# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=496 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 497 --- ## [Can different metrics go to different output and have different schedules?](https://discuss.elastic.co/t/can-different-metrics-go-to-different-output-and-have-different-schedules/103776)
**Author:** [@waynez](https://discuss.elastic.co/u/waynez)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 10:19pm UTC](https://discuss.elastic.co/t/can-different-metrics-go-to-different-output-and-have-different-schedules/103776 "2017-10-12T22:19:50Z")
I have some questions about what the MetricBeat can do in some situations. I wonder if anyone can help me. Can I configure more than one output (e.g. elastic search and logstash. This is purely hypothetical. Just exam… --- ## [Filebeat Output Condition for multiple (ELK) logstash server](https://discuss.elastic.co/t/filebeat-output-condition-for-multiple-elk-logstash-server/103572)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 5\ **Last updated:** [October 12, 2017, 6:12pm UTC](https://discuss.elastic.co/t/filebeat-output-condition-for-multiple-elk-logstash-server/103572 "2017-10-12T18:12:57Z")
There are two environments - DEV/TEST (ENV1) and PROD (ENV2) hosted in two separate Cloud environment respectively. Both have no internet connectivity. For these two environments, we have separate ELK setup for Nonprod a… --- ## [How to install Filebeat on a ARM based SBC (eg. Raspberry Pi 3)](https://discuss.elastic.co/t/how-to-install-filebeat-on-a-arm-based-sbc-eg-raspberry-pi-3/103670)
**Author:** [@Peter\_Poulsen](https://discuss.elastic.co/u/Peter_Poulsen)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 5:14pm UTC](https://discuss.elastic.co/t/how-to-install-filebeat-on-a-arm-based-sbc-eg-raspberry-pi-3/103670 "2017-10-12T17:14:09Z")
I have read through several threads, forums, and guides. But have not succeded in getting filebeat running on a arm based single board computer. This link do not seem to work anymore: https://beats-nightlies.s3.amazona… --- ## [Filebeat is not sending Json data to Elasticsearch](https://discuss.elastic.co/t/filebeat-is-not-sending-json-data-to-elasticsearch/103627)
**Author:** [@tatha](https://discuss.elastic.co/u/tatha)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 4:33pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-json-data-to-elasticsearch/103627 "2017-10-12T16:33:46Z")
I am trying to send a set of json data (basically logs in the format of json) to elasticsearch instance using filebeat. Here are my config file filebeat.prospectors: - paths: - ~/PIE/Logs/\*.json input\_type: log j… --- ## [Exiting: error loading config file: yaml:](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml/103722)
**Author:** [@prachi1](https://discuss.elastic.co/u/prachi1)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 3:59pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-yaml/103722 "2017-10-12T15:59:40Z")
I added this to filebeat.yml file paths: input\_type: log -"C:\\Users\\pjaiswa6\\Documents\\lnl06a\_3403\\\*.csv" document\_type: my\_log and ran the command - .\\filebeat -c filebeat.yml & I get an error as follows - Exiti… --- ## [What is the significance of read\_timestamp and how to specify it in filebeat config](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519)
**Author:** [@an.secure](https://discuss.elastic.co/u/an.secure)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 3:27pm UTC](https://discuss.elastic.co/t/what-is-the-significance-of-read-timestamp-and-how-to-specify-it-in-filebeat-config/103519 "2017-10-12T15:27:22Z")
Official documentation says : read\_timestamp In case the ingest pipeline parses the timestamp from the log contents, it stores the original @timestamp (representing the time when the log line was read) in this field. H… --- ## [Drop\_event on process (metric beat 5.6.2)](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238)
**Author:** [@Peter\_Steenbergen](https://discuss.elastic.co/u/Peter_Steenbergen)\ **Replies:** 9\ **Last updated:** [October 12, 2017, 2:34pm UTC](https://discuss.elastic.co/t/drop-event-on-process-metric-beat-5-6-2/103238 "2017-10-12T14:34:00Z")
Hi, This is my config: - module: system metricsets: - process enabled: true period: 60s processes: \['.\*'\] process.cgroups.enabled: false processors: - drop\_event.when.range: system.process.cpu… --- ## [Winlogbeat](https://discuss.elastic.co/t/winlogbeat/103293)
