# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=497 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 498 --- ## [Install winlogbeat on windows server 2003 without powershell](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 7\ **Last updated:** [October 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/install-winlogbeat-on-windows-server-2003-without-powershell/102506 "2017-10-06T13:53:32Z")
I have a server with windows server 2003 installed and I need to forward that server windows event logs to logstash through winlogbeat. But there is no powershell in windows server 2003. So how can I install winlogbeat… --- ## [How to get Host: field from tcpdump](https://discuss.elastic.co/t/how-to-get-host-field-from-tcpdump/103122)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 2\ **Last updated:** [October 8, 2017, 9:03pm UTC](https://discuss.elastic.co/t/how-to-get-host-field-from-tcpdump/103122 "2017-10-08T21:03:59Z")
New to Elasticsearch. How can we get the "host" field, as seen below in the sample from Wireshark, so we can view the data in Kibana? Hypertext Transfer Protocol GET /some/url Host: www.someservername.com\\r\\n \ **Author:** [@mtrivedi](https://discuss.elastic.co/u/mtrivedi)\ **Replies:** 5\ **Last updated:** [October 8, 2017, 11:35am UTC](https://discuss.elastic.co/t/how-do-i-get-the-actual-content-of-the-http-messages-body/102951 "2017-10-08T11:35:36Z") I am using Packetbeat on a remote machine running CentOS. \> \[root@bng1 bin\]# ./packetbeat -version \> packetbeat version 5.6.1 (amd64), libbeat 5.6.1 I want to fetch the raw content of the http 200 request and the respo… --- ## [Filebeat multiline java app log4j logs](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018)
**Author:** [@ktella](https://discuss.elastic.co/u/ktella)\ **Replies:** 4\ **Last updated:** [October 8, 2017, 11:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018 "2017-10-08T11:26:46Z")
Need some help with filebeat multiline configuration of java App logs. I'm pasting sample logs from my app. For each request Ill have a Request and Response lines with some extra lines sometimes. All these logging is do… --- ## [Filebeats - skips lines](https://discuss.elastic.co/t/filebeats-skips-lines/103018)
**Author:** [@adachi](https://discuss.elastic.co/u/adachi)\ **Replies:** 1\ **Last updated:** [October 8, 2017, 10:44am UTC](https://discuss.elastic.co/t/filebeats-skips-lines/103018 "2017-10-08T10:44:45Z")
I've got a log file which has 200 empty lines in the end (pre-write to allocate space). When the software writes to this file it replaces empty lines with logs and adds more empty lines in the end when 200 lines have be… --- ## [Configuring heartbeat for different environments](https://discuss.elastic.co/t/configuring-heartbeat-for-different-environments/102980)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [October 8, 2017, 10:35am UTC](https://discuss.elastic.co/t/configuring-heartbeat-for-different-environments/102980 "2017-10-08T10:35:58Z")
Hello, I am using heartbeat to check of various services on the environments however I can see that the environments are configured after the heartbeat\_monitors. Is that any way I can add multiple environments each with… --- ## [Collecting Storage metrics and logs into ELK stack](https://discuss.elastic.co/t/collecting-storage-metrics-and-logs-into-elk-stack/102695)
**Author:** [@pankajgadhari](https://discuss.elastic.co/u/pankajgadhari)\ **Replies:** 2\ **Last updated:** [October 7, 2017, 6:54am UTC](https://discuss.elastic.co/t/collecting-storage-metrics-and-logs-into-elk-stack/102695 "2017-10-07T06:54:11Z")
Hi All, I want to perform SAN analytics and do the correlations of Server Metrics with Storage metrics. Storage here I am referring to is - EMC SAN Storage, HP SAN Storage or IBM SAN storage. How can I collect SAN Metr… --- ## [Can't get location show up on the map in Kibana](https://discuss.elastic.co/t/cant-get-location-show-up-on-the-map-in-kibana/102872)
