# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=491 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 492 --- ## [Help jump from logstash to beats](https://discuss.elastic.co/t/help-jump-from-logstash-to-beats/104349)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 5\ **Last updated:** [November 13, 2017, 6:31pm UTC](https://discuss.elastic.co/t/help-jump-from-logstash-to-beats/104349 "2017-11-13T18:31:12Z")
Hi again here! I'm going to try replacing logstash to beats as a ship mechanism (as part of a migration from 1.5 to 5.x) , but I need some help to understand what are the pieces roles. Currently, I'm reading and parsin… --- ## [Upgrade 1.3.0 -\> 5.6.4: deprecated document\_type use fileds](https://discuss.elastic.co/t/upgrade-1-3-0-5-6-4-deprecated-document-type-use-fileds/107202)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [November 13, 2017, 6:20pm UTC](https://discuss.elastic.co/t/upgrade-1-3-0-5-6-4-deprecated-document-type-use-fileds/107202 "2017-11-13T18:20:53Z")
Upgraded a filebeat from 1.3.0 to 5.6.4 but it doesn't seem to collect and ship data to logstash. Upon launch filebeat complains i log about deprecated feature document\_type in my prospector: 2017-11-10T15:22:37+01:00 W… --- ## [Advice on Metrics](https://discuss.elastic.co/t/advice-on-metrics/106908)
**Author:** [@Cen\_giz](https://discuss.elastic.co/u/Cen_giz)\ **Replies:** 4\ **Last updated:** [November 13, 2017, 6:14pm UTC](https://discuss.elastic.co/t/advice-on-metrics/106908 "2017-11-13T18:14:03Z")
Hi, I am new to metrics beats concept and exploring options... First, I would like to collect metrics from all HW/Application (For Eg.. HTTP Server, Database, etc...) in the Enterprise where there are hundreds of thes… --- ## [MSSQL Use cases for elasticsearch stack?](https://discuss.elastic.co/t/mssql-use-cases-for-elasticsearch-stack/107303)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 7\ **Last updated:** [November 13, 2017, 6:10pm UTC](https://discuss.elastic.co/t/mssql-use-cases-for-elasticsearch-stack/107303 "2017-11-13T18:10:06Z")
Hi Guys, Can someone please elaborate what could be use cases for MS-SQL? OR Database in general? I mean what kind of dashboards can be created our SQL data? TIA --- ## [Unable to send logs to logstash](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 3\ **Last updated:** [November 13, 2017, 5:22pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260 "2017-11-13T17:22:00Z")
filebeat.prospectors: input\_type: log paths: /home/niked/Downloads/tom.log document\_type: prepaid\_logs multiline: pattern =\> "^%{TIMESTAMP\_ISO8601} " negate =\> true what =\> previous output.logstash: hosts: \["l… --- ## [Can filebeat load non .log file into elasticsearch/logstash?](https://discuss.elastic.co/t/can-filebeat-load-non-log-file-into-elasticsearch-logstash/107048)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 3\ **Last updated:** [November 13, 2017, 5:16pm UTC](https://discuss.elastic.co/t/can-filebeat-load-non-log-file-into-elasticsearch-logstash/107048 "2017-11-13T17:16:05Z")
Hi there. I try to load some files from filebeat -\> logstash -\> elasticsearch -\> kibana. The thing is that the files I'm trying to load are not .log files, but files without any extension. the filebeat.yml is: filebe… --- ## [Heartbeat configure problem](https://discuss.elastic.co/t/heartbeat-configure-problem/107290)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 1\ **Last updated:** [November 13, 2017, 5:14pm UTC](https://discuss.elastic.co/t/heartbeat-configure-problem/107290 "2017-11-13T17:14:21Z")
IP 192.168.10.36 HOST: clientpc I install heartbeat 5.6.4 in this pc. vim /etc/heartbeat/heartbeat.yml type: tcp schedule: '@every 5s' hosts: \["192.168.10.71"\] # 192.168.10.71 is a remote pc ports: \[5044, 9200\] … --- ## [Filebeat docker image](https://discuss.elastic.co/t/filebeat-docker-image/107033)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 4\ **Last updated:** [November 13, 2017, 10:56am UTC](https://discuss.elastic.co/t/filebeat-docker-image/107033 "2017-11-13T10:56:02Z")
Am trying to dockerize filebeat with https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html#\_custom\_image\_configuration Using the Dockerfile am building the image and starting the filebeat contai… --- ## [Filebeat not release inode](https://discuss.elastic.co/t/filebeat-not-release-inode/107265)
