# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=500 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 501 --- ## [Maximum capacity for Heartbeat](https://discuss.elastic.co/t/maximum-capacity-for-heartbeat/101021)
**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 1\ **Last updated:** [September 19, 2017, 1:16pm UTC](https://discuss.elastic.co/t/maximum-capacity-for-heartbeat/101021 "2017-09-19T13:16:19Z")
I am using heartbeat version 5.3.0. I wanted to know if there a limit on number of services that it can monitor? I see that latest release is 5.6.1(beta). Will the maximum capacity change with the version? P.S. - I hav… --- ## [Filebeat on RHEL 5.7](https://discuss.elastic.co/t/filebeat-on-rhel-5-7/100927)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 3\ **Last updated:** [September 19, 2017, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-on-rhel-5-7/100927 "2017-09-19T12:51:09Z")
How can I install Filebeat and run it on REDHAT 5.7v? Filebeat 5.4.1 Thanks Sharon. --- ## [Beats Survey: modules, data sources and ingestion experience](https://discuss.elastic.co/t/beats-survey-modules-data-sources-and-ingestion-experience/101006)
**Author:** [@monica](https://discuss.elastic.co/u/monica)\ **Replies:** 0\ **Last updated:** [September 19, 2017, 10:37am UTC](https://discuss.elastic.co/t/beats-survey-modules-data-sources-and-ingestion-experience/101006 "2017-09-19T10:37:43Z")
Beats modules are built on the premise that simple things should be simple. They let you go from raw data to dashboards for common data sources in literally minutes. Run 1 command and instantly start exploring your data … --- ## [Load balance for filbeat and mesos-dns and dc/os?](https://discuss.elastic.co/t/load-balance-for-filbeat-and-mesos-dns-and-dc-os/100920)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 0\ **Last updated:** [September 18, 2017, 7:11pm UTC](https://discuss.elastic.co/t/load-balance-for-filbeat-and-mesos-dns-and-dc-os/100920 "2017-09-18T19:11:05Z")
Hi, in filebeat and logstash we can load balance by providing multiple hosts in the host parameter like so... hosts: \["host1", "host2"\] loadbalance: true How do we make this work with service discovery systems like me… --- ## [Filebeat - multiline: Ingest XML's without line feed at end of file](https://discuss.elastic.co/t/filebeat-multiline-ingest-xmls-without-line-feed-at-end-of-file/99021)
**Author:** [@cvanhalt](https://discuss.elastic.co/u/cvanhalt)\ **Replies:** 6\ **Last updated:** [September 18, 2017, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-multiline-ingest-xmls-without-line-feed-at-end-of-file/99021 "2017-09-18T15:22:59Z")
I want to ingest XML files to the ELK-Stack. I want one event per XML file. These XML files end without line feed, thus filebeat’s multiline codec never forwards the last line of the XML to Logstash. Because of this Logs… --- ## [How to config different peroid for different metricset of system module?](https://discuss.elastic.co/t/how-to-config-different-peroid-for-different-metricset-of-system-module/100762)
**Author:** [@PChou](https://discuss.elastic.co/u/PChou)\ **Replies:** 1\ **Last updated:** [September 18, 2017, 12:29pm UTC](https://discuss.elastic.co/t/how-to-config-different-peroid-for-different-metricset-of-system-module/100762 "2017-09-18T12:29:20Z")
system module contains some useful metricset: cpu memory diskio network... but they share a single peroid configuration item, which means we are not able to use different frequency for different metricset. is there any … --- ## [BELK for distributed device log aggregation](https://discuss.elastic.co/t/belk-for-distributed-device-log-aggregation/100815)
**Author:** [@kdchamil](https://discuss.elastic.co/u/kdchamil)\ **Replies:** 1\ **Last updated:** [September 18, 2017, 5:21am UTC](https://discuss.elastic.co/t/belk-for-distributed-device-log-aggregation/100815 "2017-09-18T05:21:56Z")
Hello Everyone, I'm trying to use the ElasticSearch community edition for the following scenario. I have 20,000+ devices working on thousands of geographically distributed offices. Every office has its own private netw… --- ## [How to pack mybeat to mybeat.rpm?](https://discuss.elastic.co/t/how-to-pack-mybeat-to-mybeat-rpm/100655)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [September 18, 2017, 1:51am UTC](https://discuss.elastic.co/t/how-to-pack-mybeat-to-mybeat-rpm/100655 "2017-09-18T01:51:51Z")
