# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=498 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 499 --- ## [Filebeat may be sending bad packets](https://discuss.elastic.co/t/filebeat-may-be-sending-bad-packets/102033)
**Author:** [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 11:41am UTC](https://discuss.elastic.co/t/filebeat-may-be-sending-bad-packets/102033 "2017-10-04T11:41:15Z")
Hello, I'm working on a new Beat which has a tcp listener and decodes lumberjackv2. I ran into a problem with errors which I initially thought was due to my code, but as I've added more and more debugging and worked ba… --- ## [How to set up kafka output partition option: hash.hash or key?](https://discuss.elastic.co/t/how-to-set-up-kafka-output-partition-option-hash-hash-or-key/102311)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 11:30am UTC](https://discuss.elastic.co/t/how-to-set-up-kafka-output-partition-option-hash-hash-or-key/102311 "2017-10-04T11:30:13Z")
Hello, Can I set up kafka partitions as follows? partition: hash hash.hash to be combination of beat.hostname + source? key to be the same as beat.hostname + source? I am wondering what should be the correct synta… --- ## [Multiple metricbeat modules each with different output index](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757)
**Author:** [@jruzicka](https://discuss.elastic.co/u/jruzicka)\ **Replies:** 6\ **Last updated:** [October 4, 2017, 11:23am UTC](https://discuss.elastic.co/t/multiple-metricbeat-modules-each-with-different-output-index/99757 "2017-10-04T11:23:51Z")
Is it possible to have different modules within a single metricbeat send to different output index location? Like this in theory: -module1 metricset output index1 -module2 metricset output index2 --- ## [What is different between "backoff" and "harvester" in Filebeat?](https://discuss.elastic.co/t/what-is-different-between-backoff-and-harvester-in-filebeat/101299)
**Author:** [@vuxuanlai](https://discuss.elastic.co/u/vuxuanlai)\ **Replies:** 1\ **Last updated:** [October 4, 2017, 10:58am UTC](https://discuss.elastic.co/t/what-is-different-between-backoff-and-harvester-in-filebeat/101299 "2017-10-04T10:58:18Z")
As i know: Backoff values define how long it is waited to check a file again after EOF is reached. Harvester: reads each file, line by line, and sends the content to the output. So what is the relation between "backof… --- ## [Adding state storage backend options to the libbeat framework?](https://discuss.elastic.co/t/adding-state-storage-backend-options-to-the-libbeat-framework/101080)
**Author:** [@Dustin\_Decker](https://discuss.elastic.co/u/Dustin_Decker)\ **Replies:** 3\ **Last updated:** [October 4, 2017, 10:54am UTC](https://discuss.elastic.co/t/adding-state-storage-backend-options-to-the-libbeat-framework/101080 "2017-10-04T10:54:51Z")
For beats that don't depend on a local system resource, such as a beat for a web API, having a some standard options to store state remotely would be a huge win when running on infrastructure without persistent disk stor… --- ## [Beats TCP Message Body Decode](https://discuss.elastic.co/t/beats-tcp-message-body-decode/97674)
**Author:** [@Zeeshan\_Haider](https://discuss.elastic.co/u/Zeeshan_Haider)\ **Replies:** 10\ **Last updated:** [October 4, 2017, 10:49am UTC](https://discuss.elastic.co/t/beats-tcp-message-body-decode/97674 "2017-10-04T10:49:16Z")
I just have a Question I am working on a private service and want to integrate beat messages ingestion on my service, I been trying to decode tcp data which is coming from beat, I was successfully decoding the packet its… --- ## [Filebeat to Logstash I/O Timeouts through AWS ELB](https://discuss.elastic.co/t/filebeat-to-logstash-i-o-timeouts-through-aws-elb/100374)
**Author:** [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)\ **Replies:** 5\ **Last updated:** [October 4, 2017, 10:45am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-i-o-timeouts-through-aws-elb/100374 "2017-10-04T10:45:46Z")
Hi all, I am running Filebeat (6.0.0-beta2) on my Docker hosts to collect Docker logs (via the json-files driver) and sending them to a group of Logstash 5.5 instances for aggregation. I currently have several Logstash… --- ## [Dest.stats vs Source.stats](https://discuss.elastic.co/t/dest-stats-vs-source-stats/100442)
