# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=499 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 500 --- ## [Parse bitvise login log in windows event log](https://discuss.elastic.co/t/parse-bitvise-login-log-in-windows-event-log/101662)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 4\ **Last updated:** [September 26, 2017, 3:05pm UTC](https://discuss.elastic.co/t/parse-bitvise-login-log-in-windows-event-log/101662 "2017-09-26T15:05:25Z")
Hi, i have new case. All my windows server are using bitvise for remote dessktop. (when i used bitvise for remote dessktop in windows, event\_id 4624 contain username logon, but not contain real IP login. It alway 127.0… --- ## [Filebeat unable to access logs of super user file](https://discuss.elastic.co/t/filebeat-unable-to-access-logs-of-super-user-file/101490)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [September 26, 2017, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-access-logs-of-super-user-file/101490 "2017-09-26T14:44:53Z")
Hello , I am new to ELK Stack. I wants to access the access logs file and the file is super user. how to access the super user file with filebeat. Thanks & Regards Shrikant --- ## [Is it possible to create new events from within a processor?](https://discuss.elastic.co/t/is-it-possible-to-create-new-events-from-within-a-processor/101554)
**Author:** [@btr](https://discuss.elastic.co/u/btr)\ **Replies:** 1\ **Last updated:** [September 26, 2017, 2:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-create-new-events-from-within-a-processor/101554 "2017-09-26T14:41:18Z")
I need to batch/accumulate events based on custom criteria and I was thinking about developing a processor to do so. I think I understand how I could do the aggregation in the custom processor and drop the aggregated eve… --- ## [Multiline Parsing](https://discuss.elastic.co/t/multiline-parsing/101717)
**Author:** [@omer](https://discuss.elastic.co/u/omer)\ **Replies:** 1\ **Last updated:** [September 26, 2017, 2:11pm UTC](https://discuss.elastic.co/t/multiline-parsing/101717 "2017-09-26T14:11:47Z")
Hi, I am trying to parse a multiline log file. Input comes from filebeat so i must use multiline settings at filebeat.yml. I searched for examples and made a configuration like that: multiline.pattern: '^\[0-9\]{4}-\[0-9\]… --- ## [ERR Failed to publish events caused by: read tcp 127.0.0.1:50248-\>127.0.0.1:5601: i/o timeout](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813)
**Author:** [@daffe0x77](https://discuss.elastic.co/u/daffe0x77)\ **Replies:** 13\ **Last updated:** [September 26, 2017, 2:04pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-50248-127-0-0-1-5601-i-o-timeout/101813 "2017-09-26T14:04:19Z")
To visualize Windows Event Logs I've setup an ELK server running all 3 components on the same box. Think for testing and learning ELK should be doable. Logs forwarded are account lockouts (Event ID 4740) from Domain Con… --- ## [Runtime panic error using Apache2 module](https://discuss.elastic.co/t/runtime-panic-error-using-apache2-module/100028)
**Author:** [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\ **Replies:** 3\ **Last updated:** [September 26, 2017, 10:38am UTC](https://discuss.elastic.co/t/runtime-panic-error-using-apache2-module/100028 "2017-09-26T10:38:55Z")
Hi, I've been having no luck importing customised Apache2 logs into ES via logstash; my GROK always timeouts or give message too large errors which no one can seem to fix, so before ditching logstash and filebeat comple… --- ## [Env variables in not working in custom fields in filebeat](https://discuss.elastic.co/t/env-variables-in-not-working-in-custom-fields-in-filebeat/101374)
**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\ **Replies:** 4\ **Last updated:** [September 26, 2017, 9:58am UTC](https://discuss.elastic.co/t/env-variables-in-not-working-in-custom-fields-in-filebeat/101374 "2017-09-26T09:58:28Z")
Filebeat version 5.6 centos 7.0 I am using env variable like this fields\_under\_root: true fields: clustername: ${CLUSTER\_NAME} output of # env HOSTNAME=gsljumphost.cisco.com SHELL=/bin/bash TERM=xterm HISTSIZE=… --- ## [Extending to metricbeat error](https://discuss.elastic.co/t/extending-to-metricbeat-error/100953)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [September 26, 2017, 9:41am UTC](https://discuss.elastic.co/t/extending-to-metricbeat-error/100953 "2017-09-26T09:41:45Z")
