) W… --- ## [Publish logs from filebeat to multiple (2) logstash instances](https://discuss.elastic.co/t/publish-logs-from-filebeat-to-multiple-2-logstash-instances/109480)
**Author:** [@lokesha](https://discuss.elastic.co/u/lokesha)\ **Replies:** 3\ **Last updated:** [December 5, 2017, 5:57pm UTC](https://discuss.elastic.co/t/publish-logs-from-filebeat-to-multiple-2-logstash-instances/109480 "2017-12-05T17:57:58Z")
We have a requirement where we need to publish logs from filebeat to multiple logstash instances. Is there any way we can do this? --- ## [Winlogbeat Installation using Powershell ISE](https://discuss.elastic.co/t/winlogbeat-installation-using-powershell-ise/109433)
**Author:** [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\ **Replies:** 2\ **Last updated:** [December 5, 2017, 4:54pm UTC](https://discuss.elastic.co/t/winlogbeat-installation-using-powershell-ise/109433 "2017-12-05T16:54:36Z")
Hello, I am following the installation instructions for Winlogbeat here: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html However, I am running the code in the install-service-winlo… --- ## [Filebeat v6 and elasticsearch v6](https://discuss.elastic.co/t/filebeat-v6-and-elasticsearch-v6/107925)
**Author:** [@Gianluca\_Tranelli](https://discuss.elastic.co/u/Gianluca_Tranelli)\ **Replies:** 6\ **Last updated:** [December 5, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-v6-and-elasticsearch-v6/107925 "2017-12-05T15:54:27Z")
I set up filebeat and elasticsearch on the same machine and till v5.6 all was working good. Now in elasticsearch log i found the following error line each per event: 2017-11-16T12:45:06+01:00 WARN Can not index event (… --- ## [Filebeat does not resume logstash connections](https://discuss.elastic.co/t/filebeat-does-not-resume-logstash-connections/110370)
**Author:** [@Retenodus](https://discuss.elastic.co/u/Retenodus)\ **Replies:** 1\ **Last updated:** [December 5, 2017, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-does-not-resume-logstash-connections/110370 "2017-12-05T15:32:30Z")
Hello, I use filebeat 5.6 with logstash output (logstash is 5.2.2), using loadbalance: true et pipelining. Sometimes, there are disconnections between filebeats and logstash and I see messages like 2017-12-05T07:04:58+… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=485) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=487)