# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=502 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 503 --- ## [Did file beat 5.4 version compatible On Solaris 11.3 version?](https://discuss.elastic.co/t/did-file-beat-5-4-version-compatible-on-solaris-11-3-version/99353)
**Author:** [@yogeswararao](https://discuss.elastic.co/u/yogeswararao)\ **Replies:** 4\ **Last updated:** [September 5, 2017, 11:19pm UTC](https://discuss.elastic.co/t/did-file-beat-5-4-version-compatible-on-solaris-11-3-version/99353 "2017-09-05T23:19:22Z")
Hi, Can some one help on this. which version of the file beat version is compatible on Solaris 11.3 version ? --- ## [XML message in catalina log](https://discuss.elastic.co/t/xml-message-in-catalina-log/99175)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 3\ **Last updated:** [September 5, 2017, 3:34pm UTC](https://discuss.elastic.co/t/xml-message-in-catalina-log/99175 "2017-09-05T15:34:55Z")
Hi Team, I have my catalina.out parsed but once exception it misses XML over multi line. I need some help to get this working. Below is my config thus far: filebeat.prospectors: - document\_type: logs paths: - /Use… --- ## [Running init.d script on Gentoo produces "daemon: command not found”](https://discuss.elastic.co/t/running-init-d-script-on-gentoo-produces-daemon-command-not-found/98938)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 1\ **Last updated:** [September 1, 2017, 8:26pm UTC](https://discuss.elastic.co/t/running-init-d-script-on-gentoo-produces-daemon-command-not-found/98938 "2017-09-01T20:26:04Z")
Hi Hi! Can u help me pls? Why is it not starting? packetbeat is running with same configuration. govind :~ # /etc/init.d/packetbeat start Starting packetbeat: 2017/08/31 05:21:07.173725 beat.go:285: INFO Home path: \[… --- ## [Filebeat is not creating index in ES?](https://discuss.elastic.co/t/filebeat-is-not-creating-index-in-es/99343)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 3\ **Last updated:** [September 4, 2017, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-creating-index-in-es/99343 "2017-09-04T22:45:54Z")
Hi Experts, For Demo I am ingesting Apache data using filebeat into ES. My filebeat.yml is filebeat.modules: - module: apache2 access: var.paths: \["E:/ELK/Module1/apache1.log"\] output.elasticsearch: # Array of h… --- ## [Metricbeat system module](https://discuss.elastic.co/t/metricbeat-system-module/99170)
**Author:** [@ashvita](https://discuss.elastic.co/u/ashvita)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 1:23pm UTC](https://discuss.elastic.co/t/metricbeat-system-module/99170 "2017-09-04T13:23:46Z")
Hi, I looked into the metricbeat source code but didn’t really understand much. Can someone please tell me which system calls does metricbeat makes to get cpu memory network etc data as part of system module? Thanks --- ## [Saved "field" parameter is now invalid. Please select a new field | Visualize: "field" is a required parameter](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field-visualize-field-is-a-required-parameter/99036)
**Author:** [@danilosilva87](https://discuss.elastic.co/u/danilosilva87)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 1:19pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field-visualize-field-is-a-required-parameter/99036 "2017-09-04T13:19:22Z")
Good afternoon, I’m using metricbeat =\> redis =\> logstash =\> elasticsearch \<= kibana. Some information Kibana 5.5.2 logstash 5.5.2 elasticsearch 5.5.2 metricbeat 5.5.2 All with docker I’ve researched a lot about th… --- ## [Last run of metricbeat module](https://discuss.elastic.co/t/last-run-of-metricbeat-module/99114)
**Author:** [@Daniel\_DNP](https://discuss.elastic.co/u/Daniel_DNP)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 9:58am UTC](https://discuss.elastic.co/t/last-run-of-metricbeat-module/99114 "2017-09-04T09:58:55Z")
Hello! I’m developing a metricbeat module for a database. I would like to fetch backup information from the database. I don’t want to fetch all backup information each time the module runs. Just the information which is… --- ## [Hao to ensure filebeats high availability？](https://discuss.elastic.co/t/hao-to-ensure-filebeats-high-availability/99253)