**Author:** [@flowsys](https://discuss.elastic.co/u/flowsys)\ **Replies:** 3\ **Last updated:** [October 4, 2017, 10:15am UTC](https://discuss.elastic.co/t/dest-stats-vs-source-stats/100442 "2017-10-04T10:15:40Z")
How do we interpret in a document the value of dest.stats.net\_packets\_total vs source.stats.net\_packets\_total ? Is it the total packets received at destination IP and total packets sent from source IP? Or Total packet… --- ## [Filebeat 5.6 nginx ingest to logstash in a 5.6 elk environment](https://discuss.elastic.co/t/filebeat-5-6-nginx-ingest-to-logstash-in-a-5-6-elk-environment/102663)
**Author:** [@hsafe](https://discuss.elastic.co/u/hsafe)\ **Replies:** 0\ **Last updated:** [October 4, 2017, 8:32am UTC](https://discuss.elastic.co/t/filebeat-5-6-nginx-ingest-to-logstash-in-a-5-6-elk-environment/102663 "2017-10-04T08:32:14Z")
Hi there, I am trying to configure nginx ingestion using grok patterns and facing issues: all the documents online including the elastic.io are suggesting the good old "document\_type" directive but then in the later re… --- ## [Metricbeat support for AIX machines](https://discuss.elastic.co/t/metricbeat-support-for-aix-machines/102650)
**Author:** [@desh](https://discuss.elastic.co/u/desh)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 7:33am UTC](https://discuss.elastic.co/t/metricbeat-support-for-aix-machines/102650 "2017-10-04T07:33:36Z")
Hi, I need to install metricbeat on AIX servers but I don't find any download for AIX machines. Is metricbeat available for AIX machine? if they are not supported, is there any future plan to support it. are there any wo… --- ## [.asdasd](https://discuss.elastic.co/t/asdasd/99474)
**Author:** [@srivarunlokku](https://discuss.elastic.co/u/srivarunlokku)\ **Replies:** 4\ **Last updated:** [October 3, 2017, 4:35pm UTC](https://discuss.elastic.co/t/asdasd/99474 "2017-10-03T16:35:08Z")
........sdsdsa --- ## [Filebeat Nginx module](https://discuss.elastic.co/t/filebeat-nginx-module/101488)
**Author:** [@Youkoulayley](https://discuss.elastic.co/u/Youkoulayley)\ **Replies:** 2\ **Last updated:** [October 3, 2017, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module/101488 "2017-10-03T13:40:21Z")
Hello, I I have a filebeat who send nginx logs to logstash with this conf : ########################################### # HEARTBEAT.YML # Generated by Ansible ########################################### filebeat.prosp… --- ## [Log Sync time](https://discuss.elastic.co/t/log-sync-time/102500)
**Author:** [@shethsaam](https://discuss.elastic.co/u/shethsaam)\ **Replies:** 3\ **Last updated:** [October 3, 2017, 1:27pm UTC](https://discuss.elastic.co/t/log-sync-time/102500 "2017-10-03T13:27:14Z")
Hi, I am having a setup wherein I am sending Win Event logs from my local machine (windows 10) to Elastic cloud (service). My Config: Winglogbeat -\>Elastic search -\> Kibana. Working on the setup, I need to find the defa… --- ## [How to load index templates and dashboards from single place in beats 6.x](https://discuss.elastic.co/t/how-to-load-index-templates-and-dashboards-from-single-place-in-beats-6-x/100954)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 2\ **Last updated:** [October 2, 2017, 5:42am UTC](https://discuss.elastic.co/t/how-to-load-index-templates-and-dashboards-from-single-place-in-beats-6-x/100954 "2017-10-02T05:42:42Z")
Hello. As elastic stack 6.0 will reach its GA soon I would like to know the best way to automatically load index templates and dashboards for all the beats from the single server. Beats 6.x changed the way index templa… --- ## [Newbie and need help](https://discuss.elastic.co/t/newbie-and-need-help/102298)
**Author:** [@bjvista](https://discuss.elastic.co/u/bjvista)\ **Replies:** 1\ **Last updated:** [October 1, 2017, 10:03pm UTC](https://discuss.elastic.co/t/newbie-and-need-help/102298 "2017-10-01T22:03:54Z")
I have a server running ElasticSearch. It's working and receiving logs from a bunch of our VM's. On a different server on the network I have installed Filebeat. This server stores JSON logs from another application. … --- ## [Different Logs to Different ELK Stacks](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289)