I am based on https://www.elastic.co/guide/en/beats/devguide/current/beater-interface.html to build my own beat. Then I wrote my codes. Finally I go build main.go and Now i have ./main and \*.yml , nothing else. I want t… --- ## [Unable concatenate multiple fields which is collected by metricbeat](https://discuss.elastic.co/t/unable-concatenate-multiple-fields-which-is-collected-by-metricbeat/100744)
**Author:** [@Nikhil\_Jaiswal](https://discuss.elastic.co/u/Nikhil_Jaiswal)\ **Replies:** 0\ **Last updated:** [September 16, 2017, 3:11am UTC](https://discuss.elastic.co/t/unable-concatenate-multiple-fields-which-is-collected-by-metricbeat/100744 "2017-09-16T03:11:17Z")
Hi, I want to concatenate some fields in logstash using mutate and storing in message, but message filed is coming in logstash(after running in powershell , i am not able to see) this is my configuration- else if \[me… --- ## [Workaround for Network Volume](https://discuss.elastic.co/t/workaround-for-network-volume/100717)
**Author:** [@alhbs](https://discuss.elastic.co/u/alhbs)\ **Replies:** 5\ **Last updated:** [September 15, 2017, 8:29pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717 "2017-09-15T20:29:21Z")
According to the FAQ (https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes) , it's recommended not to use network volumes. How can I work around this? I'm considering setting up a V… --- ## [Metricbeat Memcached module seems to mix up memcached.stats.cmd.get and memcached.stats.cmd.set](https://discuss.elastic.co/t/metricbeat-memcached-module-seems-to-mix-up-memcached-stats-cmd-get-and-memcached-stats-cmd-set/100732)
**Author:** [@tylerclendenin](https://discuss.elastic.co/u/tylerclendenin)\ **Replies:** 0\ **Last updated:** [September 15, 2017, 8:19pm UTC](https://discuss.elastic.co/t/metricbeat-memcached-module-seems-to-mix-up-memcached-stats-cmd-get-and-memcached-stats-cmd-set/100732 "2017-09-15T20:19:07Z")
In metricbeat 6.0.0 beta 1 and 2 the memcached module seems to mix up the values from the get and set stats memcached.stats.cmd.get and memcached.stats.cmd.set I see the discrepency when I look at the memcached stats d… --- ## [Filebeats custom fields not sending with message](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708)
**Author:** [@jspeer](https://discuss.elastic.co/u/jspeer)\ **Replies:** 4\ **Last updated:** [September 15, 2017, 7:04pm UTC](https://discuss.elastic.co/t/filebeats-custom-fields-not-sending-with-message/100708 "2017-09-15T19:04:33Z")
I'm running filebeats 5.5.1, the 2 fields that I've added into the prospector aren't sending with the logs. Here is my prospector: - input\_type: log paths: - /etc/filebeat/log/\*.log fields: log\_… --- ## [Failed to publish long multiline events](https://discuss.elastic.co/t/failed-to-publish-long-multiline-events/100296)
**Author:** [@glipinski](https://discuss.elastic.co/u/glipinski)\ **Replies:** 2\ **Last updated:** [September 15, 2017, 8:37am UTC](https://discuss.elastic.co/t/failed-to-publish-long-multiline-events/100296 "2017-09-15T08:37:48Z")
Hi, I am trying to send logs from Filebeat to Logstash Filebeat 5.5.2 (Centos 6.9) Logstash 5.5.2 (Windows Server 2008) But I am getting an error: INFO Error publishing events (retrying): read tcp \*\*\*\*\*\* -\>\*\*\*\*\*:504… --- ## [Filebeat - Created new module, don't see new module fields in Kibana](https://discuss.elastic.co/t/filebeat-created-new-module-dont-see-new-module-fields-in-kibana/100620)
**Author:** [@Glen\_Hickman](https://discuss.elastic.co/u/Glen_Hickman)\ **Replies:** 0\ **Last updated:** [September 14, 2017, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-created-new-module-dont-see-new-module-fields-in-kibana/100620 "2017-09-14T23:25:42Z")
Created a new module (for Log4J) in Filebeat Running successfully on source, see records in Kibana however don't see my new 'log4j.console.xxx' fields in my filebeat-\* index after performing field refresh Using Elastic… --- ## [How Logstash keeps track of winlogbeat events?](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 3\ **Last updated:** [September 14, 2017, 6:17pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425 "2017-09-14T18:17:18Z")