**Author:** [@ZhiqinYang](https://discuss.elastic.co/u/ZhiqinYang)\ **Replies:** 1\ **Last updated:** [November 13, 2017, 2:26am UTC](https://discuss.elastic.co/t/filebeat-not-release-inode/107265 "2017-11-13T02:26:02Z")
i print log id=inode-device: {"log":"2017/11/11 05:15:01.007411 harvester.go:217: INFO parse count:2538 source:/var/lib/docker/containers/3b8a18339298d101e62f0a582d621f7d8b74210845017c302004b26c7f1cd755/3b8a18339298d10… --- ## [Filebeat for naxsi waf log](https://discuss.elastic.co/t/filebeat-for-naxsi-waf-log/106951)
**Author:** [@qingweiqm](https://discuss.elastic.co/u/qingweiqm)\ **Replies:** 5\ **Last updated:** [November 10, 2017, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-for-naxsi-waf-log/106951 "2017-11-10T14:22:11Z")
hi, there I was trying to build a filebeat module for naxsi waf log. the log is on /usr/local/shadow/logs/shadow\_waf.log the log format is below: 2017/09/07 18:26:21 \[error\] 1097#0: SHADOW\_WAF: 109720&ip=172.16.144.1&s… --- ## [Multiple definitions for the same module?](https://discuss.elastic.co/t/multiple-definitions-for-the-same-module/106839)
**Author:** [@sebastien.k](https://discuss.elastic.co/u/sebastien.k)\ **Replies:** 5\ **Last updated:** [November 10, 2017, 8:56am UTC](https://discuss.elastic.co/t/multiple-definitions-for-the-same-module/106839 "2017-11-10T08:56:16Z")
Hi, We have created a specific filebeat module to parse Drupal logs. In filebeat.yml we declare two entries for filebeat.modules with this custom module in order to distinguish preprod and prod environments (by adding … --- ## [Is there any way to find which files have been ingested by filebeat to logstash?](https://discuss.elastic.co/t/is-there-any-way-to-find-which-files-have-been-ingested-by-filebeat-to-logstash/107010)
**Author:** [@Jay\_Dabhi](https://discuss.elastic.co/u/Jay_Dabhi)\ **Replies:** 1\ **Last updated:** [November 9, 2017, 4:21pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-find-which-files-have-been-ingested-by-filebeat-to-logstash/107010 "2017-11-09T16:21:25Z")
Is there any way to find which files have been ingested by filebeat to logstash? --- ## [Filebeat not dumping logs](https://discuss.elastic.co/t/filebeat-not-dumping-logs/106667)
**Author:** [@Jay\_Dabhi](https://discuss.elastic.co/u/Jay_Dabhi)\ **Replies:** 3\ **Last updated:** [November 9, 2017, 9:52am UTC](https://discuss.elastic.co/t/filebeat-not-dumping-logs/106667 "2017-11-09T09:52:50Z")
I want to dump filebeat logs to specific file at certain path.I have specified in my filebeat.yml file. ###################### Filebeat Configuration Example ######################### # This file is an example configur… --- ## [Filebeat need restart to send logs and his logs they are duplicate](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs-and-his-logs-they-are-duplicate/106718)
**Author:** [@davidhs](https://discuss.elastic.co/u/davidhs)\ **Replies:** 2\ **Last updated:** [November 9, 2017, 9:00am UTC](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs-and-his-logs-they-are-duplicate/106718 "2017-11-09T09:00:09Z")
Hello community elastic, i have a problem with filebeat, I have seen many threads in the community, but I have two problems, I have to restart filebeat to be able to send logs, but it receives duplicates, that is, it sen… --- ## [FILEBEAT-\> (SSL) Logstash :: Error publishing events (retrying): read tcp : i/o timeout](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948)
**Author:** [@lookcrabs](https://discuss.elastic.co/u/lookcrabs)\ **Replies:** 1\ **Last updated:** [November 9, 2017, 4:37am UTC](https://discuss.elastic.co/t/filebeat-ssl-logstash-error-publishing-events-retrying-read-tcp-i-o-timeout/106948 "2017-11-09T04:37:46Z")
I have filebeat version 5.5.1 (ssl)-\> logstash version 5.5.1 talking to elasticsearch. I have 2 prospectors defined but only authlog seems to be sending. I have tried increasing and decreasing the bulk\_max\_size, using c… --- ## [Filebeats for syslog](https://discuss.elastic.co/t/filebeats-for-syslog/106421)