**Author:** [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\ **Replies:** 2\ **Last updated:** [September 29, 2017, 8:36pm UTC](https://discuss.elastic.co/t/different-logs-to-different-elk-stacks/102289 "2017-09-29T20:36:53Z")
Is it possible to configure an instance of Winlogbeat to send different logs to different elk stacks? If no, how would such be accomplished? Would that require the installation of multiple instances of Winlogbeat on serv… --- ## [Firewall with Beats](https://discuss.elastic.co/t/firewall-with-beats/102132)
**Author:** [@Threepwood](https://discuss.elastic.co/u/Threepwood)\ **Replies:** 3\ **Last updated:** [September 29, 2017, 4:38pm UTC](https://discuss.elastic.co/t/firewall-with-beats/102132 "2017-09-29T16:38:50Z")
Hello, I just set up the elk suite I installed filebeat on a client machine, but this one to iptables rules. I have to fight with, I can not let pass filebeat. if I disable the iptables, filebeat communicates perfect… --- ## [Getsockopt: connection refused](https://discuss.elastic.co/t/getsockopt-connection-refused/102206)
**Author:** [@brw314](https://discuss.elastic.co/u/brw314)\ **Replies:** 1\ **Last updated:** [September 29, 2017, 8:43am UTC](https://discuss.elastic.co/t/getsockopt-connection-refused/102206 "2017-09-29T08:43:00Z")
I only have ports 8080,8081,8082 available on this linux sytem. I get this error(I've also tried other ports): 2017/09/29 02:22:26.347036 single.go:140: ERR Connecting error publishing events (retrying): dial tcp \[::1… --- ## [Filebeat Load All the Entries in Log File Downloaded from Remote Server](https://discuss.elastic.co/t/filebeat-load-all-the-entries-in-log-file-downloaded-from-remote-server/102024)
**Author:** [@feijiangnan](https://discuss.elastic.co/u/feijiangnan)\ **Replies:** 2\ **Last updated:** [September 28, 2017, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-load-all-the-entries-in-log-file-downloaded-from-remote-server/102024 "2017-09-28T13:53:38Z")
Hi there, In my scenario, I download log file with wget from remote server to local and parse it with Logstash and Filebeat. For example: Remote file name: SystemOut.log, and its contents looks like below \[9/26/17 7:0… --- ## [Exclude line regex wont work](https://discuss.elastic.co/t/exclude-line-regex-wont-work/101855)
**Author:** [@Thunder](https://discuss.elastic.co/u/Thunder)\ **Replies:** 4\ **Last updated:** [September 28, 2017, 9:16am UTC](https://discuss.elastic.co/t/exclude-line-regex-wont-work/101855 "2017-09-28T09:16:18Z")
Hi, I trying to exclude lines from the logs. Some lines from the log: Connect from 192.168.3.6:54422 to 192.168.3.2:3306 (mysql/TCP) \[26/Sep/2017:00:19:50 +0200\] 94.0.38.45 - - "" 408 160 "" "" 58010 859 "www~" "www"… --- ## [Filebeat Performance](https://discuss.elastic.co/t/filebeat-performance/101946)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 2\ **Last updated:** [September 28, 2017, 7:33am UTC](https://discuss.elastic.co/t/filebeat-performance/101946 "2017-09-28T07:33:32Z")
Hi, My filebeat config file has 5 prospectors. Each one access a network path on one of five application servers. app\_server\_01, d:\\app\_server\\logs\\app\_server\_01.log app\_server\_02, d:\\app\_server\\logs\\app\_server\_0… --- ## [It's a bug?](https://discuss.elastic.co/t/its-a-bug/101811)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [September 28, 2017, 1:21am UTC](https://discuss.elastic.co/t/its-a-bug/101811 "2017-09-28T01:21:11Z")
I create a new beat based on https://www.elastic.co/guide/en/beats/devguide/current/beater-interface.html. And then I modified beat.yml as follow, but when it is executed for 10 minutes, /tmp/testbeats/testbeats will no … --- ## [Filebeats protocol load balancing to a single IP](https://discuss.elastic.co/t/filebeats-protocol-load-balancing-to-a-single-ip/102017)
**Author:** [@xrl](https://discuss.elastic.co/u/xrl)\ **Replies:** 1\ **Last updated:** [September 27, 2017, 10:22pm UTC](https://discuss.elastic.co/t/filebeats-protocol-load-balancing-to-a-single-ip/102017 "2017-09-27T22:22:57Z")
I want to set up a pool of logstash processes for handling incoming data from many filebeats. I want to deploy them behind an AWS elastic load balancer (ELB) and I was wondering if there are any gotcha's. Will filebeats … --- ## [OOM error in Filebeat](https://discuss.elastic.co/t/oom-error-in-filebeat/101820)
