# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=490 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 491 --- ## [How to break logs into different lines(events)](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264)
**Author:** [@Vishnu\_Garg](https://discuss.elastic.co/u/Vishnu_Garg)\ **Replies:** 1\ **Last updated:** [November 19, 2017, 8:19pm UTC](https://discuss.elastic.co/t/how-to-break-logs-into-different-lines-events/108264 "2017-11-19T20:19:21Z")
Hi Everyone, Thanks for help in advance. i have logs like : 2017-11-18 14:19:29 \[tomcat-http--850\] INFO 2017-11-18 14:19:29 \[tomcat-http--850\] INFO i want to set in "multiline.pattern:" a regex expression but what e… --- ## [Try to use heartbeat to ping thrift interface](https://discuss.elastic.co/t/try-to-use-heartbeat-to-ping-thrift-interface/108106)
**Author:** [@jiangzhileaf](https://discuss.elastic.co/u/jiangzhileaf)\ **Replies:** 2\ **Last updated:** [November 18, 2017, 4:36am UTC](https://discuss.elastic.co/t/try-to-use-heartbeat-to-ping-thrift-interface/108106 "2017-11-18T04:36:43Z")
try to use heartbeat to ping thrift interface(call ping method , receive string "pong") i ping through tcp and need to send a binary data as below: check.send: "\\x00\\x00\\x00\\x10\\x80\\x01\\x00\\x01\\x00\\x00\\x00\\x04\\x70\\x69\\… --- ## [Migrating from Filebeat 5.5.2 to 6.0.0](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 6\ **Last updated:** [November 17, 2017, 3:39pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968 "2017-11-17T15:39:15Z")
Hello World, I am trying to upgrade my filebeat agent and doing the following steps (on Windows): Stopping the filebeat service uninstalling the filebeat with the uninstall-service-winlogbeat.ps1 replacing the winlogb… --- ## [File and kernel metricsets does not work together](https://discuss.elastic.co/t/file-and-kernel-metricsets-does-not-work-together/108036)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 2\ **Last updated:** [November 17, 2017, 2:33pm UTC](https://discuss.elastic.co/t/file-and-kernel-metricsets-does-not-work-together/108036 "2017-11-17T14:33:12Z")
Hello, I am trying to setup auditbeat to monitor both logins to the systems and filechanges but if I enable the file metricset the kernel one stop sending data into elasticsearch. I have the following configuration: a… --- ## [Metricbeat: CPU percentages and normalized\_percentages](https://discuss.elastic.co/t/metricbeat-cpu-percentages-and-normalized-percentages/108137)
**Author:** [@Arkadiy\_Ponomarov](https://discuss.elastic.co/u/Arkadiy_Ponomarov)\ **Replies:** 2\ **Last updated:** [November 17, 2017, 2:21pm UTC](https://discuss.elastic.co/t/metricbeat-cpu-percentages-and-normalized-percentages/108137 "2017-11-17T14:21:19Z")
Hello all, I have installed Elasticsearch, Kibana and Metricbeat (all 6.0). Everything looks great instead of CPU percentage: it shows with paying in attention cores, I guess, is I see something like 986% on Metricbeat … --- ## [Metricbeat VSPHERE](https://discuss.elastic.co/t/metricbeat-vsphere/108115)
**Author:** [@adelbot](https://discuss.elastic.co/u/adelbot)\ **Replies:** 1\ **Last updated:** [November 17, 2017, 1:58pm UTC](https://discuss.elastic.co/t/metricbeat-vsphere/108115 "2017-11-17T13:58:57Z")
We are looking for 1 new feature: Is it possible ? Add metrics in field.yml and not in the code for example: we want : field named folder with the path of the vm from the datacenter field name host with the name … --- ## [Debug Errors while setting up SSL communication between Filebeat and Logstash](https://discuss.elastic.co/t/debug-errors-while-setting-up-ssl-communication-between-filebeat-and-logstash/107421)
**Author:** [@Shalvin\_Kumar](https://discuss.elastic.co/u/Shalvin_Kumar)\ **Replies:** 6\ **Last updated:** [November 17, 2017, 11:57am UTC](https://discuss.elastic.co/t/debug-errors-while-setting-up-ssl-communication-between-filebeat-and-logstash/107421 "2017-11-17T11:57:27Z")
I am trying a POC for my organisation and have the following setup : Filebeat on Linux Server Logstash, ElasticSearch and Kibana on Windows Server 2012 A simple flow of picking up log files from Filebeat to Kibana wor… --- ## [How to remove packetbeat](https://discuss.elastic.co/t/how-to-remove-packetbeat/108074)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 7\ **Last updated:** [November 17, 2017, 10:30am UTC](https://discuss.elastic.co/t/how-to-remove-packetbeat/108074 "2017-11-17T10:30:47Z")
