# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=495 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 496 --- ## [Heartbeat - verify tcp ports failed with timeout and socket error](https://discuss.elastic.co/t/heartbeat-verify-tcp-ports-failed-with-timeout-and-socket-error/104130)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 2\ **Last updated:** [October 20, 2017, 11:08am UTC](https://discuss.elastic.co/t/heartbeat-verify-tcp-ports-failed-with-timeout-and-socket-error/104130 "2017-10-20T11:08:10Z")
I am trying to check the status of TCP ports of servers from Hearbeat client. I am getting 4 output responses in kibana, three are showing status as false and one status is true. Initially it has failed due to timeout a… --- ## [Logstash-input-http in beats](https://discuss.elastic.co/t/logstash-input-http-in-beats/104659)
**Author:** [@nick76](https://discuss.elastic.co/u/nick76)\ **Replies:** 0\ **Last updated:** [October 20, 2017, 7:18am UTC](https://discuss.elastic.co/t/logstash-input-http-in-beats/104659 "2017-10-20T07:18:02Z")
Hello all, I've the following configurations in my environment: filebeat --\> redis \<-- FW -- ELK on the frontend servers (where I've installed the filebeat module) I need to install something that act as the logstash… --- ## [Installing beats dashboard into kibana, version 6.x](https://discuss.elastic.co/t/installing-beats-dashboard-into-kibana-version-6-x/103952)
**Author:** [@chirgeo](https://discuss.elastic.co/u/chirgeo)\ **Replies:** 2\ **Last updated:** [October 20, 2017, 5:48am UTC](https://discuss.elastic.co/t/installing-beats-dashboard-into-kibana-version-6-x/103952 "2017-10-20T05:48:06Z")
Hi. I'm testing metricbeat:6.0.0-rc1 and confused on how to import dashboards into kibana when using as output logstash in an automated way(using ansible). I'm installing metricbeat which is configured default to send … --- ## [Error: No matching indices found: No indices match pattern "filebeat-\*"](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 15\ **Last updated:** [October 19, 2017, 12:52pm UTC](https://discuss.elastic.co/t/error-no-matching-indices-found-no-indices-match-pattern-filebeat/103675 "2017-10-19T12:52:49Z")
No matching indices found: No indices match pattern "filebeat-\*" Less Info OK Error: No matching indices found: No indices match pattern "filebeat-\*" at http://localhost:5601/bundles/kibana.bundle.js?v=15976:231:2635… --- ## [Add IP-addresses and MAC-addresses to event](https://discuss.elastic.co/t/add-ip-addresses-and-mac-addresses-to-event/103465)
**Author:** [@hypp](https://discuss.elastic.co/u/hypp)\ **Replies:** 8\ **Last updated:** [October 19, 2017, 7:52am UTC](https://discuss.elastic.co/t/add-ip-addresses-and-mac-addresses-to-event/103465 "2017-10-19T07:52:36Z")
Hi, I would like to dynamically add all IP-addresses and all MAC-addresses of the sender host to each event sent by filebeat. Is there a way to do that? If not, I would be happy to contribute a new processor, similar to… --- ## [Help on multiline](https://discuss.elastic.co/t/help-on-multiline/99819)
**Author:** [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Replies:** 11\ **Last updated:** [October 18, 2017, 10:47pm UTC](https://discuss.elastic.co/t/help-on-multiline/99819 "2017-10-18T22:47:12Z")
Hi there, I'm trying to translate my logstash configuration for using filebeat and the ingest pipeline feature. While using logstash, I had the following configuration: ---- LOGSTASH ----- input: codec =\> multiline… --- ## [Filebeat not sending all data](https://discuss.elastic.co/t/filebeat-not-sending-all-data/104384)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 0\ **Last updated:** [October 18, 2017, 11:55am UTC](https://discuss.elastic.co/t/filebeat-not-sending-all-data/104384 "2017-10-18T11:55:02Z")
Hi, I have a Filebeat process with 4 prospectors. created a scheduled task which is updating the file for each prospector with current time. The task runs every 2 minutes. The data is being sent over to Elasticsearch… --- ## [Add docker meta data for docker log files AND harvest other log files](https://discuss.elastic.co/t/add-docker-meta-data-for-docker-log-files-and-harvest-other-log-files/103688)