**Author:** [@Cen\_giz](https://discuss.elastic.co/u/Cen_giz)\ **Replies:** 5\ **Last updated:** [November 8, 2017, 11:11pm UTC](https://discuss.elastic.co/t/filebeats-for-syslog/106421 "2017-11-08T23:11:30Z")
Hi All, I am looking into using FileBeats with Logstash. Isntalling Filebeats into each client server is not scalable if the number goes high and at one time filebeat agents need version upgrades. Thus, I am looking in… --- ## [Error loading config file when running Heartbeat without --path.config flag](https://discuss.elastic.co/t/error-loading-config-file-when-running-heartbeat-without-path-config-flag/106874)
**Author:** [@Jon\_D](https://discuss.elastic.co/u/Jon_D)\ **Replies:** 0\ **Last updated:** [November 8, 2017, 1:49pm UTC](https://discuss.elastic.co/t/error-loading-config-file-when-running-heartbeat-without-path-config-flag/106874 "2017-11-08T13:49:44Z")
I installed Heartbeat using RPM. Now, when I try to run it without any options it gives the following error: \[elastic@local-central bin\]$ ./heartbeat heartbeat2017/11/08 13:27:44.630019 beat.go:346: CRIT Exiting: error… --- ## [Filebeat.exe using over 1GB of Memory on Windows](https://discuss.elastic.co/t/filebeat-exe-using-over-1gb-of-memory-on-windows/106775)
**Author:** [@BrianBeaulieu](https://discuss.elastic.co/u/BrianBeaulieu)\ **Replies:** 4\ **Last updated:** [November 8, 2017, 12:24pm UTC](https://discuss.elastic.co/t/filebeat-exe-using-over-1gb-of-memory-on-windows/106775 "2017-11-08T12:24:30Z")
\[2017-11-07 18\_32\_46-Remote Desktop Manager \[RMCO - WebProd\]\] Version 5.6.3 Happened with older 5.x versions as well. Can't attach memory profile text file. Summary at the bottom. Configuration is pretty simple. 3 l… --- ## [CPU usage increases over time meticbeat on Windows 10](https://discuss.elastic.co/t/cpu-usage-increases-over-time-meticbeat-on-windows-10/105686)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 3\ **Last updated:** [November 8, 2017, 12:03pm UTC](https://discuss.elastic.co/t/cpu-usage-increases-over-time-meticbeat-on-windows-10/105686 "2017-11-08T12:03:48Z")
Any idea why CPU usage is steadily increasing over time? This graph shows a four hour period. \[image\] Here's how the metricbeat is configured: metricbeat.modules: #------------------------------- System Module ------… --- ## [MongoDB beats output](https://discuss.elastic.co/t/mongodb-beats-output/106818)
**Author:** [@dapicard](https://discuss.elastic.co/u/dapicard)\ **Replies:** 0\ **Last updated:** [November 8, 2017, 8:26am UTC](https://discuss.elastic.co/t/mongodb-beats-output/106818 "2017-11-08T08:26:52Z")
Hi, For a very specific use case, I write a MongoDB output for Beats. You can find it on github : If it can be helpful for anybody else. Have a good day ! --- ## [PacketBeat fails to extract HTTP from simple PCAP](https://discuss.elastic.co/t/packetbeat-fails-to-extract-http-from-simple-pcap/103868)
**Author:** [@theetete](https://discuss.elastic.co/u/theetete)\ **Replies:** 5\ **Last updated:** [November 7, 2017, 3:42pm UTC](https://discuss.elastic.co/t/packetbeat-fails-to-extract-http-from-simple-pcap/103868 "2017-11-07T15:42:31Z")
Hi, I got trouble in extracting HTTP from my tcpdumped file All I get is one tcp stream, but if I check with Wireshark I got full HTTP streams. 2017-10-13T09:40:52Z INFO packetbeat start running. 2017-10-13T09:40:52Z … --- ## [Flow data](https://discuss.elastic.co/t/flow-data/106679)
**Author:** [@Venky\_Guntakindapall](https://discuss.elastic.co/u/Venky_Guntakindapall)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 2:58pm UTC](https://discuss.elastic.co/t/flow-data/106679 "2017-11-07T14:58:43Z")
Hi, I am running packetbeat on one of my production servers to analyse the amount of data transfer between my server ip and to all other ips. Below is my flow configuration in packetbeat.yml packetbeat.flows: timeout: … --- ## [Filebeat resolves hostnames to IPs](https://discuss.elastic.co/t/filebeat-resolves-hostnames-to-ips/106550)
**Author:** [@stphngrtz](https://discuss.elastic.co/u/stphngrtz)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-resolves-hostnames-to-ips/106550 "2017-11-07T14:50:18Z")
Hello! I've configured filebeat to output the logs to logstash by hostname. output: logstash: hosts: \["logstash:5044"\] Internally it seems to resolve the hostname to its IP. 2017/11/06 14:45:18.882832 output.go… --- ## [Restarting Filebeat, replay all data of a file](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630)