As title. I want to remove packetbeat and reinstall it.(not just service) how could I do . thank you in advance! --- ## [How to receive ack of publish in 6.0 libbeat](https://discuss.elastic.co/t/how-to-receive-ack-of-publish-in-6-0-libbeat/107964)
**Author:** [@JamesB](https://discuss.elastic.co/u/JamesB)\ **Replies:** 2\ **Last updated:** [November 17, 2017, 9:08am UTC](https://discuss.elastic.co/t/how-to-receive-ack-of-publish-in-6-0-libbeat/107964 "2017-11-17T09:08:39Z")
Hi, I've just started looking at creating a custom beat using the 6.0 branch. I want to guarantee delivery of events and also be notified when an event has been published. What is the best way to do this? I've found th… --- ## [Create metricbeat index pattern failed - index patterns are missing](https://discuss.elastic.co/t/create-metricbeat-index-pattern-failed-index-patterns-are-missing/108006)
**Author:** [@geneliu](https://discuss.elastic.co/u/geneliu)\ **Replies:** 1\ **Last updated:** [November 16, 2017, 11:29pm UTC](https://discuss.elastic.co/t/create-metricbeat-index-pattern-failed-index-patterns-are-missing/108006 "2017-11-16T23:29:29Z")
Version: ELK6.0 metricbeat.json of index-pattern from https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-6.0.0.zip Command: curl -H 'Content-Type: application/json' -XPUT 'http://192.168.22… --- ## [Change in document \_type?](https://discuss.elastic.co/t/change-in-document-type/107807)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 3\ **Last updated:** [November 16, 2017, 11:11pm UTC](https://discuss.elastic.co/t/change-in-document-type/107807 "2017-11-16T23:11:38Z")
I am ingesting both G1 and J9 garbage collection logs into elasticsearch. Filebeat sends them to kafka, and logstash pulls them in from there. I installed 6.0 GA this morning, and deleted data/nodes/0 before starting es.… --- ## [Release resources when Metricbeat stops](https://discuss.elastic.co/t/release-resources-when-metricbeat-stops/107542)
**Author:** [@mguggi](https://discuss.elastic.co/u/mguggi)\ **Replies:** 9\ **Last updated:** [November 16, 2017, 10:50pm UTC](https://discuss.elastic.co/t/release-resources-when-metricbeat-stops/107542 "2017-11-16T22:50:30Z")
Hi, I'm new in go and metricbeat. I want write a metricbeat module which collects data from an Oracle database. Unfortunately I found no function (or way) to cleanup my connection when metricbeat will be stopped. I als… --- ## [What is the best way to handle \_grokparsefailure errors](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092)
**Author:** [@shroh](https://discuss.elastic.co/u/shroh)\ **Replies:** 3\ **Last updated:** [November 16, 2017, 8:41pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092 "2017-11-16T20:41:01Z")
I can see there are some \_grokparsefailure errors in the kibana console, i want to know what is the best way to handle these errors? --- ## [Parse the logs with FileBeat-ElasticSearch and Display on Kibana](https://discuss.elastic.co/t/parse-the-logs-with-filebeat-elasticsearch-and-display-on-kibana/107802)
**Author:** [@Shreyas\_Gade](https://discuss.elastic.co/u/Shreyas_Gade)\ **Replies:** 7\ **Last updated:** [November 16, 2017, 1:45pm UTC](https://discuss.elastic.co/t/parse-the-logs-with-filebeat-elasticsearch-and-display-on-kibana/107802 "2017-11-16T13:45:25Z")
I'm very new to the forums of Elastic. I have gone through these tools and few videos some hours ago and setup Kibana, Logstash and Elasticsearch on my local windows machine (on a private network). I managed to parse th… --- ## [How to create a alert in topbeat if a particular app is not running](https://discuss.elastic.co/t/how-to-create-a-alert-in-topbeat-if-a-particular-app-is-not-running/107695)
**Author:** [@JoelJoy](https://discuss.elastic.co/u/JoelJoy)\ **Replies:** 1\ **Last updated:** [November 16, 2017, 2:49am UTC](https://discuss.elastic.co/t/how-to-create-a-alert-in-topbeat-if-a-particular-app-is-not-running/107695 "2017-11-16T02:49:56Z")
is it possible to make a alert if a application is not running --- ## [Filebeat pulling older logs to logstash](https://discuss.elastic.co/t/filebeat-pulling-older-logs-to-logstash/107526)