**Author:** [@Anders\_Gibson](https://discuss.elastic.co/u/Anders_Gibson)\ **Replies:** 7\ **Last updated:** [October 18, 2017, 11:53am UTC](https://discuss.elastic.co/t/add-docker-meta-data-for-docker-log-files-and-harvest-other-log-files/103688 "2017-10-18T11:53:58Z")
Hi! I am evaluating FileBeat 6.0.0-rc1. It seems as if this configuration: processors: - add\_docker\_metadata: host: "unix:///var/run/docker.sock" works fine and docker fields gets added, but filebeat ignores dock… --- ## [Filebeat data loss with file rotation and elasticsearch not reachable](https://discuss.elastic.co/t/filebeat-data-loss-with-file-rotation-and-elasticsearch-not-reachable/104238)
**Author:** [@an.secure](https://discuss.elastic.co/u/an.secure)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 9:33am UTC](https://discuss.elastic.co/t/filebeat-data-loss-with-file-rotation-and-elasticsearch-not-reachable/104238 "2017-10-18T09:33:10Z")
I am seeing loss of data in below scenario : filebeat is sending data to elasticsearch from a json file elasticsearch is down multiple ( say 5 ) files are created during this time due to file rotation policy. files are… --- ## [Filebeat multiline not working](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870)
**Author:** [@VidyVideni](https://discuss.elastic.co/u/VidyVideni)\ **Replies:** 5\ **Last updated:** [October 18, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-multiline-not-working/103870 "2017-10-18T09:31:22Z")
Nginx test error log \[2017/10/13 16:17:49\] \[error\] 21169#21169: \*113356 FastCGI sent in stderr: "PHP message: PHP Fatal error: Class 'Elasticsearch\\ClientBuilder' not found in /home/work/website/cdt0-webapp.example.co… --- ## [Cloudtrailbeat](https://discuss.elastic.co/t/cloudtrailbeat/104252)
**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\ **Replies:** 3\ **Last updated:** [October 18, 2017, 9:20am UTC](https://discuss.elastic.co/t/cloudtrailbeat/104252 "2017-10-18T09:20:56Z")
Hi everyone, Can anyone help me with Cloudtrail beat installation? Anyone got any experience with cloudtrail beat for AWS? Any help at all would much appreciated. Thanks --- ## [Adding more fields from the nginx log file](https://discuss.elastic.co/t/adding-more-fields-from-the-nginx-log-file/104231)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 1\ **Last updated:** [October 18, 2017, 1:46am UTC](https://discuss.elastic.co/t/adding-more-fields-from-the-nginx-log-file/104231 "2017-10-18T01:46:38Z")
Hi, I'm using Filebeat with Kibana and Elastic 5.5.0 to get the nginx data from logs file and it's work well, but all the data from my nginx log file was not in Kibana. Here an example of my log file: 10.10.10.10 - -… --- ## [Packetbeat service does not start](https://discuss.elastic.co/t/packetbeat-service-does-not-start/104191)
**Author:** [@vijayjadav](https://discuss.elastic.co/u/vijayjadav)\ **Replies:** 1\ **Last updated:** [October 17, 2017, 10:44pm UTC](https://discuss.elastic.co/t/packetbeat-service-does-not-start/104191 "2017-10-17T22:44:37Z")
hello, I am trying to run packetbeat service but its giving error ..here is details. I am using Windows 10. No error in logs and config files PS C:\\Packetbeat\> PowerShell.exe -ExecutionPolicy UnRestricted -File .\\insta… --- ## [Can Metricbeat gather "waiting MySQL queries"?](https://discuss.elastic.co/t/can-metricbeat-gather-waiting-mysql-queries/103453)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 4\ **Last updated:** [October 17, 2017, 4:31pm UTC](https://discuss.elastic.co/t/can-metricbeat-gather-waiting-mysql-queries/103453 "2017-10-17T16:31:18Z")
We are troubleshooting an issue and would like to see "waiting MySQL queries" but did not see a metric for this. Is this in the MySQL module? --- ## [Does filebeat6.0 have potential memory leaks?](https://discuss.elastic.co/t/does-filebeat6-0-have-potential-memory-leaks/104259)
**Author:** [@ZhiqinYang](https://discuss.elastic.co/u/ZhiqinYang)\ **Replies:** 0\ **Last updated:** [October 17, 2017, 2:12pm UTC](https://discuss.elastic.co/t/does-filebeat6-0-have-potential-memory-leaks/104259 "2017-10-17T14:12:00Z")
I run filebeat6.0-beta , and my app output 2000+ logs per second, i use docker stats see the memory is use up? what's wrong with this? i thought the mem will keep in a certain range ？ but In fact is not， does somethin… --- ## [DBG Harvester for file is still running + Solution](https://discuss.elastic.co/t/dbg-harvester-for-file-is-still-running-solution/104223)