**Author:** [@waynez](https://discuss.elastic.co/u/waynez)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 10:05pm UTC](https://discuss.elastic.co/t/cant-get-location-show-up-on-the-map-in-kibana/102872 "2017-10-06T22:05:00Z")
I have been trying to figure out how to get my geo ip location shown up on Kibana map. But I always get the following error: The "metricbeat\*" index pattern does not contain any of the following field types: geo\_point I… --- ## [Wish it was all one package](https://discuss.elastic.co/t/wish-it-was-all-one-package/103031)
**Author:** [@panaman](https://discuss.elastic.co/u/panaman)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 9:43pm UTC](https://discuss.elastic.co/t/wish-it-was-all-one-package/103031 "2017-10-06T21:43:09Z")
i wish, packetbeat, metricbeat, filebeat and any a future beat or other beat not listed was one package and you just enabled features in the config --- ## [How to set umask in metricbeat?](https://discuss.elastic.co/t/how-to-set-umask-in-metricbeat/103068)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 9:35pm UTC](https://discuss.elastic.co/t/how-to-set-umask-in-metricbeat/103068 "2017-10-06T21:35:41Z")
Hi, how can i configure the umask for metricbeat logs? I build from source on arm system. When I start metricbeat it sets 600 as permission, but I would like to give other users than the beat process the permission to… --- ## [Filebeat + Apache2 configuration help!](https://discuss.elastic.co/t/filebeat-apache2-configuration-help/100422)
**Author:** [@eddie1](https://discuss.elastic.co/u/eddie1)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 9:08pm UTC](https://discuss.elastic.co/t/filebeat-apache2-configuration-help/100422 "2017-10-06T21:08:44Z")
Hi, I'm new to the ELK stack and am trying to figure out how to configure filebeat+apache 2. I have the system doing some basic work such as syslog going from filebeat-\>logstash-\>ES, but I'm finding the documentation … --- ## [Configuring Beats to send logs to a SIEM and Logstash in parallel](https://discuss.elastic.co/t/configuring-beats-to-send-logs-to-a-siem-and-logstash-in-parallel/103061)
**Author:** [@s.essa](https://discuss.elastic.co/u/s.essa)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 9:05pm UTC](https://discuss.elastic.co/t/configuring-beats-to-send-logs-to-a-siem-and-logstash-in-parallel/103061 "2017-10-06T21:05:27Z")
Hi there, The configuration guide obviously mentions log output to elasticsearch and logstash but I'm wondering if it is possible to send the logs directly to a SIEM, something outside of the Elastic stack. I know Beats… --- ## [Filebeats to read locked file](https://discuss.elastic.co/t/filebeats-to-read-locked-file/102826)
**Author:** [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 3:57pm UTC](https://discuss.elastic.co/t/filebeats-to-read-locked-file/102826 "2017-10-06T15:57:44Z")
Hi, I have an application which continuously writes to a log file and locks it while it is writing the data. I need to use filebeats to get the logs from the file to ElasticSearch in Real Time. Can filebeat ship such da… --- ## [Is publishing events thread safe?](https://discuss.elastic.co/t/is-publishing-events-thread-safe/102877)
**Author:** [@jmegin](https://discuss.elastic.co/u/jmegin)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 1:56pm UTC](https://discuss.elastic.co/t/is-publishing-events-thread-safe/102877 "2017-10-06T13:56:14Z")
The developer guide shows how to create an instance of publisher.Client, but I'm wondering if it's PublishEvent and PublishEvents methods are thread safe. I'm currently working on a beat that receives HTTP requests and … --- ## [Multiline | Not even working](https://discuss.elastic.co/t/multiline-not-even-working/102963)
**Author:** [@WhipSnake](https://discuss.elastic.co/u/WhipSnake)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 12:48pm UTC](https://discuss.elastic.co/t/multiline-not-even-working/102963 "2017-10-06T12:48:53Z")
I have having difficulty getting the below multiline code to work. I feel I am close just no sure what I am doing wrong. I want it to take the lines that don't have time stamps and append it to the time stamp that is abo… --- ## [Filebeat holding old files in Centos 6.5](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571)