**Author:** [@Vasu\_Deva\_Reddy\_Gund](https://discuss.elastic.co/u/Vasu_Deva_Reddy_Gund)\ **Replies:** 1\ **Last updated:** [November 16, 2017, 2:30am UTC](https://discuss.elastic.co/t/filebeat-pulling-older-logs-to-logstash/107526 "2017-11-16T02:30:45Z")
i am using file-beat to pull the logs to log-stash and from there to gray-log, its working fine with .csv files and when i am sending .txt files facing issue example : if one error logged at 6:00 AM that log get pushed … --- ## [Filebeat multiline and other questions](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821)
**Author:** [@Eduard3000](https://discuss.elastic.co/u/Eduard3000)\ **Replies:** 6\ **Last updated:** [November 15, 2017, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-multiline-and-other-questions/106821 "2017-11-15T20:02:18Z")
Hi, I am trying to write a jvm verbose gclog filebeat module: where is the right place to set the multiline option? how do I tell elastic to use my pipeline.json with grok filters as ingest pipeline. how to ext… --- ## [Filebeat harvest only currently running docker containers](https://discuss.elastic.co/t/filebeat-harvest-only-currently-running-docker-containers/106924)
**Author:** [@kwojcicki](https://discuss.elastic.co/u/kwojcicki)\ **Replies:** 6\ **Last updated:** [November 15, 2017, 4:50pm UTC](https://discuss.elastic.co/t/filebeat-harvest-only-currently-running-docker-containers/106924 "2017-11-15T16:50:09Z")
I am currently running filebeat to harvest all logs in /var/lib/docker/containers//-json.log however this harvests all logs even if a container isn't running anymore. Is there a way to get around this or perhaps a differ… --- ## [\[Question\] Is output routing possible in Filebeat](https://discuss.elastic.co/t/question-is-output-routing-possible-in-filebeat/107419)
**Author:** [@Moep90](https://discuss.elastic.co/u/Moep90)\ **Replies:** 5\ **Last updated:** [November 15, 2017, 2:50pm UTC](https://discuss.elastic.co/t/question-is-output-routing-possible-in-filebeat/107419 "2017-11-15T14:50:52Z")
Hey there, currently I'm working on configuring an ELK Stack. Filebeat should put JSON oneliners ONLY into Logstash for parsing. Filebeat should put /var/log/secure, /var/log/yum.log, /var/log/audit/audit.log directly… --- ## [Packetbeat can't show Client locations](https://discuss.elastic.co/t/packetbeat-cant-show-client-locations/107518)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [November 15, 2017, 2:45pm UTC](https://discuss.elastic.co/t/packetbeat-cant-show-client-locations/107518 "2017-11-15T14:45:13Z")
I installed Packetbeat, but the Client locations didn't show anything only the map. \[image\] thank you in advance. --- ## [Client certificate](https://discuss.elastic.co/t/client-certificate/107617)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 1\ **Last updated:** [November 15, 2017, 2:40pm UTC](https://discuss.elastic.co/t/client-certificate/107617 "2017-11-15T14:40:20Z")
Hello, We have an api which needs to be checked by heartbeat but it needs client ssl authentication to get a proper 200 http code. Is there any way it could be configured? Regards, Peter --- ## [Beat to monitor ... elasticsearch](https://discuss.elastic.co/t/beat-to-monitor-elasticsearch/107719)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [November 15, 2017, 2:18pm UTC](https://discuss.elastic.co/t/beat-to-monitor-elasticsearch/107719 "2017-11-15T14:18:58Z")
I found a community beat https://github.com/radoondas/elasticbeat to grab elasticsearch metrics, I dont understand why there is no an official beat for that? --- ## [Package name "heartbeat" conflicts with "heartbeat" package for Linux HA cluster](https://discuss.elastic.co/t/package-name-heartbeat-conflicts-with-heartbeat-package-for-linux-ha-cluster/107706)
**Author:** [@elkinspace](https://discuss.elastic.co/u/elkinspace)\ **Replies:** 2\ **Last updated:** [November 15, 2017, 11:30am UTC](https://discuss.elastic.co/t/package-name-heartbeat-conflicts-with-heartbeat-package-for-linux-ha-cluster/107706 "2017-11-15T11:30:55Z")
Hi there, I have just had an issue with the use of heartbeat. The heartbeat package (ES) has the same name as the heartbeat package used together with Pacemaker and Corosync for Linux clustering. This heartbeat package … --- ## [Packetbeat & Mysql bug](https://discuss.elastic.co/t/packetbeat-mysql-bug/107682)