**Author:** [@jinojoseph](https://discuss.elastic.co/u/jinojoseph)\ **Replies:** 0\ **Last updated:** [October 17, 2017, 10:29am UTC](https://discuss.elastic.co/t/dbg-harvester-for-file-is-still-running-solution/104223 "2017-10-17T10:29:30Z")
I had been getting the error like below in my filebeat log: 2017-10-17T04:35:19-05:00 DBG Check file for harvesting: /var/log/secure 2017-10-17T04:35:19-05:00 DBG Update existing file for harvesting: /var/log/secure,… --- ## [ERR Failed to publish events caused by: read tcp (filebeat Version: 5.5.1)](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-filebeat-version-5-5-1/103498)
**Author:** [@Danish\_Bin\_Sofwan](https://discuss.elastic.co/u/Danish_Bin_Sofwan)\ **Replies:** 4\ **Last updated:** [October 16, 2017, 2:44pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-filebeat-version-5-5-1/103498 "2017-10-16T14:44:00Z")
This is how my filebeat.yml looks like : output.logstash: # The Logstash hosts hosts: \["55.194.113.9:5043"\] bulk\_max\_size : 1048 The logstash instance transforms and indexes the logs into aws managed Elastic sear… --- ## [What's the means about this params in the log file](https://discuss.elastic.co/t/whats-the-means-about-this-params-in-the-log-file/104100)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 0\ **Last updated:** [October 16, 2017, 2:09pm UTC](https://discuss.elastic.co/t/whats-the-means-about-this-params-in-the-log-file/104100 "2017-10-16T14:09:49Z")
Hi, We run some metricbeat in our machines. And collect the run log every 10 mins. After check the log at /etc/log/metricbeat, we feel puzzled. And we don't find any document about it. One log record like followed: f… --- ## [Filebeat modules - problem with pipeline.json](https://discuss.elastic.co/t/filebeat-modules-problem-with-pipeline-json/103190)
**Author:** [@Miroslav\_Kudlac](https://discuss.elastic.co/u/Miroslav_Kudlac)\ **Replies:** 9\ **Last updated:** [October 16, 2017, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-modules-problem-with-pipeline-json/103190 "2017-10-16T13:16:48Z")
Hi, I am trying to make my own module, but I have a problem right on the beginning. I tried to write my own pipeline.json file, but after command execution I get this error: filebeat -e --modules test -setup 2017/10/0… --- ## [Filebeat cut multiline on 500 line](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086)
**Author:** [@Dees7](https://discuss.elastic.co/u/Dees7)\ **Replies:** 1\ **Last updated:** [October 16, 2017, 11:43am UTC](https://discuss.elastic.co/t/filebeat-cut-multiline-on-500-line/104086 "2017-10-16T11:43:51Z")
I use Filebeat to send logs to remote logstash. I use multiline - input\_type: log paths: - /production\_xml.log multiline.pattern: '^Response\_id|^Request\_id' multiline.negate: true multiline.match: after My… --- ## [Certgen Certificates for WinlogBeat](https://discuss.elastic.co/t/certgen-certificates-for-winlogbeat/103898)
**Author:** [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\ **Replies:** 1\ **Last updated:** [October 16, 2017, 8:17am UTC](https://discuss.elastic.co/t/certgen-certificates-for-winlogbeat/103898 "2017-10-16T08:17:41Z")
I have just set up my first full Elastic Stack. I am now trying to get Windows Event logs from one of our test boxes, however the logs will be transported via the internet and therefore I need to set up TLS from WinLogBe… --- ## [Exploring logs queuing application with Filebeat](https://discuss.elastic.co/t/exploring-logs-queuing-application-with-filebeat/103744)
**Author:** [@Nishant\_Hurnekar](https://discuss.elastic.co/u/Nishant_Hurnekar)\ **Replies:** 7\ **Last updated:** [October 16, 2017, 7:46am UTC](https://discuss.elastic.co/t/exploring-logs-queuing-application-with-filebeat/103744 "2017-10-16T07:46:40Z")
Hi, Is there any functionality available in Filebeat where filebeat application can send logs to some queuing application. We are exploring such option in Filebeat because our access logs are keep rotating on every 15 … --- ## [Does this group cover Lovebeat? Is so how does one change the web ui port](https://discuss.elastic.co/t/does-this-group-cover-lovebeat-is-so-how-does-one-change-the-web-ui-port/103911)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 3\ **Last updated:** [October 14, 2017, 3:00pm UTC](https://discuss.elastic.co/t/does-this-group-cover-lovebeat-is-so-how-does-one-change-the-web-ui-port/103911 "2017-10-14T15:00:44Z")