**Author:** [@fatmafouad\_y](https://discuss.elastic.co/u/fatmafouad_y)\ **Replies:** 5\ **Last updated:** [October 12, 2017, 1:30pm UTC](https://discuss.elastic.co/t/winlogbeat/103293 "2017-10-12T13:30:36Z")
I got an error when I delete winlogbeat for the first time ... error is : Get-Process : Parameter cannot be processed because the parameter name 'e' is ambiguous. Possible matches include: -Err orAction -ErrorVariabl… --- ## [Metricbeat: grouping multiple metrics in one event](https://discuss.elastic.co/t/metricbeat-grouping-multiple-metrics-in-one-event/98940)
**Author:** [@keithn](https://discuss.elastic.co/u/keithn)\ **Replies:** 3\ **Last updated:** [October 12, 2017, 10:11am UTC](https://discuss.elastic.co/t/metricbeat-grouping-multiple-metrics-in-one-event/98940 "2017-10-12T10:11:46Z")
Hi. Using the following configurations, I was not able to generate a single event containing multiple metrics (referring to https://www.elastic.co/guide/en/beats/metricbeat/current/key-features.html#multiple-events-in-o… --- ## [Error: getsockopt: connection refused](https://discuss.elastic.co/t/error-getsockopt-connection-refused/103418)
**Author:** [@Amit2015](https://discuss.elastic.co/u/Amit2015)\ **Replies:** 3\ **Last updated:** [October 11, 2017, 9:37pm UTC](https://discuss.elastic.co/t/error-getsockopt-connection-refused/103418 "2017-10-11T21:37:39Z")
Hi, I am using filebeat with logstash-\> ElasticSearch. I have configured same port on filebeat and logstash but I am getting error : getsockopt: connection refused Filebeat.yml indent preformatted text by 4 spaces #… --- ## [Missing fields when viewing dashboard in Kibana](https://discuss.elastic.co/t/missing-fields-when-viewing-dashboard-in-kibana/103575)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 1\ **Last updated:** [October 11, 2017, 3:55pm UTC](https://discuss.elastic.co/t/missing-fields-when-viewing-dashboard-in-kibana/103575 "2017-10-11T15:55:08Z")
Hi running 5.5.1 throughout. I have metric beat running on mesos dc/os 1.10 using marathon/docker. I ran the dashboard import scripts. Everything seems to be loading into Elastic fine, but when I look at the kibana da… --- ## [Using both Filebeat and Winlogbeat](https://discuss.elastic.co/t/using-both-filebeat-and-winlogbeat/103484)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [October 11, 2017, 11:48am UTC](https://discuss.elastic.co/t/using-both-filebeat-and-winlogbeat/103484 "2017-10-11T11:48:32Z")
Hello all, I'm using both Filebeat and Winlogbeat to send events to Logstash which then forwards them to Elasticsearch nodes, however whilst my Winlogbeat events are being indexed in Elasticsearch I cannot find anything … --- ## [Filebeat redis output less than 4096 events](https://discuss.elastic.co/t/filebeat-redis-output-less-than-4096-events/101942)
**Author:** [@zhouyue](https://discuss.elastic.co/u/zhouyue)\ **Replies:** 3\ **Last updated:** [October 11, 2017, 10:12am UTC](https://discuss.elastic.co/t/filebeat-redis-output-less-than-4096-events/101942 "2017-10-11T10:12:40Z")
when use the redis output, repeat generating the log file (with the same filename) and removing it. the filebeat would send events no more than 4096. even use one log file contains 6000 rows, the filebeat only send 40… --- ## [JSON and Kibana not reporting the same information](https://discuss.elastic.co/t/json-and-kibana-not-reporting-the-same-information/103460)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 0\ **Last updated:** [October 11, 2017, 4:17am UTC](https://discuss.elastic.co/t/json-and-kibana-not-reporting-the-same-information/103460 "2017-10-11T04:17:53Z")
We noticed the JSON document says 3.88% here but the table view in Kibana and all of the charts for the process show 100 times the percentage that is in the JSON document. { "\_index": "metricbeat-2017.10.11", "\_type":… --- ## [Filebeat with Nginx, how to differentiate 2 files?](https://discuss.elastic.co/t/filebeat-with-nginx-how-to-differentiate-2-files/103346)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 2\ **Last updated:** [October 11, 2017, 2:15am UTC](https://discuss.elastic.co/t/filebeat-with-nginx-how-to-differentiate-2-files/103346 "2017-10-11T02:15:36Z")
Good evening, I use Filebeat for nginx files with ingest, here my filebeat config file: { "output.elasticsearch": { "hosts": \[ "172.16.1.3:9200" \], "template.enabled": false, "index": "prod-%{+y… --- ## [Filebeat 5.5.2 Connection reset by peer](https://discuss.elastic.co/t/filebeat-5-5-2-connection-reset-by-peer/103090)