**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\ **Replies:** 4\ **Last updated:** [October 5, 2017, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-holding-old-files-in-centos-6-5/100571 "2017-10-05T15:03:46Z")
Hi not sure it bug but filebeat is killing space on filesystem one I do restart filebeat system get back to normal can some one please why filebeat stuck to old files I'm running 5.5.2 version ? --- ## [Tricky Multiline pattern/configuration](https://discuss.elastic.co/t/tricky-multiline-pattern-configuration/102450)
**Author:** [@sbuch](https://discuss.elastic.co/u/sbuch)\ **Replies:** 8\ **Last updated:** [October 6, 2017, 10:11am UTC](https://discuss.elastic.co/t/tricky-multiline-pattern-configuration/102450 "2017-10-06T10:11:59Z")
Hi I have a very tricky situation with two types of multiline messages in one file and of course no application support to change it :slight\_smile: Example 1: 20170930 14:20:01.003 message 1 line 1 message 1 line 2 201… --- ## [JVM and GC analysis using metricbeat](https://discuss.elastic.co/t/jvm-and-gc-analysis-using-metricbeat/102954)
**Author:** [@desh](https://discuss.elastic.co/u/desh)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 7:13am UTC](https://discuss.elastic.co/t/jvm-and-gc-analysis-using-metricbeat/102954 "2017-10-06T07:13:19Z")
I am new to metricbeat. I have done setup of metricbeat and using it to visualise processes in kibana, is there any way to view my JVM statistics? --- ## [Filebeat not able to read multiple log files](https://discuss.elastic.co/t/filebeat-not-able-to-read-multiple-log-files/102817)
**Author:** [@atosguest](https://discuss.elastic.co/u/atosguest)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 6:11am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-read-multiple-log-files/102817 "2017-10-06T06:11:18Z")
Hi All, I am using Filebeat 5.5 with ELK stack 5.5. I configured filebeat.yml file to sent all logs to logstash. it is working fine when I am giving single log file but when I am trying to configure it for multiple log… --- ## [Filebeat processing status](https://discuss.elastic.co/t/filebeat-processing-status/102690)
**Author:** [@mantzas](https://discuss.elastic.co/u/mantzas)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 6:04am UTC](https://discuss.elastic.co/t/filebeat-processing-status/102690 "2017-10-06T06:04:28Z")
Hi, we are using AWS and we terminate instances frequently. These instances contain an application which logs to file and filebeat sends the logs to logstash. Before we terminate the instances we remove them from acti… --- ## [Using Jolokia in Metricbeat need to collect G1GC garbage collector information](https://discuss.elastic.co/t/using-jolokia-in-metricbeat-need-to-collect-g1gc-garbage-collector-information/102698)
**Author:** [@abirami](https://discuss.elastic.co/u/abirami)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 12:31pm UTC](https://discuss.elastic.co/t/using-jolokia-in-metricbeat-need-to-collect-g1gc-garbage-collector-information/102698 "2017-10-04T12:31:11Z")
Hi , In our JVM ,we are using G1GC algorithm for garbage collection.I couldn't see any name related to that in jolokia metrics like 'name=G1 Old Generation,type=GarbageCollector' i tried using this config but it didnt … --- ## [Shipping Logs to Logstash not Working](https://discuss.elastic.co/t/shipping-logs-to-logstash-not-working/102892)
**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 2:57am UTC](https://discuss.elastic.co/t/shipping-logs-to-logstash-not-working/102892 "2017-10-06T02:57:37Z")
I thought I would take moment today to see how I could ship Windows logs from endpoints to Elastic. I set up a basic winlogbeats, config shown below: winlogbeat.event\_logs: - name: Application #ignore\_older: 24h … --- ## [Replace winlogbeat configuration file](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789)
**Author:** [@justas](https://discuss.elastic.co/u/justas)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 1:30am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789 "2017-10-06T01:30:13Z")
Hi All, What is the proper way to replace/update winlogbeat.yml file and force that file into the service? I expected modifying the .yml in programfiles/winlogbeat and service restart would pick it up, but it does not. … --- ## [Filebeat Windows 10 IoT Core availability](https://discuss.elastic.co/t/filebeat-windows-10-iot-core-availability/102727)