when I use "make setup" accoring to https://www.elastic.co/guide/en/beats/devguide/current/creating-beat-from-metricbeat.html. it appends error: rm -r \_meta/kibana/dashboard \_meta/kibana/search \_meta/kibana/visualizati… --- ## [Isolating slowdowns possibly caused by filebeat](https://discuss.elastic.co/t/isolating-slowdowns-possibly-caused-by-filebeat/101783)
**Author:** [@patrickian](https://discuss.elastic.co/u/patrickian)\ **Replies:** 0\ **Last updated:** [September 26, 2017, 6:37am UTC](https://discuss.elastic.co/t/isolating-slowdowns-possibly-caused-by-filebeat/101783 "2017-09-26T06:37:53Z")
We're trying to isolate issues of slowdowns possibly caused by filebeat. We're looking into scan\_frequency which I believe is the frequency where new files in the directory is checked. Is there a way to adjust when fileb… --- ## [Having problem with parsing Json data using Filebeat and Logstash](https://discuss.elastic.co/t/having-problem-with-parsing-json-data-using-filebeat-and-logstash/101683)
**Author:** [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Replies:** 10\ **Last updated:** [September 25, 2017, 1:58pm UTC](https://discuss.elastic.co/t/having-problem-with-parsing-json-data-using-filebeat-and-logstash/101683 "2017-09-25T13:58:22Z")
i have this type of json logs: 1485907213693 {"counter\_name": "image", "resource\_id": "999d4b25-0539-419e-9991-42f2cf26061b", "timestamp": "2017-02-01T00:00:40Z", "counter\_volume": 1, "user\_id": null, "message\_signature… --- ## [Filebeat stops sending logs with no reason](https://discuss.elastic.co/t/filebeat-stops-sending-logs-with-no-reason/101130)
**Author:** [@serkin](https://discuss.elastic.co/u/serkin)\ **Replies:** 4\ **Last updated:** [September 25, 2017, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-with-no-reason/101130 "2017-09-25T13:53:06Z")
I have an unusual issue I have server sending logs to elasticsearch using filebeat Everything goes ok until suddenly filebeat stops sending logs. But if I curl to elasticsearch it responds. tcpdump shows that filebeat … --- ## [Run the official docker image with k8s failed](https://discuss.elastic.co/t/run-the-official-docker-image-with-k8s-failed/101571)
**Author:** [@pnuzyf](https://discuss.elastic.co/u/pnuzyf)\ **Replies:** 3\ **Last updated:** [September 25, 2017, 1:33pm UTC](https://discuss.elastic.co/t/run-the-official-docker-image-with-k8s-failed/101571 "2017-09-25T13:33:00Z")
I got the following message: Message: oci runtime error: container\_linux.go:262: starting container process caused "exec: "filebeat": executable file not found my daemonset.yaml : apiVersion: extensions/v1beta1 kind:… --- ## [Packetbeat 5.6.1 - Thrift Protocol Error - index out of range](https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635)
**Author:** [@davidbernard](https://discuss.elastic.co/u/davidbernard)\ **Replies:** 0\ **Last updated:** [September 25, 2017, 5:39am UTC](https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635 "2017-09-25T05:39:52Z")
See earlier unresolved issue https://github.com/elastic/beats/issues/995. Monitoring scribe thrift RPC calls. Some of the calls could have a large number of log entries structures in an array. Config: packetbeat.proto… --- ## [Parsing of thrift fields - not quite JSON](https://discuss.elastic.co/t/parsing-of-thrift-fields-not-quite-json/101550)
**Author:** [@davidbernard](https://discuss.elastic.co/u/davidbernard)\ **Replies:** 0\ **Last updated:** [September 23, 2017, 12:29am UTC](https://discuss.elastic.co/t/parsing-of-thrift-fields-not-quite-json/101550 "2017-09-23T00:29:04Z")
The thrift fields representing params, request and response are in "human readable format". Does anyone have advise as to how to parse these with logstash? "thrift": { "params": "(messages: \[(1: \\"test\\", 2:… --- ## [Logstash can't recognize "message" field from winlogbeat](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518)
**Author:** [@leonkin](https://discuss.elastic.co/u/leonkin)\ **Replies:** 2\ **Last updated:** [September 22, 2017, 8:38pm UTC](https://discuss.elastic.co/t/logstash-cant-recognize-message-field-from-winlogbeat/101518 "2017-09-22T20:38:54Z")
winlogbeat version 5.6.1 config winlonbeat.yml winlogbeat: registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event\_logs: - name: Application output.logstash: # The Logstash hosts hosts: \["host:port"… --- ## [Filebeat is skipping lines randomly](https://discuss.elastic.co/t/filebeat-is-skipping-lines-randomly/101498)