**Author:** [@Bkt](https://discuss.elastic.co/u/Bkt)\ **Replies:** 5\ **Last updated:** [October 10, 2017, 8:21pm UTC](https://discuss.elastic.co/t/filebeat-5-5-2-connection-reset-by-peer/103090 "2017-10-10T20:21:45Z")
Hello, I am getting connection reset when using filebeat to send the logs to logstash. When I restart filebeat, it does send the prior events but soon repeats the connection reset by peer event. I am using the filebeat v… --- ## [Can include sub-configuration](https://discuss.elastic.co/t/can-include-sub-configuration/103287)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 3\ **Last updated:** [October 10, 2017, 6:33pm UTC](https://discuss.elastic.co/t/can-include-sub-configuration/103287 "2017-10-10T18:33:50Z")
Hi, There is filebeat & metricbeat in my machine. Some configuration is same in these yml file, like output elasticsearch or some customize fields. Can I write the same things in a config-file, and then include it in o… --- ## [Installing filebeats Ubuntu 16.04 repo timeout](https://discuss.elastic.co/t/installing-filebeats-ubuntu-16-04-repo-timeout/101825)
**Author:** [@drenriza](https://discuss.elastic.co/u/drenriza)\ **Replies:** 10\ **Last updated:** [October 10, 2017, 2:27pm UTC](https://discuss.elastic.co/t/installing-filebeats-ubuntu-16-04-repo-timeout/101825 "2017-10-10T14:27:04Z")
When looking over the installation documentation for APT it is stated that you need to download and add the elasticsearch GPG key, and than add the following repo deb https://artifacts.elastic.co/packages/5.x/apt stabl… --- ## [Installing Filebeat on Windows](https://discuss.elastic.co/t/installing-filebeat-on-windows/102992)
**Author:** [@prachi1](https://discuss.elastic.co/u/prachi1)\ **Replies:** 3\ **Last updated:** [October 10, 2017, 1:22pm UTC](https://discuss.elastic.co/t/installing-filebeat-on-windows/102992 "2017-10-10T13:22:11Z")
I am trying to install Filebeat on windows7 64 bit. I entered the following commands while running cmd with elevated rights. cd C:\\elastic\\filebeat-5.2.1-windows-x86\_64 filebeat-5.2.1-windows-x86\_64\>filebeat.exe -e -c… --- ## [Packetbeat: panic: Too many events acked](https://discuss.elastic.co/t/packetbeat-panic-too-many-events-acked/102055)
**Author:** [@191801737](https://discuss.elastic.co/u/191801737)\ **Replies:** 3\ **Last updated:** [October 10, 2017, 11:47am UTC](https://discuss.elastic.co/t/packetbeat-panic-too-many-events-acked/102055 "2017-10-10T11:47:59Z")
\[root@xdl-10-7 packetbeat\]# bin/packetbeat -version packetbeat version 6.0.0-beta2 (amd64), libbeat 6.0.0-beta2 \[root@xdl-10-7 packetbeat\]# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) /var/log/messag… --- ## [Using environment variable to specify file paths in yml config file](https://discuss.elastic.co/t/using-environment-variable-to-specify-file-paths-in-yml-config-file/103328)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 2\ **Last updated:** [October 10, 2017, 11:17am UTC](https://discuss.elastic.co/t/using-environment-variable-to-specify-file-paths-in-yml-config-file/103328 "2017-10-10T11:17:38Z")
Is it possible to use an environment variable to specify part of the file path in the \*beat.yml configuration? You can see what I'm trying to do here. Is there a way to make it work? output.logstash: hosts: \["foobar.… --- ## [Filebeat never releases unupdated logfiles](https://discuss.elastic.co/t/filebeat-never-releases-unupdated-logfiles/102673)
**Author:** [@giakalisn](https://discuss.elastic.co/u/giakalisn)\ **Replies:** 8\ **Last updated:** [October 10, 2017, 10:55am UTC](https://discuss.elastic.co/t/filebeat-never-releases-unupdated-logfiles/102673 "2017-10-10T10:55:32Z")
Sometimes, filebeat keeps old files opened forever. lsof shows us that filebeat is at EOF, but for some unknown reasons it doesn't close the file. I am using latest version of filebeat Here is our setup : close\_inacti… --- ## [Installing Metricbeat Dashboards on Kibana for Amazon Elasticsearch](https://discuss.elastic.co/t/installing-metricbeat-dashboards-on-kibana-for-amazon-elasticsearch/102180)