I just installed Lovebeat on my Stage server but the default port 8080 is already in use so I need to know how to change the default port for the web ui. Looking in the config file but nothing is jumping out at me - I tr… --- ## [Starting filebeat on windows as a service does not expand env vars in config file](https://discuss.elastic.co/t/starting-filebeat-on-windows-as-a-service-does-not-expand-env-vars-in-config-file/103963)
**Author:** [@ahayschi](https://discuss.elastic.co/u/ahayschi)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 10:32pm UTC](https://discuss.elastic.co/t/starting-filebeat-on-windows-as-a-service-does-not-expand-env-vars-in-config-file/103963 "2017-10-13T22:32:39Z")
Beat version: filebeat:5.6.2 Operating System: Microsoft Windows Server 2012 R2 Standard on ec2 Hi there, I'm starting filebeat as a service on windows by running Start-Service filebeat at the end of a powershell scri… --- ## [Filebeat install error on Windows](https://discuss.elastic.co/t/filebeat-install-error-on-windows/103832)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-install-error-on-windows/103832 "2017-10-13T16:29:18Z")
I have uninstall previously install filebeat and received following information \[image\] Then I tried to install filebeat again and received following error message and I am unable to resolve this issue. \[image\] How t… --- ## [Filebeat tags not applied, if JSON event already has a tags field?](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974)
**Author:** [@uschtwill](https://discuss.elastic.co/u/uschtwill)\ **Replies:** 6\ **Last updated:** [October 13, 2017, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974 "2017-10-13T15:07:50Z")
I have spent quite some time trying to add some tags to Kibana logs yesterday - futilely. The Kibana logs are in JSON and already contain a "tags" field. The way it looks, Filebeat (maybe beats in general?) chooses not … --- ## [Provided Grok expressions do not match field value](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/103502)
**Author:** [@316014408](https://discuss.elastic.co/u/316014408)\ **Replies:** 5\ **Last updated:** [October 13, 2017, 12:47pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/103502 "2017-10-13T12:47:11Z")
Hi, MySQL module does not support 5.6? The MySQL module was tested with logs from versions 5.5 and 5.7. I modified pipeline.json,but... filebeat versions 5.6.2 elasticsearch versions 5.6.2 MySQL versions 5.6.33… --- ## [Is it possible to define two index in the filebeat config](https://discuss.elastic.co/t/is-it-possible-to-define-two-index-in-the-filebeat-config/103862)
**Author:** [@Nishant\_Hurnekar](https://discuss.elastic.co/u/Nishant_Hurnekar)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 9:13am UTC](https://discuss.elastic.co/t/is-it-possible-to-define-two-index-in-the-filebeat-config/103862 "2017-10-13T09:13:34Z")
Hi, We have multiple vhost on the same server as below web.xyz.access.log app.xyz.access.log Is it possible to define two index name in the filebeat configuration or by creating separate yml file? web.xyz.access.log… --- ## [Filebeat restart repeatedly with throwing out of memory in runtime](https://discuss.elastic.co/t/filebeat-restart-repeatedly-with-throwing-out-of-memory-in-runtime/103314)
**Author:** [@Kyle-Wilson1](https://discuss.elastic.co/u/Kyle-Wilson1)\ **Replies:** 8\ **Last updated:** [October 13, 2017, 7:40am UTC](https://discuss.elastic.co/t/filebeat-restart-repeatedly-with-throwing-out-of-memory-in-runtime/103314 "2017-10-13T07:40:01Z")
log shows the following: client mode check start 2017-10-10 07:40:58.303980858 +0000 UTC client mode check start 2017-10-10 07:41:01.305266634 +0000 UTC client mode check start 2017-10-10 07:41:04.506058547 +0000 UTC f… --- ## [Error- read: connection reset by peer](https://discuss.elastic.co/t/error-read-connection-reset-by-peer/102916)
**Author:** [@Amit2015](https://discuss.elastic.co/u/Amit2015)\ **Replies:** 7\ **Last updated:** [October 13, 2017, 6:53am UTC](https://discuss.elastic.co/t/error-read-connection-reset-by-peer/102916 "2017-10-13T06:53:21Z")
Hi, I am using filebeat with Logstash output. Please find below config files: filebeat.yml #=========================== Filebeat prospectors ============================= filebeat.prospectors: Each - is a prospector.… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=494) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=496)