# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=507 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 508 --- ## [Travis errors on chmod command after generating new Beat](https://discuss.elastic.co/t/travis-errors-on-chmod-command-after-generating-new-beat/95856)
**Author:** [@makkes](https://discuss.elastic.co/u/makkes)\ **Replies:** 4\ **Last updated:** [August 8, 2017, 7:06pm UTC](https://discuss.elastic.co/t/travis-errors-on-chmod-command-after-generating-new-beat/95856 "2017-08-08T19:06:19Z")
Hi everyone, I've just created a new Beat using the documentation from https://www.elastic.co/guide/en/beats/libbeat/current/new-beat.html. However, the generated .travis.yml file causes Travis to fail: The chmod cal… --- ## [Filebeat's logs rotation malfunctioning](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522)
**Author:** [@abhiroyg](https://discuss.elastic.co/u/abhiroyg)\ **Replies:** 6\ **Last updated:** [August 8, 2017, 4:52pm UTC](https://discuss.elastic.co/t/filebeats-logs-rotation-malfunctioning/95522 "2017-08-08T16:52:10Z")
Hi, Below is my filebeat config: filebeat.prospectors: - input\_type: log paths: - '/tmp/worker.log' encoding: utf-8 output.logstash: hosts: \["127.0.0.1:5044"\] worker: 2 loadbalance: true ssl.verificatio… --- ## [How to connect the remote MYSQL database](https://discuss.elastic.co/t/how-to-connect-the-remote-mysql-database/96243)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 2\ **Last updated:** [August 8, 2017, 1:20pm UTC](https://discuss.elastic.co/t/how-to-connect-the-remote-mysql-database/96243 "2017-08-08T13:20:35Z")
I have a Ubuntu server and MySQL Cloud server.i have packetbeat installed in Ubuntu server, and i need to monitor MySQL Cloud server (3306-port). In kibana i cant see any data. 1- Where should i use the (MySQL-host / i… --- ## [Inteface conversion in running time error of a custum beat](https://discuss.elastic.co/t/inteface-conversion-in-running-time-error-of-a-custum-beat/96216)
**Author:** [@boubker\_elamri](https://discuss.elastic.co/u/boubker_elamri)\ **Replies:** 1\ **Last updated:** [August 8, 2017, 12:39pm UTC](https://discuss.elastic.co/t/inteface-conversion-in-running-time-error-of-a-custum-beat/96216 "2017-08-08T12:39:03Z")
hi everyone, I’m working on a beat and I came across an error like this : 2017/08/08 07:46:39.505926 beat.go:267: INFO Home path: \[/home/hp/src/github.com/bob96/hc34\] Config path: \[/home/hp/src/github.com/bob96/hc34\] D… --- ## [Create Index Template in FileBeat and No Effect on datatype of Date](https://discuss.elastic.co/t/create-index-template-in-filebeat-and-no-effect-on-datatype-of-date/96033)
**Author:** [@markboo](https://discuss.elastic.co/u/markboo)\ **Replies:** 3\ **Last updated:** [August 8, 2017, 12:29pm UTC](https://discuss.elastic.co/t/create-index-template-in-filebeat-and-no-effect-on-datatype-of-date/96033 "2017-08-08T12:29:35Z")
I create a custom template.json in filebeat folder, and configured it to template.path in filebeat.yml. The template contains a field of local\_timestamp which is a date field in my logs. like this: “local\_timestamp”: … --- ## [FileBeat elasticsearch output, unable to add "host" to http headers](https://discuss.elastic.co/t/filebeat-elasticsearch-output-unable-to-add-host-to-http-headers/96073)
**Author:** [@zpoint](https://discuss.elastic.co/u/zpoint)\ **Replies:** 2\ **Last updated:** [August 8, 2017, 8:02am UTC](https://discuss.elastic.co/t/filebeat-elasticsearch-output-unable-to-add-host-to-http-headers/96073 "2017-08-08T08:02:01Z")
configure file: headers: host: "datasearch" abc: "def" I sniffer the network and find that “Abc” added to http header in every request, but “Host” remains default value (someting like “120.76.205.2… --- ## [Filebeat not publishing log to ES](https://discuss.elastic.co/t/filebeat-not-publishing-log-to-es/95817)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 7\ **Last updated:** [August 8, 2017, 3:08am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-log-to-es/95817 "2017-08-08T03:08:48Z")