**Author:** [@mdanner](https://discuss.elastic.co/u/mdanner)\ **Replies:** 12\ **Last updated:** [October 10, 2017, 7:34am UTC](https://discuss.elastic.co/t/installing-metricbeat-dashboards-on-kibana-for-amazon-elasticsearch/102180 "2017-10-10T07:34:23Z")
I'm trying to install the Sample Kibana Dashboards on an instance of the Amazon Elasticsearch Service. That service is protected by AWS Signature Version 4 Signing. I issued these commands from an EC2 instance of Ubunt… --- ## [Distinct LS port per prospector for multiline](https://discuss.elastic.co/t/distinct-ls-port-per-prospector-for-multiline/101843)
**Author:** [@g.le](https://discuss.elastic.co/u/g.le)\ **Replies:** 4\ **Last updated:** [October 9, 2017, 4:37pm UTC](https://discuss.elastic.co/t/distinct-ls-port-per-prospector-for-multiline/101843 "2017-10-09T16:37:35Z")
Hello everyone! My current filebeat configuration reads logs from two different directories. Each directory contains logs of distinct formats, therefore I have two log formats. For each directory, I have specified a fi… --- ## [Duplicate Events in filebeat/auditbeat](https://discuss.elastic.co/t/duplicate-events-in-filebeat-auditbeat/103290)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 0\ **Last updated:** [October 10, 2017, 4:39am UTC](https://discuss.elastic.co/t/duplicate-events-in-filebeat-auditbeat/103290 "2017-10-10T04:39:50Z")
Hi Team, There are few occasion where filebeat/auditbeat is indexing same log event or audit event twice in elasticsearch with different \_id value. Is this the expected behavior and is there any way to reduce duplicat… --- ## [How to extend MetricBeat to execute external scripts?](https://discuss.elastic.co/t/how-to-extend-metricbeat-to-execute-external-scripts/102104)
**Author:** [@pascaldergane](https://discuss.elastic.co/u/pascaldergane)\ **Replies:** 1\ **Last updated:** [October 9, 2017, 8:57pm UTC](https://discuss.elastic.co/t/how-to-extend-metricbeat-to-execute-external-scripts/102104 "2017-10-09T20:57:52Z")
Hi all, I've got some "old" probes based on snmp command (snmpwalk, snmpget). I would like to reuse them. How can extend metricbeat to execute my old scripts? --- ## [How to use Metricbeat Docker module in Docker Swarm](https://discuss.elastic.co/t/how-to-use-metricbeat-docker-module-in-docker-swarm/103019)
**Author:** [@muhammadrehansaeed](https://discuss.elastic.co/u/muhammadrehansaeed)\ **Replies:** 5\ **Last updated:** [October 9, 2017, 5:39pm UTC](https://discuss.elastic.co/t/how-to-use-metricbeat-docker-module-in-docker-swarm/103019 "2017-10-09T17:39:34Z")
I'm using Metricbeat in my Docker Swarm and have managed to get the system model pushing CPU and memory metrics to Elastic Search. I can then see the metrics in the sample dashboard in Kibana. However, I can't seem to ge… --- ## [Metricbeat - Get only Local Disk usage (Excluding mount disk usage)](https://discuss.elastic.co/t/metricbeat-get-only-local-disk-usage-excluding-mount-disk-usage/103009)
**Author:** [@mahadevaprasadap](https://discuss.elastic.co/u/mahadevaprasadap)\ **Replies:** 3\ **Last updated:** [October 9, 2017, 3:26pm UTC](https://discuss.elastic.co/t/metricbeat-get-only-local-disk-usage-excluding-mount-disk-usage/103009 "2017-10-09T15:26:37Z")
How to get only local disk usage by excluding mount disk usage in Metricbeat? --- ## [Unable to start filebeat](https://discuss.elastic.co/t/unable-to-start-filebeat/102869)
**Author:** [@vinodjv3](https://discuss.elastic.co/u/vinodjv3)\ **Replies:** 6\ **Last updated:** [October 9, 2017, 2:26pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat/102869 "2017-10-09T14:26:33Z")
Downloaded filebeat to Linux machine. Kernel version of the machine is "2.6.18-238.5.1.el5". I get error as below. ksh\> ./filebeat Memory fault Please suggest --- ## [File Beat performance - How to check if file beat is keeping up while reading files](https://discuss.elastic.co/t/file-beat-performance-how-to-check-if-file-beat-is-keeping-up-while-reading-files/102899)
**Author:** [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Replies:** 6\ **Last updated:** [October 9, 2017, 12:24pm UTC](https://discuss.elastic.co/t/file-beat-performance-how-to-check-if-file-beat-is-keeping-up-while-reading-files/102899 "2017-10-09T12:24:18Z")
We have an ELK 5.5.2 environment where we have 3 master enable nodes, 3 coordinating nodes and 8 data nodes. The servers in this environment have 8 cores, 64gb ram and 200gb of storage on the data nodes. We are sendin… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=495) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=497)