# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=494 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 495 --- ## [Filebeat might erroneously hold on to the file descriptor?](https://discuss.elastic.co/t/filebeat-might-erroneously-hold-on-to-the-file-descriptor/104957)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 4\ **Last updated:** [October 25, 2017, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-might-erroneously-hold-on-to-the-file-descriptor/104957 "2017-10-25T12:29:43Z")
Hello, Filebeat experts, we just encountered a disk usage issue after deploying filebeat to production a few weeks. We set up filebeat to ship log files (file with extension .log) to kafka. The log files are rotated e… --- ## [Unable to start winlogbeat on windows server 2012](https://discuss.elastic.co/t/unable-to-start-winlogbeat-on-windows-server-2012/105112)
**Author:** [@Offer\_Sasson](https://discuss.elastic.co/u/Offer_Sasson)\ **Replies:** 1\ **Last updated:** [October 25, 2017, 12:06pm UTC](https://discuss.elastic.co/t/unable-to-start-winlogbeat-on-windows-server-2012/105112 "2017-10-25T12:06:19Z")
Hi, I am new to this world.... 1.I read a few of the topic related to this error. 2. i am using centos as my EKL server. 3. i installed winlogbeat on a windows 2012 machine and trying to started the service, also in … --- ## [ELK issue](https://discuss.elastic.co/t/elk-issue/105102)
**Author:** [@Rehan\_Ch](https://discuss.elastic.co/u/Rehan_Ch)\ **Replies:** 2\ **Last updated:** [October 25, 2017, 11:54am UTC](https://discuss.elastic.co/t/elk-issue/105102 "2017-10-25T11:54:59Z")
Hi, I am new to ELK and configured ELK by following some online doc. I got the dashboard but my syslog or nginx access logs are not appearing in kibana. Here I am posting my config files.Please help SSl certificate: … --- ## [Haproxy module authentication](https://discuss.elastic.co/t/haproxy-module-authentication/105108)
**Author:** [@rozling](https://discuss.elastic.co/u/rozling)\ **Replies:** 2\ **Last updated:** [October 25, 2017, 9:46am UTC](https://discuss.elastic.co/t/haproxy-module-authentication/105108 "2017-10-25T09:46:14Z")
We have stats enabled on our haproxy loadbalancers, however we also have basic authentication enabled as a security measure. Is it possible to pass the credentials from the metricbeat haproxy module so it can pick up st… --- ## [Metrics not synchronized with time](https://discuss.elastic.co/t/metrics-not-synchronized-with-time/105025)
**Author:** [@yoga-sara](https://discuss.elastic.co/u/yoga-sara)\ **Replies:** 2\ **Last updated:** [October 25, 2017, 3:12am UTC](https://discuss.elastic.co/t/metrics-not-synchronized-with-time/105025 "2017-10-25T03:12:57Z")
Hello, I'm having ELK 5.6.2 with redis 4.0.2.My environment like below, Filebeat (syslog) =\> Redis =\> Logstash =\>ES =\>Kibana Both machines are synchronized with time but @timestamp and system.syslog.timestamp are mis… --- ## [Unable to Visualise Metricbeat system.process.CPU data](https://discuss.elastic.co/t/unable-to-visualise-metricbeat-system-process-cpu-data/105103)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 0\ **Last updated:** [October 24, 2017, 4:42pm UTC](https://discuss.elastic.co/t/unable-to-visualise-metricbeat-system-process-cpu-data/105103 "2017-10-24T16:42:19Z")
Running Metricbeat v6 RC1 (trialling the perfmon counter functionality), but have Metricbeat reporting metrics at a process level also, note I have "top n" selected as well as specifiying a few processes the idea was tha… --- ## [Filebeat does not poll files in order](https://discuss.elastic.co/t/filebeat-does-not-poll-files-in-order/104133)
**Author:** [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-does-not-poll-files-in-order/104133 "2017-10-24T15:06:14Z")
I was testing a new Beat I created (Rebeat) with a large queue of log files, where Filebeat would pick up the logs and send them over to my beat. During debugging I confirmed that there is no particular (human friendly)… --- ## [Filebeat publish metrics on start up to elastic and then stops publishing metrics](https://discuss.elastic.co/t/filebeat-publish-metrics-on-start-up-to-elastic-and-then-stops-publishing-metrics/104742)