**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\ **Replies:** 3\ **Last updated:** [September 27, 2017, 12:54pm UTC](https://discuss.elastic.co/t/oom-error-in-filebeat/101820 "2017-09-27T12:54:24Z")
We are running filebeat in an docker container with basic configuration and only one logstash output. Filebeat was running continously for past few days, yesterday it started to comeup and go down continuously. the fil… --- ## [Filebeat repeat send log](https://discuss.elastic.co/t/filebeat-repeat-send-log/99833)
**Author:** [@water\_smart](https://discuss.elastic.co/u/water_smart)\ **Replies:** 5\ **Last updated:** [September 27, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-repeat-send-log/99833 "2017-09-27T12:40:25Z")
2017/09/08 07:34:20.656217 client.go:184: DBG Publish: { "@timestamp": "2017-09-08T07:34:16.242Z", "beat": { "hostname": "85", "name": "10.58.51.85", "version": "5.2.2" }, "input\_type": "log", "mes… --- ## [ERR Failed to publish events caused by: EOF graylog logstash filebeat](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof-graylog-logstash-filebeat/101718)
**Author:** [@Omer\_Mizrahi](https://discuss.elastic.co/u/Omer_Mizrahi)\ **Replies:** 4\ **Last updated:** [September 27, 2017, 11:32am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-eof-graylog-logstash-filebeat/101718 "2017-09-27T11:32:10Z")
Hi everyone, Im using Logstash on aws ecs (Docker), and using filebeat 5.6.1 to transfer logs to logstash, and output them to graylog, no data goes into graylog, and getting the following from filebeat log and logstash… --- ## [Create new metricset for windows services states](https://discuss.elastic.co/t/create-new-metricset-for-windows-services-states/101727)
**Author:** [@maddin2016](https://discuss.elastic.co/u/maddin2016)\ **Replies:** 4\ **Last updated:** [September 27, 2017, 6:35am UTC](https://discuss.elastic.co/t/create-new-metricset-for-windows-services-states/101727 "2017-09-27T06:35:12Z")
Hi @andrewkroh. Because there some requests for having a collector for windows services, i have decided to create a new metricset to collect windows service states. It's very basic at the moment and i don't know if you h… --- ## [Invalid top-level key 'setup' found](https://discuss.elastic.co/t/invalid-top-level-key-setup-found/101367)
**Author:** [@igormarqs](https://discuss.elastic.co/u/igormarqs)\ **Replies:** 6\ **Last updated:** [September 26, 2017, 9:57pm UTC](https://discuss.elastic.co/t/invalid-top-level-key-setup-found/101367 "2017-09-26T21:57:38Z")
hi, i have try to install winlogbeat on Windows Server Datacenter and failed. i download winlogbeat from here extract the content into C:\\Program Files and rename the winlogbeat- directory to Winlogbeat. edit winlogbe… --- ## [Can't merge a non object mapping](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping/101901)
**Author:** [@valdemar.pavesi](https://discuss.elastic.co/u/valdemar.pavesi)\ **Replies:** 1\ **Last updated:** [September 26, 2017, 8:41pm UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping/101901 "2017-09-26T20:41:43Z")
Hello, I am getting this error 2017/09/26 20:31:28.110247 client.go:465: WARN Can not index event (status=400): {"type":"illegal\_argument\_exception","reason":"Can't merge a non object mapping \[cmm.pm.ipds0.VS.NbrRexmit… --- ## [Filebeat output per prospector](https://discuss.elastic.co/t/filebeat-output-per-prospector/101579)
**Author:** [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\ **Replies:** 2\ **Last updated:** [September 26, 2017, 6:19pm UTC](https://discuss.elastic.co/t/filebeat-output-per-prospector/101579 "2017-09-26T18:19:05Z")
Hi, Here is the use case that I have some well-formed JSON data such as metrics I'd like to go straight into Elasticsearch, whereas other logs need Logstash pipeline to process then shipping to Elasticsearch. Sounds li… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=497) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=499)