Hi, Im using ES 5.5.0, LS 5.5.0. Kibana 5.5.0 and Filebeat 5.5.0. Beat -\> LS -\> ES Im instaliing filbeat in windows server 2012 for collecting log. This is my filebeat config filebeat.prospectors: - input\_type: log … --- ## [Processor conditions: default case?](https://discuss.elastic.co/t/processor-conditions-default-case/96093)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 2\ **Last updated:** [August 7, 2017, 5:02pm UTC](https://discuss.elastic.co/t/processor-conditions-default-case/96093 "2017-08-07T17:02:51Z")
Hi, Is there any efficient way to tell FB that if one or multiple conditions are met and corresponding data is processed by corresponding processor(s), everything else goes to another - default - processor? Example of… --- ## [Filebeat stops processing and does not retry](https://discuss.elastic.co/t/filebeat-stops-processing-and-does-not-retry/95935)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 2\ **Last updated:** [August 7, 2017, 2:43pm UTC](https://discuss.elastic.co/t/filebeat-stops-processing-and-does-not-retry/95935 "2017-08-07T14:43:49Z")
Hello, Using Filebeat 5.5.1 on RHEL 6.9, directly pushing logs to ES 5.5.0, I’m having this strange behavior during Filbeat execution which is configured to harvest one single test log file of ~100 Gb: \[... runs succes… --- ## [Filebeat to Logstash - broken pipe](https://discuss.elastic.co/t/filebeat-to-logstash-broken-pipe/95614)
**Author:** [@z\_m](https://discuss.elastic.co/u/z_m)\ **Replies:** 3\ **Last updated:** [August 7, 2017, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-broken-pipe/95614 "2017-08-07T14:40:47Z")
Hi, It seems the filebeat misses acks from logstash in my testing rig. My arrangement Both Filebeat and Logstash runs on sigle Mac Sierra (10.12.6) Filebeat v.5.5.0 Config filebeat.prospectors: - input\_type: … --- ## [Filebeat is taking too much of memory on ubuntu 16](https://discuss.elastic.co/t/filebeat-is-taking-too-much-of-memory-on-ubuntu-16/96057)
**Author:** [@Narayanan\_Sukumar](https://discuss.elastic.co/u/Narayanan_Sukumar)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-is-taking-too-much-of-memory-on-ubuntu-16/96057 "2017-08-07T14:22:25Z")
Hello, I am using filebeat version 5.4.2 with ubuntu 16 and it is taking more memory resulting OOM. ================== root@xxxxxx:/usr/share/filebeat/bin# ./filebeat -configtest -c /etc/filebeat/filebeat.yml -e 2017/… --- ## [Save Metrics as JSON on NFS share, import on other server w/o logstash](https://discuss.elastic.co/t/save-metrics-as-json-on-nfs-share-import-on-other-server-w-o-logstash/95923)
**Author:** [@pat7](https://discuss.elastic.co/u/pat7)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 1:25pm UTC](https://discuss.elastic.co/t/save-metrics-as-json-on-nfs-share-import-on-other-server-w-o-logstash/95923 "2017-08-07T13:25:56Z")
Hi, unfortunately i don’t have a direct access (no fw access possible) to my target server i want collect metrcis from with metricbeat. The idea is now to export the metrics to a json file instead of pushing it directly … --- ## [Filebeat: logstash.pipelining: how does it work?](https://discuss.elastic.co/t/filebeat-logstash-pipelining-how-does-it-work/95921)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-logstash-pipelining-how-does-it-work/95921 "2017-08-07T13:23:12Z")
Hello, The documentation being pretty succinct on the topic of logstash.pipelining parameter (and Google searches often return articles related to LS and ES pipelines), I’d like to know how these 3 parameters interact t… --- ## [Packetbeat MPLS support](https://discuss.elastic.co/t/packetbeat-mpls-support/95860)
**Author:** [@michu162](https://discuss.elastic.co/u/michu162)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 12:42pm UTC](https://discuss.elastic.co/t/packetbeat-mpls-support/95860 "2017-08-07T12:42:39Z")
Hello, I would like to log HTTP requests from MPLS traffic (one or two labels) Packetbeat does support MPLS? I’m tried both pcap and af-packet modes without success. Regards, Michal --- ## [Timestamp format while overwriting](https://discuss.elastic.co/t/timestamp-format-while-overwriting/94814)