**Author:** [@Hermes\_Vazquez\_Figue](https://discuss.elastic.co/u/Hermes_Vazquez_Figue)\ **Replies:** 1\ **Last updated:** [September 22, 2017, 6:49pm UTC](https://discuss.elastic.co/t/filebeat-is-skipping-lines-randomly/101498 "2017-09-22T18:49:51Z")
Hello, I'm shipping my logs directly to ES with filebeat and is skipping some lines from the logs randomly. My filebeat version is 5.4.2 on Debian GNU/Linux 8 (jessie) The following is the configuration file that I'm u… --- ## [Filebeat default value for logstash load balance discrepancy](https://discuss.elastic.co/t/filebeat-default-value-for-logstash-load-balance-discrepancy/101384)
**Author:** [@sila5](https://discuss.elastic.co/u/sila5)\ **Replies:** 2\ **Last updated:** [September 22, 2017, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-default-value-for-logstash-load-balance-discrepancy/101384 "2017-09-22T16:00:27Z")
I noticed that on GitHub in the reference yml file for filebeat, under the logstash module, load balancing shows as true. I assumed this was the default but found out later when restarting one of my logstash instance's t… --- ## [Filebeat Windows : no event when log file contains 1 line](https://discuss.elastic.co/t/filebeat-windows-no-event-when-log-file-contains-1-line/101133)
**Author:** [@Youkoulayley](https://discuss.elastic.co/u/Youkoulayley)\ **Replies:** 2\ **Last updated:** [September 22, 2017, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-windows-no-event-when-log-file-contains-1-line/101133 "2017-09-22T12:52:49Z")
Hi, I have filebeat installed on a WIndows machine. My file contain the result of a sql request. So the file is always truncated and contain either 0 line or 1 line. But when the file contains just one line, filebeat d… --- ## [Import\_dashboards - fail to load Elasticsearch loader](https://discuss.elastic.co/t/import-dashboards-fail-to-load-elasticsearch-loader/101405)
**Author:** [@marleybobby](https://discuss.elastic.co/u/marleybobby)\ **Replies:** 2\ **Last updated:** [September 22, 2017, 12:25pm UTC](https://discuss.elastic.co/t/import-dashboards-fail-to-load-elasticsearch-loader/101405 "2017-09-22T12:25:42Z")
Hi, I just installed elasticsearch and kibana, as described on this page https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html and it seems works fine. Now i installed packetbeat and tried … --- ## [Perfmon help for metricbeat 6 beta](https://discuss.elastic.co/t/perfmon-help-for-metricbeat-6-beta/101366)
**Author:** [@chokedoke](https://discuss.elastic.co/u/chokedoke)\ **Replies:** 1\ **Last updated:** [September 22, 2017, 10:01am UTC](https://discuss.elastic.co/t/perfmon-help-for-metricbeat-6-beta/101366 "2017-09-22T10:01:03Z")
Hi Hopefully someone can give me a little bit of help in regards to getting a perfmon counter to work I am trying to get the below to work but as soon as i put it in my metrics everything stops working What am i doing… --- ## [Flows detected on thrift port but no thrift protocol events generated](https://discuss.elastic.co/t/flows-detected-on-thrift-port-but-no-thrift-protocol-events-generated/101444)
**Author:** [@davidbernard](https://discuss.elastic.co/u/davidbernard)\ **Replies:** 1\ **Last updated:** [September 22, 2017, 9:19am UTC](https://discuss.elastic.co/t/flows-detected-on-thrift-port-but-no-thrift-protocol-events-generated/101444 "2017-09-22T09:19:24Z")
I have configure packetbeat to process thrift-RPC on port 1463 and even though the network flow monitoring shows traffic on that port. no thrift-RPC events are generated. packetbeat.protocols.thrift: ports: \[1463\] t… --- ## [How to get RAID and disk health details using beats](https://discuss.elastic.co/t/how-to-get-raid-and-disk-health-details-using-beats/101311)
**Author:** [@rahul01](https://discuss.elastic.co/u/rahul01)\ **Replies:** 1\ **Last updated:** [September 21, 2017, 11:19pm UTC](https://discuss.elastic.co/t/how-to-get-raid-and-disk-health-details-using-beats/101311 "2017-09-21T23:19:22Z")
Hello, I have HP servers with 8 disks and RAID 1+0 configured and installed XenServer 7.0 OS. I usually check RAID details and disk health with hpacucli utility. Now I have configured metricbeat for resource utilization… --- ## [Filebeat is not creating a log file](https://discuss.elastic.co/t/filebeat-is-not-creating-a-log-file/101382)