**Author:** [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Replies:** 5\ **Last updated:** [October 24, 2017, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-publish-metrics-on-start-up-to-elastic-and-then-stops-publishing-metrics/104742 "2017-10-24T14:28:56Z")
Filebeat publish metrics on start up to elastic and then stops publishing metrics. We stopped filebeat by doing a kill -9 of the pid. Systemd restarts filebeat. Filebeat published data to the logs and then stops publi… --- ## [Winlogbeat output to Graylog](https://discuss.elastic.co/t/winlogbeat-output-to-graylog/104533)
**Author:** [@justas](https://discuss.elastic.co/u/justas)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 12:55pm UTC](https://discuss.elastic.co/t/winlogbeat-output-to-graylog/104533 "2017-10-24T12:55:44Z")
Hi All, I have an issue. My winlogbeat sends duplicate and even in one event I found x150 same messages in graylog where in windows event logs there is only 1 message. Winlogbeat: 5.5.2 Graylog: 2.3.0 Elasticsearch: … --- ## [Multiline not combining lines - GO play matches](https://discuss.elastic.co/t/multiline-not-combining-lines-go-play-matches/104743)
**Author:** [@svanschalkwyk](https://discuss.elastic.co/u/svanschalkwyk)\ **Replies:** 0\ **Last updated:** [October 20, 2017, 6:31pm UTC](https://discuss.elastic.co/t/multiline-not-combining-lines-go-play-matches/104743 "2017-10-20T18:31:20Z")
\[SOLVED\] - multiline.\* settings were not indented correctly. Filebeats configtest did not pick this up. Hi, I'm ingesting SOLR logs. The logs have a datetime stamp on the first line and the information on the second. … --- ## [How to have a filebeat config send some prospectors to a pipeline and send some prospectors to no pipeline](https://discuss.elastic.co/t/how-to-have-a-filebeat-config-send-some-prospectors-to-a-pipeline-and-send-some-prospectors-to-no-pipeline/104492)
**Author:** [@frr255](https://discuss.elastic.co/u/frr255)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 12:48pm UTC](https://discuss.elastic.co/t/how-to-have-a-filebeat-config-send-some-prospectors-to-a-pipeline-and-send-some-prospectors-to-no-pipeline/104492 "2017-10-24T12:48:26Z")
I have a Filebeat config containing multiple prospectors. I want some prospectors to be sent to a pipeline. This is easy. However, I also want some prospectors not to be sent to any pipeline i.e. skip or avoid any pipel… --- ## [All scoreboard values equals to 0](https://discuss.elastic.co/t/all-scoreboard-values-equals-to-0/105060)
**Author:** [@rikemSen](https://discuss.elastic.co/u/rikemSen)\ **Replies:** 0\ **Last updated:** [October 24, 2017, 12:20pm UTC](https://discuss.elastic.co/t/all-scoreboard-values-equals-to-0/105060 "2017-10-24T12:20:29Z")
Hi there :), I'm facing a problem while configuring metricbeat with the apache module. I have activated mod\_status, and it works well. I have the page with all the needed informations. But when I go to kibana, in the a… --- ## [Filebeats not sending all logs from file](https://discuss.elastic.co/t/filebeats-not-sending-all-logs-from-file/104137)
**Author:** [@SalmaanP](https://discuss.elastic.co/u/SalmaanP)\ **Replies:** 5\ **Last updated:** [October 24, 2017, 11:49am UTC](https://discuss.elastic.co/t/filebeats-not-sending-all-logs-from-file/104137 "2017-10-24T11:49:26Z")
Hi, I have csv file which is generated every monday. The file is being overwritten every time. Filebeats is monitoring that file and sending it to kafka. It has a weird case where sometimes it sends all the logs, but a f… --- ## [Filebeat processing docker json-file logs](https://discuss.elastic.co/t/filebeat-processing-docker-json-file-logs/104590)
**Author:** [@evansj](https://discuss.elastic.co/u/evansj)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 11:32am UTC](https://discuss.elastic.co/t/filebeat-processing-docker-json-file-logs/104590 "2017-10-24T11:32:32Z")
Hi I'm trying to configure filebeat, in a docker container, to process docker container logs and send them to graylog. The docker log files are structured with a json message per line, like this: {"log":"Starting conta… --- ## [HttpProf not works](https://discuss.elastic.co/t/httpprof-not-works/104236)