**Author:** [@gavinage](https://discuss.elastic.co/u/gavinage)\ **Replies:** 0\ **Last updated:** [September 4, 2017, 7:10am UTC](https://discuss.elastic.co/t/hao-to-ensure-filebeats-high-availability/99253 "2017-09-04T07:10:27Z")
hi all, I have a doubt. for example I need collect file A.log and I start up a Filebeat agent,when this agent is down, the result is no collect go on , my question is hao to hao to ensure filebeats high availabil… --- ## [ElasticSearch MetricBeat indexing issue](https://discuss.elastic.co/t/elasticsearch-metricbeat-indexing-issue/99212)
**Author:** [@Ratnakar\_Sadasyula](https://discuss.elastic.co/u/Ratnakar_Sadasyula)\ **Replies:** 1\ **Last updated:** [September 3, 2017, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-metricbeat-indexing-issue/99212 "2017-09-03T09:03:06Z")
Hi I have installed MetricBeat on my Windows system. And started it. In the configuration metricbeats.yml I have set the elasticsearch property as follows output.elasticsearch: \_ # Array of hosts to connect to.\_ \_ … --- ## [MetricBeat compatibility with ElasticSearch](https://discuss.elastic.co/t/metricbeat-compatibility-with-elasticsearch/99213)
**Author:** [@Ratnakar\_Sadasyula](https://discuss.elastic.co/u/Ratnakar_Sadasyula)\ **Replies:** 1\ **Last updated:** [September 3, 2017, 9:01am UTC](https://discuss.elastic.co/t/metricbeat-compatibility-with-elasticsearch/99213 "2017-09-03T09:01:57Z")
With which versions of Elastic Search is MetricBeat 5.5.X compatible? I use ElasticSearch 1.4.2 but in the Compatibility Matrix I find no entry for this version of ElasticSearch. --- ## [Extract Windows Event Log fields](https://discuss.elastic.co/t/extract-windows-event-log-fields/99185)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 0\ **Last updated:** [September 2, 2017, 6:49am UTC](https://discuss.elastic.co/t/extract-windows-event-log-fields/99185 "2017-09-02T06:49:52Z")
Hello. I need help about extract Windows Event Log fields. For example, In below image, How can I extract "Subject”, “Object” and “Accesses” from “message” ? \[Untitled\] I have written below lines but I can’t extract “… --- ## [How can I change "winlogbeat" name in "template.name"?](https://discuss.elastic.co/t/how-can-i-change-winlogbeat-name-in-template-name/98442)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 13\ **Last updated:** [September 1, 2017, 11:15am UTC](https://discuss.elastic.co/t/how-can-i-change-winlogbeat-name-in-template-name/98442 "2017-09-01T11:15:45Z")
Hello. Why I can’t change “winlogbeat” name in “template.name” section in config file? Thank you. --- ## [Custom field / derived field in Heartbeat](https://discuss.elastic.co/t/custom-field-derived-field-in-heartbeat/99008)
**Author:** [@mahadevaprasadap](https://discuss.elastic.co/u/mahadevaprasadap)\ **Replies:** 1\ **Last updated:** [September 1, 2017, 8:30pm UTC](https://discuss.elastic.co/t/custom-field-derived-field-in-heartbeat/99008 "2017-09-01T20:30:51Z")
Is it possible to add derived field in HB? Example: If “Up = true”, I want to add “status=1” else “status=-1” --- ## [Add new field based on value in event\_data](https://discuss.elastic.co/t/add-new-field-based-on-value-in-event-data/99164)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 8:17pm UTC](https://discuss.elastic.co/t/add-new-field-based-on-value-in-event-data/99164 "2017-09-01T20:17:04Z")
Hi, Trying to add a new field IF event\_data.Status is a specific value. Cant figure out the syntax for Logstash. Anyone? /Maekee --- ## [Metricbeats to collect windows services status?](https://discuss.elastic.co/t/metricbeats-to-collect-windows-services-status/99127)
**Author:** [@Daniel\_Braga](https://discuss.elastic.co/u/Daniel_Braga)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 8:12pm UTC](https://discuss.elastic.co/t/metricbeats-to-collect-windows-services-status/99127 "2017-09-01T20:12:10Z")
Hello All! I was wondering if there is a way to collect windows services status, instead of only the actual processes… Thanks in advance, Daniel --- ## [Log rotation in filebeat: can I change filebeat log name to filebeat.log as opposed to filebeat?](https://discuss.elastic.co/t/log-rotation-in-filebeat-can-i-change-filebeat-log-name-to-filebeat-log-as-opposed-to-filebeat/99067)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 1\ **Last updated:** [September 1, 2017, 8:04pm UTC](https://discuss.elastic.co/t/log-rotation-in-filebeat-can-i-change-filebeat-log-name-to-filebeat-log-as-opposed-to-filebeat/99067 "2017-09-01T20:04:21Z")