**Author:** [@ajstark123](https://discuss.elastic.co/u/ajstark123)\ **Replies:** 1\ **Last updated:** [September 21, 2017, 10:51pm UTC](https://discuss.elastic.co/t/filebeat-is-not-creating-a-log-file/101382 "2017-09-21T22:51:51Z")
I set up my filebeat yml with the following options. logging.level: info # logging.to\_syslog: false logging.to\_files: true logging.files: # path: /opt/pki/filebeat/logs path: /tmp/filebeat\_logs name: filebeat ro… --- ## [What's the exact meaning of log entries generated by filebeat 5.2.2](https://discuss.elastic.co/t/whats-the-exact-meaning-of-log-entries-generated-by-filebeat-5-2-2/101217)
**Author:** [@kzhang](https://discuss.elastic.co/u/kzhang)\ **Replies:** 1\ **Last updated:** [September 21, 2017, 10:38am UTC](https://discuss.elastic.co/t/whats-the-exact-meaning-of-log-entries-generated-by-filebeat-5-2-2/101217 "2017-09-21T10:38:38Z")
Hi, I am new to filebeat and doing some troubleshooting, I want to understand the meaning of log entrie in the filebeat.log generated by the filebeat 5.2.2. Take the following log entries as an example, can anybody expl… --- ## [Filebeat ignoring Path with Wildcard(s)](https://discuss.elastic.co/t/filebeat-ignoring-path-with-wildcard-s/101253)
**Author:** [@allenfin](https://discuss.elastic.co/u/allenfin)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-ignoring-path-with-wildcard-s/101253 "2017-09-21T09:31:40Z")
I'm using Filebeat as a docker container and I keep having problems with trying make sure that nginx error logs and access logs go to the right place. It seems that they just go to both places. I setup a different logsta… --- ## [Filebeat cpu usage is too high](https://discuss.elastic.co/t/filebeat-cpu-usage-is-too-high/100840)
**Author:** [@sailq21](https://discuss.elastic.co/u/sailq21)\ **Replies:** 3\ **Last updated:** [September 21, 2017, 1:31am UTC](https://discuss.elastic.co/t/filebeat-cpu-usage-is-too-high/100840 "2017-09-21T01:31:16Z")
os:CentOS release 6.5 (Final) filebeat version:filebeat-5.6.0-1.x86\_64 32 core cpu. I have use filebeats to collect nginx logs(my log is json format) and sent to kafka. but cpu usage is too high ,but I don't know w… --- ## [./scripts/import\_dashboards: No such file or directory](https://discuss.elastic.co/t/scripts-import-dashboards-no-such-file-or-directory/100910)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 20\ **Last updated:** [September 20, 2017, 7:10pm UTC](https://discuss.elastic.co/t/scripts-import-dashboards-no-such-file-or-directory/100910 "2017-09-20T19:10:17Z")
I installed Filebeat 6 , i can find ./scripts/import\_dashboards please assist, only found migrate\_beat\_config\_1\_x\_to\_5\_0.py --- ## [Recursive file paths](https://discuss.elastic.co/t/recursive-file-paths/101155)
**Author:** [@rednax](https://discuss.elastic.co/u/rednax)\ **Replies:** 1\ **Last updated:** [September 20, 2017, 1:06pm UTC](https://discuss.elastic.co/t/recursive-file-paths/101155 "2017-09-20T13:06:13Z")
Hi, I was experimenting with Auditbeat file monitoring. What I wanted is to monitor all files in the "C:\\Program Files" folder of a Windows VM. However, when altering files (add, remove, etc.) in some of the subdirector… --- ## [Beats with golang version](https://discuss.elastic.co/t/beats-with-golang-version/100855)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 1\ **Last updated:** [September 19, 2017, 6:40pm UTC](https://discuss.elastic.co/t/beats-with-golang-version/100855 "2017-09-19T18:40:07Z")
Two month ago, I create my beats according to beats-5.4.3. I installed go 1.7.6. why now it need 1.8.3. Is each version of the beats with a different go version? according to: https://www.elastic.co/guide/en/beats/dev… --- ## [No error for permission if symlinks involved in paths for filebeat](https://discuss.elastic.co/t/no-error-for-permission-if-symlinks-involved-in-paths-for-filebeat/100984)
**Author:** [@raazeev64](https://discuss.elastic.co/u/raazeev64)\ **Replies:** 3\ **Last updated:** [September 19, 2017, 1:48pm UTC](https://discuss.elastic.co/t/no-error-for-permission-if-symlinks-involved-in-paths-for-filebeat/100984 "2017-09-19T13:48:09Z")
I tried to run filebeat to monitor a path that involved a symlink. symlink: /var/log/current -\> /var/log/version1 paths: /var/log/current/logs/abc.log Actual file location: /var/log/version1/logs/abc.log T… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=498) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=500)