**Author:** [@baac7d8fd69f222caad0](https://discuss.elastic.co/u/baac7d8fd69f222caad0)\ **Replies:** 6\ **Last updated:** [October 24, 2017, 7:53am UTC](https://discuss.elastic.co/t/httpprof-not-works/104236 "2017-10-24T07:53:31Z")
I start the fileBeat like this： ./filebeat -c DataCenterCollecterAgent.yml -httpprof 127.0.0.1:6000 I use command to get FileBeat info like this: curl http:127.0.0.1:60000/debug/vars It returns: curl: (7) Failed to… --- ## [Parse json and text logs](https://discuss.elastic.co/t/parse-json-and-text-logs/104994)
**Author:** [@mohit.garg](https://discuss.elastic.co/u/mohit.garg)\ **Replies:** 0\ **Last updated:** [October 24, 2017, 4:57am UTC](https://discuss.elastic.co/t/parse-json-and-text-logs/104994 "2017-10-24T04:57:13Z")
Hi, I have a requirement where I need to parse json logs created by application and plain text logs created by applications like nginx using filebeats. I tried couple of things but cannot make it work. Is there any sol… --- ## [Multiline with Ingest Node](https://discuss.elastic.co/t/multiline-with-ingest-node/104582)
**Author:** [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Replies:** 5\ **Last updated:** [October 23, 2017, 2:49pm UTC](https://discuss.elastic.co/t/multiline-with-ingest-node/104582 "2017-10-23T14:49:44Z")
I have the following log from Spring Boot, just for the demonstration purpose. //log starts 2017-10-19 11:21:20.949 ERROR 29648 --- \[http-nio-8080-exec-5\] com.example.demo.GlobalExceptionHandler : Unhandled exception … --- ## [FileBeat Not sending to kafka](https://discuss.elastic.co/t/filebeat-not-sending-to-kafka/104364)
**Author:** [@zubair777](https://discuss.elastic.co/u/zubair777)\ **Replies:** 7\ **Last updated:** [October 23, 2017, 2:46pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-to-kafka/104364 "2017-10-23T14:46:56Z")
HI All I m faced with an issue where my filebeat instance is either not sending files to my Kafka instances or its not reding the spicified log file in my filebeat.yml config my config looks like this : output.kafka: … --- ## [Add a separator character in multiline configuration](https://discuss.elastic.co/t/add-a-separator-character-in-multiline-configuration/104539)
**Author:** [@zeenon](https://discuss.elastic.co/u/zeenon)\ **Replies:** 3\ **Last updated:** [October 23, 2017, 1:23pm UTC](https://discuss.elastic.co/t/add-a-separator-character-in-multiline-configuration/104539 "2017-10-23T13:23:16Z")
hi, I have a multiline configuration like this: multiline.pattern : '^.{22}\*' multiline.negate: false multiline.match: after and filebeat joins the lines if a \* is found at column 23 each original line has a \\t to … --- ## [Support for handling rotated files as .gz files in filebeat](https://discuss.elastic.co/t/support-for-handling-rotated-files-as-gz-files-in-filebeat/104858)
**Author:** [@an.secure](https://discuss.elastic.co/u/an.secure)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 1:15pm UTC](https://discuss.elastic.co/t/support-for-handling-rotated-files-as-gz-files-in-filebeat/104858 "2017-10-23T13:15:29Z")
Does filebeat support compressed files? Our java application is writing the logs to log.json file using logback RollingFileAppender. After 5MB the file is rotated like below : arch\_2017-10-23.1.gz arch\_2017-10-23.2.g… --- ## [Manage multiline](https://discuss.elastic.co/t/manage-multiline/104636)
**Author:** [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 12:45pm UTC](https://discuss.elastic.co/t/manage-multiline/104636 "2017-10-23T12:45:16Z")
Hi, I've read https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html. But It didn't help me for the downstream Elasticsearch Ingest Pipeline Grok Processor. The challenge I have is the following… --- ## [Packetbeat: Code Coverage for your Golang System Tests](https://discuss.elastic.co/t/packetbeat-code-coverage-for-your-golang-system-tests/104484)
**Author:** [@sunanxiang](https://discuss.elastic.co/u/sunanxiang)\ **Replies:** 2\ **Last updated:** [October 23, 2017, 12:36pm UTC](https://discuss.elastic.co/t/packetbeat-code-coverage-for-your-golang-system-tests/104484 "2017-10-23T12:36:03Z")
I followed this blog and want to do Code Coverage System test.But I can't find the param in the blog. $ ./packetbeat.test -h Usage of ./packetbeat.test: -I string file -N Disable actual publishing for t… --- ## [Duplicate entries result from multiple Winlogbeats](https://discuss.elastic.co/t/duplicate-entries-result-from-multiple-winlogbeats/104892)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 12:22pm UTC](https://discuss.elastic.co/t/duplicate-entries-result-from-multiple-winlogbeats/104892 "2017-10-23T12:22:41Z")