By default, filebeat log file is named as filebeat, filebeat.1, filebeat.3… Can we set up the log rotation to be more like java log4j naming convention? e.g., filebeat.log, filebeat.log.2017-31-08 The reason I am as… --- ## [Question about conditions in kafka.output topics option topics](https://discuss.elastic.co/t/question-about-conditions-in-kafka-output-topics-option-topics/99039)
**Author:** [@tdukacheva](https://discuss.elastic.co/u/tdukacheva)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 8:00pm UTC](https://discuss.elastic.co/t/question-about-conditions-in-kafka-output-topics-option-topics/99039 "2017-09-01T20:00:26Z")
Hi, I need to configure multiple topics using conditions but looks like multiple conditions in kafka.output section don’t work. topics: - topic: "selene-access-log" when: and: - equals: logType: “access” - regexp: … --- ## [Rpm installation fails due to depencency /bin/sh not found?](https://discuss.elastic.co/t/rpm-installation-fails-due-to-depencency-bin-sh-not-found/98941)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 6\ **Last updated:** [September 1, 2017, 11:37am UTC](https://discuss.elastic.co/t/rpm-installation-fails-due-to-depencency-bin-sh-not-found/98941 "2017-09-01T11:37:36Z")
hi all, i am trying to install a peacketbeat using rpm, Steps i followed, curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-5.5.2-x86\_64.rpm rpm -vi packetbeat-5.5.2-x86\_64.rpm while insat… --- ## [Fileat: Illegal instruction Error](https://discuss.elastic.co/t/fileat-illegal-instruction-error/99104)
**Author:** [@Peeyush\_Gupta](https://discuss.elastic.co/u/Peeyush_Gupta)\ **Replies:** 0\ **Last updated:** [September 1, 2017, 9:05am UTC](https://discuss.elastic.co/t/fileat-illegal-instruction-error/99104 "2017-09-01T09:05:36Z")
Hi, I am building filebeat from source on my ppc64le machine. When I run the command “make” the build is successful but when I try to run the binary, I get “Illegal instruction” error. Not any command is working, it jus… --- ## [X509: cannot validate certificate for 192.168.129.33 because it doesn't contain any IP SANs](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435)
**Author:** [@igormarqs](https://discuss.elastic.co/u/igormarqs)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 8:42am UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435 "2017-09-01T08:42:53Z")
i'm try to start setup ssl btw filebeat and logstash. generate cert.pem and key.pem with: openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout logstashK.pem -out logstashC.pem && openssl req -x509 -nodes -days 3… --- ## [Use Lambda+Beats to load balance S3 input?](https://discuss.elastic.co/t/use-lambda-beats-to-load-balance-s3-input/98760)
**Author:** [@sgendler-stem](https://discuss.elastic.co/u/sgendler-stem)\ **Replies:** 1\ **Last updated:** [August 31, 2017, 12:09pm UTC](https://discuss.elastic.co/t/use-lambda-beats-to-load-balance-s3-input/98760 "2017-08-31T12:09:30Z")
TLDR; - Can I write a lambda which acts as a Beat in order to send the content of a S3-hosted file to a logstash cluster through a load balanced connection in order to distribute the workload, since the S3 input plugin i… --- ## [Metricbeat 5.5.2 with jolokia integration](https://discuss.elastic.co/t/metricbeat-5-5-2-with-jolokia-integration/98985)
**Author:** [@Ashok\_A](https://discuss.elastic.co/u/Ashok_A)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 10:21am UTC](https://discuss.elastic.co/t/metricbeat-5-5-2-with-jolokia-integration/98985 "2017-08-31T10:21:30Z")
Hi All, metricbeat 5.5.2 elasticsearch:5.5.2 jolokia-jvm-1.3.7-agent.jar I’m getting metricbeat logs : fetches.jolokia-jmx.events=30 fetches.jolokia-jmx.failures=30 How to resolve the above failures ? Thanks in ad… --- ## [Metricbeat collects Windows information and Linux information](https://discuss.elastic.co/t/metricbeat-collects-windows-information-and-linux-information/98965)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [August 31, 2017, 8:35am UTC](https://discuss.elastic.co/t/metricbeat-collects-windows-information-and-linux-information/98965 "2017-08-31T08:35:53Z")