Hi, I am trying to use winlogbeat and Logstash. How does Logstash keep track of winlogbeat events if Logstash is restarted? Thanks --- ## [Stuck with MySQL permission](https://discuss.elastic.co/t/stuck-with-mysql-permission/97594)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 3\ **Last updated:** [September 14, 2017, 4:59pm UTC](https://discuss.elastic.co/t/stuck-with-mysql-permission/97594 "2017-09-14T16:59:50Z")
Hi experts I'm trying to config my metricbeat to track MySQL server. Here is my config mysql The result kibana collected is I already use the query GRANT ALL ON . to root@'%' IDENTIFIED BY 'pass'; in sql still e… --- ## [Using Winlogbeat for custom logfiles?](https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482)
**Author:** [@tobys](https://discuss.elastic.co/u/tobys)\ **Replies:** 5\ **Last updated:** [September 14, 2017, 2:24pm UTC](https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482 "2017-09-14T14:24:16Z")
Hi, A newbee question... I'm evaluating Winlogbeat as an option for log management of an application that has it's own custom log file on a windows-server. Is Winlogbeat only using the Windows event log as input sourc… --- ## [Metricbeat fields defaults](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365)
**Author:** [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)\ **Replies:** 5\ **Last updated:** [September 14, 2017, 2:31pm UTC](https://discuss.elastic.co/t/metricbeat-fields-defaults/100365 "2017-09-14T14:31:33Z")
Hi, I'm running a test cluster and a production cluster, metricbeats is one of the things posting data into both of these. In the metricbeat-\* index pattern on my dev cluster the host field is searchable and aggregatab… --- ## [Monitor try connect packets](https://discuss.elastic.co/t/monitor-try-connect-packets/100388)
**Author:** [@Rene\_Araos](https://discuss.elastic.co/u/Rene_Araos)\ **Replies:** 1\ **Last updated:** [September 14, 2017, 11:48am UTC](https://discuss.elastic.co/t/monitor-try-connect-packets/100388 "2017-09-14T11:48:25Z")
Hello Packetbeat can monitor "try connect" http packets. In example, if try to connect 10.4.3.2 port 80 but remote server is down or service is down, packetbeat not log events. Is there a way to log and monitor this… --- ## [Collecting custom metrics for vsphere module?](https://discuss.elastic.co/t/collecting-custom-metrics-for-vsphere-module/100278)
**Author:** [@reymondk](https://discuss.elastic.co/u/reymondk)\ **Replies:** 2\ **Last updated:** [September 14, 2017, 12:00am UTC](https://discuss.elastic.co/t/collecting-custom-metrics-for-vsphere-module/100278 "2017-09-14T00:00:31Z")
Hi Everyone, OS: CentOS 7.x Beat: Metricbeat Version: 6.0.0-beta2 can we customize the list of metric that we want to collect in the vsphere module? I'm not sure if that's the purpose of get\_custom\_fields in the conf… --- ## [Which is write option to configure filebeat settings](https://discuss.elastic.co/t/which-is-write-option-to-configure-filebeat-settings/100387)
**Author:** [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Replies:** 1\ **Last updated:** [September 13, 2017, 8:48pm UTC](https://discuss.elastic.co/t/which-is-write-option-to-configure-filebeat-settings/100387 "2017-09-13T20:48:32Z")
filebeat.prospectors: input\_type: log Paths that should be crawled and fetched. Glob based paths. paths: /tmp/testlog.txt exclude\_files: \[".gz$"\] ignore\_older: 2h harvester: close\_inactive: 5m close\_renamed: f… --- ## [Scripts/import\_dashboard doesn't exist](https://discuss.elastic.co/t/scripts-import-dashboard-doesnt-exist/100367)
**Author:** [@KnechtionsCoding](https://discuss.elastic.co/u/KnechtionsCoding)\ **Replies:** 6\ **Last updated:** [September 13, 2017, 6:20pm UTC](https://discuss.elastic.co/t/scripts-import-dashboard-doesnt-exist/100367 "2017-09-13T18:20:34Z")
I just installed heartbeat on an elk server to test. I'm trying to import the dashboards, however while I can find the dashboards themselves I cannot find the /scripts/import\_dashboards. The docs here: Import Dashboards … --- ## [Docker Beat with Docker ELK](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333)