**Author:** [@Yi\_Ge](https://discuss.elastic.co/u/Yi_Ge)\ **Replies:** 1\ **Last updated:** [November 15, 2017, 9:28am UTC](https://discuss.elastic.co/t/packetbeat-mysql-bug/107682 "2017-11-15T09:28:15Z")
Hi,I'm using packetbeat to monitor MySQL database, and found that packetbeat do not support mysql\_stmt\_prepare and mysql\_stmt\_execute command, and too many SQL querys can not be extracted because of using prepare state… --- ## [Creating a custom index for filebeat](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509)
**Author:** [@Widget](https://discuss.elastic.co/u/Widget)\ **Replies:** 1\ **Last updated:** [November 15, 2017, 2:01am UTC](https://discuss.elastic.co/t/creating-a-custom-index-for-filebeat/107509 "2017-11-15T02:01:25Z")
Hi Team, I would like to log from filebeat to one a custom index. I would like to set filebeat to log filebeat-division1-\* to logstash from one server and filebeat-division2-\* from another server. Then set access to t… --- ## [Filebeat and metricbeat produce different docker metadata for same container](https://discuss.elastic.co/t/filebeat-and-metricbeat-produce-different-docker-metadata-for-same-container/107449)
**Author:** [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\ **Replies:** 1\ **Last updated:** [November 14, 2017, 10:57pm UTC](https://discuss.elastic.co/t/filebeat-and-metricbeat-produce-different-docker-metadata-for-same-container/107449 "2017-11-14T22:57:33Z")
Hi, Metricbeat and Filebeat seem to have different ways of processing docker metadata, specifically docker labels. This means that for the same container you end up with different document schema in ES. My first refle… --- ## [Filebeat running error](https://discuss.elastic.co/t/filebeat-running-error/107334)
**Author:** [@vaddanam](https://discuss.elastic.co/u/vaddanam)\ **Replies:** 2\ **Last updated:** [November 14, 2017, 7:50am UTC](https://discuss.elastic.co/t/filebeat-running-error/107334 "2017-11-14T07:50:09Z")
Hi Team, file beat is not starting as a service even after executing the command. It's showing the below status : sudo systemctl status filebeat.service \[sudo\] password for elkservice: â filebeat.service - filebeat … --- ## [Install dashboard fails Windows to Ubuntu](https://discuss.elastic.co/t/install-dashboard-fails-windows-to-ubuntu/104966)
**Author:** [@CSRut](https://discuss.elastic.co/u/CSRut)\ **Replies:** 1\ **Last updated:** [November 14, 2017, 3:28pm UTC](https://discuss.elastic.co/t/install-dashboard-fails-windows-to-ubuntu/104966 "2017-11-14T15:28:24Z")
I have been struggling with getting filebeats (or winlogbeats - same errors) on Windows Server 2016 to install dashboards on my Ubuntu 16.04 server. (Also tried on Windows 10 using internet, not internal network address… --- ## [Winlogbeat service doesnot startup in Windows 10](https://discuss.elastic.co/t/winlogbeat-service-doesnot-startup-in-windows-10/106881)
**Author:** [@elasticguy](https://discuss.elastic.co/u/elasticguy)\ **Replies:** 1\ **Last updated:** [November 13, 2017, 7:43pm UTC](https://discuss.elastic.co/t/winlogbeat-service-doesnot-startup-in-windows-10/106881 "2017-11-13T19:43:24Z")
Hi, I am newbie to ELK and trying to get logs from windows 10 to logstash and then forward to elasticsearch. But Winlogbeat service is not coming up it just always appear as "stopped". any suggestion? Thank you in Adva… --- ## [Error publishing metricbeat to logstash](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157)
**Author:** [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\ **Replies:** 5\ **Last updated:** [November 13, 2017, 6:33pm UTC](https://discuss.elastic.co/t/error-publishing-metricbeat-to-logstash/107157 "2017-11-13T18:33:16Z")
Hi, I have installed metricbeat on windows and configured it to send logs/metric to logstash. However it fails with below error message: 017-11-10T14:13:36+05:30 ERR Failed to publish events (host: 10.5.52.136:5044:102… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=489) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=491)