Whether the code uses different functions to collects information on Linux and Windows operating systems? Why the source does not see it for different operating systems call a different function？ If you solved my questi… --- ## [How to distinguish between Linux and Windows in the filebeat code？](https://discuss.elastic.co/t/how-to-distinguish-between-linux-and-windows-in-the-filebeat-code/98807)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [August 31, 2017, 1:35am UTC](https://discuss.elastic.co/t/how-to-distinguish-between-linux-and-windows-in-the-filebeat-code/98807 "2017-08-31T01:35:32Z")
I read the filebeat source, and read the filebeat have multiple versions, I would like to ask how to distinguish file and how Linux and Windows operating system, how to distinguish between 32-bit system and 64-bit system… --- ## [What is the role of libbeat/beat.go/type BeatConfig struct？](https://discuss.elastic.co/t/what-is-the-role-of-libbeat-beat-go-type-beatconfig-struct/98816)
**Author:** [@caibaoying](https://discuss.elastic.co/u/caibaoying)\ **Replies:** 2\ **Last updated:** [August 31, 2017, 1:26am UTC](https://discuss.elastic.co/t/what-is-the-role-of-libbeat-beat-go-type-beatconfig-struct/98816 "2017-08-31T01:26:12Z")
type BeatConfig struct { Shipper publisher.ShipperConfig config:",inline" Output map\[string\]\*common.Config config:"output" Logging logp.Logging config:"logging" Processors processors.PluginCo… --- ## [Metricbeat 5.3.1 not collecting host os process info](https://discuss.elastic.co/t/metricbeat-5-3-1-not-collecting-host-os-process-info/97626)
**Author:** [@dh2001](https://discuss.elastic.co/u/dh2001)\ **Replies:** 3\ **Last updated:** [August 30, 2017, 10:04pm UTC](https://discuss.elastic.co/t/metricbeat-5-3-1-not-collecting-host-os-process-info/97626 "2017-08-30T22:04:59Z")
We have Filebeat and Metricbeat running in a docker container. With /proc mounted to /hostfs ro. SLES 12. Using -system.hostfs=/hostfs when running metricbeat. But we do not see any process info for processes in anothe… --- ## [Metricbeat 5.5 sending events to Logstash in batches](https://discuss.elastic.co/t/metricbeat-5-5-sending-events-to-logstash-in-batches/98269)
**Author:** [@keithn](https://discuss.elastic.co/u/keithn)\ **Replies:** 5\ **Last updated:** [August 30, 2017, 8:51pm UTC](https://discuss.elastic.co/t/metricbeat-5-5-sending-events-to-logstash-in-batches/98269 "2017-08-30T20:51:58Z")
Is it possible for Metricbeat to send multiple events to Logstash in batches? For example, collect system CPU and Memory metrics every second, but ship the metrics to Logstash in batches (e.g. 60 events) every minute? T… --- ## [Combining multiline entries based on a common unique ID](https://discuss.elastic.co/t/combining-multiline-entries-based-on-a-common-unique-id/98611)
**Author:** [@TJelastico](https://discuss.elastic.co/u/TJelastico)\ **Replies:** 4\ **Last updated:** [August 30, 2017, 8:14pm UTC](https://discuss.elastic.co/t/combining-multiline-entries-based-on-a-common-unique-id/98611 "2017-08-30T20:14:36Z")
Hi, I have a single log file which contains several multi-line log formats that defy a using a single set of multiline.pattern, multiline.match, and multiline.negate entries. Using multiple OR statements in multiline.pa… --- ## [Running Filebeat from Command Line](https://discuss.elastic.co/t/running-filebeat-from-command-line/98907)
**Author:** [@dolanmk](https://discuss.elastic.co/u/dolanmk)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 8:14pm UTC](https://discuss.elastic.co/t/running-filebeat-from-command-line/98907 "2017-08-30T20:14:34Z")
Hi, I am hoping to run Filebeat from my command line and not as a service on my Windows machine. I have filebeat.yml configured to send my logs to a port that my Logstash will be listening for instead of sending them d… --- ## [Reporting a vulnerability in filebeat?](https://discuss.elastic.co/t/reporting-a-vulnerability-in-filebeat/98870)
**Author:** [@mlucia](https://discuss.elastic.co/u/mlucia)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 3:23pm UTC](https://discuss.elastic.co/t/reporting-a-vulnerability-in-filebeat/98870 "2017-08-30T15:23:54Z")
One of my colleagues found a vulnerability between filebeats ssl and logstash ssl. Whom should we contact regarding this? [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=501) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=503)