**Author:** [@domenicozingone](https://discuss.elastic.co/u/domenicozingone)\ **Replies:** 4\ **Last updated:** [September 13, 2017, 3:17pm UTC](https://discuss.elastic.co/t/docker-beat-with-docker-elk/100333 "2017-09-13T15:17:25Z")
Hi, i have a docker container that is running filebeat container in on one host with an webpp an his logfile, and the docker ELK on other. i configure filebeat.yml : filebeat.prospectors: - input\_type: log paths: … --- ## [Filebeat certificate error with kafka output + replicats](https://discuss.elastic.co/t/filebeat-certificate-error-with-kafka-output-replicats/100163)
**Author:** [@willouuu](https://discuss.elastic.co/u/willouuu)\ **Replies:** 2\ **Last updated:** [September 13, 2017, 11:55am UTC](https://discuss.elastic.co/t/filebeat-certificate-error-with-kafka-output-replicats/100163 "2017-09-13T11:55:38Z")
Hi I have a first problem with SSL usage with the output to kafka. It seems that filebeat truncates the fqdn, in the configuration I use "kafka1.domain.fr" and it tells me that the certification is invalid for "kafka1".… --- ## [/lib/systemd/system/filebeat.service in rpm package](https://discuss.elastic.co/t/lib-systemd-system-filebeat-service-in-rpm-package/100184)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [September 13, 2017, 1:15am UTC](https://discuss.elastic.co/t/lib-systemd-system-filebeat-service-in-rpm-package/100184 "2017-09-13T01:15:57Z")
\*.service should be placed to /usr/lib or /etc/sysemd/system; so why filebeat.service is placed to /lib/systemd/system/? when filebeat runing, filebeat.service， whether it works or not and why? --- ## [What is the role of unpack,（/libbeat/common/cfgfile.go）?](https://discuss.elastic.co/t/what-is-the-role-of-unpack-libbeat-common-cfgfile-go/100009)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 4\ **Last updated:** [September 13, 2017, 1:14am UTC](https://discuss.elastic.co/t/what-is-the-role-of-unpack-libbeat-common-cfgfile-go/100009 "2017-09-13T01:14:59Z")
I check the source code found after the path is Unpack () function set to '/tmp', but the source seems to have no relevant settings inside; I use "go build main.go" generated executable file, the implementation does n… --- ## [Message filed is missing when Winlogbeat is used](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 11\ **Last updated:** [September 12, 2017, 10:24pm UTC](https://discuss.elastic.co/t/message-filed-is-missing-when-winlogbeat-is-used/100115 "2017-09-12T22:24:14Z")
Hi, I am using Winlogbeat to collect Windows event logs and sending output to Logstash. But the problem is that I am missing message filed and instead I am seeing event\_data filed. And inside event\_data field there is a… --- ## [Can't create winlogbeat-\*](https://discuss.elastic.co/t/cant-create-winlogbeat/100113)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 16\ **Last updated:** [September 12, 2017, 7:03pm UTC](https://discuss.elastic.co/t/cant-create-winlogbeat/100113 "2017-09-12T19:03:11Z")
Hi, I have succesfully installed winlogbeat on a Windows Server 2016. Yesterday I was able to create the index for the winlogbeat data. Today I deleted everything and I wanted to start again also with a new index name. … --- ## [Java exception full trace](https://discuss.elastic.co/t/java-exception-full-trace/100041)
**Author:** [@nsivabalan](https://discuss.elastic.co/u/nsivabalan)\ **Replies:** 6\ **Last updated:** [September 12, 2017, 4:35pm UTC](https://discuss.elastic.co/t/java-exception-full-trace/100041 "2017-09-12T16:35:07Z")
Hi, I would like see full log trace of the exception in the kibana. Kindly some one let me know the multile pattern for the below log format. FYR INFO | jvm 1 | main | 2017/09/11 00:00:45.665 | 12:00:45 AM | … --- ## [Nginx SSL config](https://discuss.elastic.co/t/nginx-ssl-config/100232)
**Author:** [@kwojcicki](https://discuss.elastic.co/u/kwojcicki)\ **Replies:** 2\ **Last updated:** [September 12, 2017, 3:34pm UTC](https://discuss.elastic.co/t/nginx-ssl-config/100232 "2017-09-12T15:34:15Z")
The nginx docker image I am using sends everything to https which causes metricbeat to print out the following logs in elasticsearch error making http request: Get https://ui:443/server-status: x509: failed to load syste… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=499) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=501)