**Author:** [@onezero-jung](https://discuss.elastic.co/u/onezero-jung)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 2:13pm UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630 "2017-11-07T14:13:51Z")
Filebeat sand data again in a file when restarting paths property is setted with absolute path. It is work well( Restarting filbert, does not send duplicate data) but setting with relative path, send duplicate data. … --- ## [Filebeat\[5.6.3\] - tail\_files not working](https://discuss.elastic.co/t/filebeat-5-6-3-tail-files-not-working/106642)
**Author:** [@olololll](https://discuss.elastic.co/u/olololll)\ **Replies:** 6\ **Last updated:** [November 7, 2017, 10:01am UTC](https://discuss.elastic.co/t/filebeat-5-6-3-tail-files-not-working/106642 "2017-11-07T10:01:27Z")
Problem: I want filebeat only read the newly added line in log file and send it to logstash. For example, there are 2lines in the log originally. Line1: A Line2: B The log file will keep updating, says a new line3, … --- ## [Beat Dashboards aggregating on non-aggregatable fields](https://discuss.elastic.co/t/beat-dashboards-aggregating-on-non-aggregatable-fields/106481)
**Author:** [@chris060986](https://discuss.elastic.co/u/chris060986)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 6:47am UTC](https://discuss.elastic.co/t/beat-dashboards-aggregating-on-non-aggregatable-fields/106481 "2017-11-07T06:47:44Z")
Hi, we are using elasticsearch 5.6.2 and the beat-dashboards 5.6.2. After installing the dashboards all seems to be fine, indices are created, visualizations and dashboards are successfully stored in elastic. But when … --- ## [Getting " ERR Failed to publish events caused by: lumberjack protocol error" in Filebeat](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509)
**Author:** [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\ **Replies:** 4\ **Last updated:** [November 7, 2017, 4:43am UTC](https://discuss.elastic.co/t/getting-err-failed-to-publish-events-caused-by-lumberjack-protocol-error-in-filebeat/106509 "2017-11-07T04:43:19Z")
Hi, I am trying to implement ELK with filebeat in some of my servers, As of now i am trying it locally. When ever i am trying to start the filebeat to send the logs to my logstash its throwing " ERR Failed to publish e… --- ## [Can the Windows module collect perfmon metrics from a remote host?](https://discuss.elastic.co/t/can-the-windows-module-collect-perfmon-metrics-from-a-remote-host/106551)
**Author:** [@pshroads](https://discuss.elastic.co/u/pshroads)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 12:13am UTC](https://discuss.elastic.co/t/can-the-windows-module-collect-perfmon-metrics-from-a-remote-host/106551 "2017-11-07T00:13:27Z")
I don't see anywhere in the config to specify a remote host so I'm guessing it can only collect on the local host. Is that correct? Thanks --- ## [How to search for "logname.log" in kibana?](https://discuss.elastic.co/t/how-to-search-for-logname-log-in-kibana/106354)
**Author:** [@marcuy](https://discuss.elastic.co/u/marcuy)\ **Replies:** 3\ **Last updated:** [November 6, 2017, 9:35pm UTC](https://discuss.elastic.co/t/how-to-search-for-logname-log-in-kibana/106354 "2017-11-06T21:35:50Z")
Hello, I'am adding filebat in many servers to send jboss logs to Logstash \> Elastisearch \> Kibana I need to search for "log name" in kibana, for example "server\_appname.log" but does not works. (beat.version:5.6.3) A… --- ## [Metricbeat filesystem usage setting in units](https://discuss.elastic.co/t/metricbeat-filesystem-usage-setting-in-units/105572)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 6\ **Last updated:** [November 6, 2017, 2:26pm UTC](https://discuss.elastic.co/t/metricbeat-filesystem-usage-setting-in-units/105572 "2017-11-06T14:26:33Z")
I have 2 ELK setup with metricbeat configured to find the filesystem usage. The metricbeat.yml is like below in both the environment. But in env-01 i could see the units (GB, MB and % for the values) and in env-02 it is … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=490) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=492)