**Author:** [@bder](https://discuss.elastic.co/u/bder)\ **Replies:** 1\ **Last updated:** [October 5, 2017, 3:20pm UTC](https://discuss.elastic.co/t/filebeat-windows-10-iot-core-availability/102727 "2017-10-05T15:20:33Z")
Hi, I am wondering how to get the beats stack (filebeat specifically) up and running on Windows 10 IoT core Raspberry PI based devices. I couldn't find any specific packages for this platform, is there a known way to ge… --- ## [Logstash not outputting Heartbeat input](https://discuss.elastic.co/t/logstash-not-outputting-heartbeat-input/99875)
**Author:** [@londonx](https://discuss.elastic.co/u/londonx)\ **Replies:** 3\ **Last updated:** [October 5, 2017, 12:26pm UTC](https://discuss.elastic.co/t/logstash-not-outputting-heartbeat-input/99875 "2017-10-05T12:26:12Z")
Logstash 5.5.1 Heartbeat 5.5.2 & tried 6.0.0 beta2 logstash-plugin update logstash-input-beats Can not get logstash to forward heartbeat data to Elastic. Debug mode shows it receives the data but then does nothing wit… --- ## [Kafka output logs everything with WARN level](https://discuss.elastic.co/t/kafka-output-logs-everything-with-warn-level/102259)
**Author:** [@imehl](https://discuss.elastic.co/u/imehl)\ **Replies:** 3\ **Last updated:** [October 5, 2017, 9:45am UTC](https://discuss.elastic.co/t/kafka-output-logs-everything-with-warn-level/102259 "2017-10-05T09:45:40Z")
Hi, the kafka output plugin of beats logs all messages with the "WARN" level. Example of "INFO" messages: 2017/09/29 12:44:40.975292 log.go:16: WARN kafka message: Initializing new client 2017/09/29 12:44:40.975362 l… --- ## [Filebeat + Windows: Spaces in directories](https://discuss.elastic.co/t/filebeat-windows-spaces-in-directories/102584)
**Author:** [@Roger\_Keulen](https://discuss.elastic.co/u/Roger_Keulen)\ **Replies:** 6\ **Last updated:** [October 5, 2017, 6:37am UTC](https://discuss.elastic.co/t/filebeat-windows-spaces-in-directories/102584 "2017-10-05T06:37:10Z")
I'm trying to setup filebeat on a windows machine The dir of apache logs = C:/Program Files (x86)/EasyPHP/binaries/apache/logs/error\* The error i get is: Exiting: Error getting config for fielset apache2/error: Error … --- ## [Merging rails log lines](https://discuss.elastic.co/t/merging-rails-log-lines/102624)
**Author:** [@Richard\_Collins](https://discuss.elastic.co/u/Richard_Collins)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 9:33pm UTC](https://discuss.elastic.co/t/merging-rails-log-lines/102624 "2017-10-04T21:33:00Z")
Hi, I am looking at setting up some log aggregation using Filebeats and Elastisearch. We currently have around 200 servers that logs will be aggregated from, with aspirations for growth - the attraction to Elastisearch … --- ## [Please point me to Beats 5.6 build server (Solaris compiled)](https://discuss.elastic.co/t/please-point-me-to-beats-5-6-build-server-solaris-compiled/102629)
**Author:** [@rustbot](https://discuss.elastic.co/u/rustbot)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 9:31pm UTC](https://discuss.elastic.co/t/please-point-me-to-beats-5-6-build-server-solaris-compiled/102629 "2017-10-04T21:31:09Z")
I was wondering if there was still a build server that had the compiled 5.6 version of beats (Filebeats, Metricbeats, etc) for Solaris. A few months ago I found a 5.5 Filebeats version that was compiled for Solaris on n… --- ## [Metricbeat won't start on boot (AWS EC2, Ubuntu 16.04)](https://discuss.elastic.co/t/metricbeat-wont-start-on-boot-aws-ec2-ubuntu-16-04/102706)
**Author:** [@wrossmorrow](https://discuss.elastic.co/u/wrossmorrow)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 12:55pm UTC](https://discuss.elastic.co/t/metricbeat-wont-start-on-boot-aws-ec2-ubuntu-16-04/102706 "2017-10-04T12:55:28Z")
Hi! We're running EC2 instances with Ubuntu 16.04. We have metricbeat installed in the image we use, but it won't start on boot (for new instances or when restarting a stopped instance). Here's the sort of error we get w… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=496) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=498)