Hi, I have multiple installs of Winlogbeat clients pushing, amongst other logs, events for locked out users. All works as expected. The only problem we are now faced with is that as there are multiple instances of WLB o… --- ## [Weekly indices with name as starting day of the week metricbeat](https://discuss.elastic.co/t/weekly-indices-with-name-as-starting-day-of-the-week-metricbeat/104436)
**Author:** [@Manikanth\_Reddy](https://discuss.elastic.co/u/Manikanth_Reddy)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 12:22pm UTC](https://discuss.elastic.co/t/weekly-indices-with-name-as-starting-day-of-the-week-metricbeat/104436 "2017-10-23T12:22:22Z")
Hi, As of now, we are using daily indices and are trying to create weekly indices going forward. I have tried configuring indexprefix-%{+xxxx.ww} but it is giving indices by week number out of year. I have been trying t… --- ## [Questions about retry and store data in a file](https://discuss.elastic.co/t/questions-about-retry-and-store-data-in-a-file/104183)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 7\ **Last updated:** [October 23, 2017, 12:02pm UTC](https://discuss.elastic.co/t/questions-about-retry-and-store-data-in-a-file/104183 "2017-10-23T12:02:49Z")
Hi, all The Metricbeat set output to Elasticsearch, in our system. But the DNS error or other network errors will let the data to be dropped. We want to protect the collection data. Can we output the data to a file or… --- ## [Http hearbeat Status cloned thru the list of configured URL](https://discuss.elastic.co/t/http-hearbeat-status-cloned-thru-the-list-of-configured-url/104310)
**Author:** [@Flavio\_Fortes](https://discuss.elastic.co/u/Flavio_Fortes)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 11:27am UTC](https://discuss.elastic.co/t/http-hearbeat-status-cloned-thru-the-list-of-configured-url/104310 "2017-10-23T11:27:57Z")
Hi, I have setup http type monitor for a list of URLs: heartbeat.monitors: - type: http # List or urls to query urls: \["http://es1.el:9200","http://es2.el:9200"\] schedule: '@every 25s' timeout: 16s When one an… --- ## [What's the peferred IDE for Beats development?](https://discuss.elastic.co/t/whats-the-peferred-ide-for-beats-development/104780)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 7:58am UTC](https://discuss.elastic.co/t/whats-the-peferred-ide-for-beats-development/104780 "2017-10-23T07:58:47Z")
Gogland looks interesting. --- ## [Missing Docker Meta Data Fields in Kibana](https://discuss.elastic.co/t/missing-docker-meta-data-fields-in-kibana/101977)
**Author:** [@stevejr](https://discuss.elastic.co/u/stevejr)\ **Replies:** 15\ **Last updated:** [October 22, 2017, 7:12pm UTC](https://discuss.elastic.co/t/missing-docker-meta-data-fields-in-kibana/101977 "2017-10-22T19:12:24Z")
Hi, I am evaluating the 6.0.0-beta2 release of Filebeat as I am interested in the docker metadata feature. In my filebeat.yml I have added the following in my prospector: processors: add\_docker\_metadata:~ Filebeat i… --- ## [Harvester doesnt read file](https://discuss.elastic.co/t/harvester-doesnt-read-file/104783)
**Author:** [@janko.sarmir](https://discuss.elastic.co/u/janko.sarmir)\ **Replies:** 1\ **Last updated:** [October 22, 2017, 2:42am UTC](https://discuss.elastic.co/t/harvester-doesnt-read-file/104783 "2017-10-22T02:42:06Z")
I have this configuration (v 5.x) input\_type: log document\_type: nginx.error paths: /var/log/nginx/error\*.log\* /var/www/urba/var/logs/nginx\_error.log; exclude\_files: \[".gz$"\] first rule of paths finds all files … --- ## [Getting the Beats index template onto Elasticsearch](https://discuss.elastic.co/t/getting-the-beats-index-template-onto-elasticsearch/104782)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 0\ **Last updated:** [October 21, 2017, 9:58pm UTC](https://discuss.elastic.co/t/getting-the-beats-index-template-onto-elasticsearch/104782 "2017-10-21T21:58:28Z")
When running the configuration metricbeat -\> elasticsearch the index template (metricbeat.template.json) is automatically installed on Elasticsearch by the Metricbeat agent. However, when running the configuration m… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=493) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=495)