**Author:** [@2knarf](https://discuss.elastic.co/u/2knarf)\ **Replies:** 5\ **Last updated:** [August 7, 2017, 12:09pm UTC](https://discuss.elastic.co/t/timestamp-format-while-overwriting/94814 "2017-08-07T12:09:50Z")
Hello, Is it possible to change the timestamp format for a logfile within filebeat? I get this error so I need to change it. 2017-07-27T14:41:03+02:00 ERR JSON: Won't overwrite @timestamp because of parsing error: pa… --- ## [Filebeat installation in linux](https://discuss.elastic.co/t/filebeat-installation-in-linux/95388)
**Author:** [@vaddanam](https://discuss.elastic.co/u/vaddanam)\ **Replies:** 4\ **Last updated:** [August 7, 2017, 11:56am UTC](https://discuss.elastic.co/t/filebeat-installation-in-linux/95388 "2017-08-07T11:56:41Z")
Hi Team, I installed the filebeat in linux environment using the rpm installation sudo install rpm filename. On observing that the default directory layout data folder “/var/lib/filebeat” and logs folder “/var/log/fileb… --- ## [How to Dynamic Service Discovery](https://discuss.elastic.co/t/how-to-dynamic-service-discovery/96062)
**Author:** [@l453595892](https://discuss.elastic.co/u/l453595892)\ **Replies:** 0\ **Last updated:** [August 7, 2017, 8:38am UTC](https://discuss.elastic.co/t/how-to-dynamic-service-discovery/96062 "2017-08-07T08:38:56Z")
In kubernetes,when i want to send kubernetes pods logs to logstash with filebeat,i find i can not add the target pods labels (not filebeat pod\`s lables) how can i do to add these targettag? --- ## [Filebeat Multiline problem with Logstash](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logstash/95997)
**Author:** [@madou23](https://discuss.elastic.co/u/madou23)\ **Replies:** 1\ **Last updated:** [August 6, 2017, 11:27am UTC](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logstash/95997 "2017-08-06T11:27:15Z")
Hi all, I am trying to use multiline pattern in filebeat to append multiline code in jenkins log Below is a sample of log file: Aug 06, 2017 12:18:19 AM hudson.UDPBroadcastThread run INFO: Cannot listen to UDP port 33… --- ## [Cannot connect to /var/run/docker.sock](https://discuss.elastic.co/t/cannot-connect-to-var-run-docker-sock/95993)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 1\ **Last updated:** [August 5, 2017, 7:43pm UTC](https://discuss.elastic.co/t/cannot-connect-to-var-run-docker-sock/95993 "2017-08-05T19:43:33Z")
Hi I’m trying the new 6.0.0-alpha2 beat I try to launch as follows… docker run -v ~/filebeat.yml:/usr/share/filebeat/filebeat.yml -u root docker.elastic.co/beats/filebeat:6.0.0-alpha2 The container logs print Canno… --- ## [How to send different logs files to different logstash ports](https://discuss.elastic.co/t/how-to-send-different-logs-files-to-different-logstash-ports/95781)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 5\ **Last updated:** [August 5, 2017, 2:14pm UTC](https://discuss.elastic.co/t/how-to-send-different-logs-files-to-different-logstash-ports/95781 "2017-08-05T14:14:05Z")
I am trying to send different log files on different logstash ports on logstash …like one on 5044 and other on 5043 Here is my filebeat config . can someone help #=========================== Filebeat prospectors ======… --- ## [Multiline problem with 2 "first" lines](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770)
**Author:** [@Redempter](https://discuss.elastic.co/u/Redempter)\ **Replies:** 4\ **Last updated:** [August 4, 2017, 3:10pm UTC](https://discuss.elastic.co/t/multiline-problem-with-2-first-lines/95770 "2017-08-04T15:10:20Z")
I just implemented a new ELK server to centralise all our servers’ logs so I’m still pretty new to the configuration and I’m having quite a puzzling problem. I am trying to get multilines log to be caught as one event a… --- ## [CRIT Exiting: No prospectors defined. What files do you want me to watch?](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728)
**Author:** [@hasan\_sharekhan](https://discuss.elastic.co/u/hasan_sharekhan)\ **Replies:** 3\ **Last updated:** [August 4, 2017, 6:27am UTC](https://discuss.elastic.co/t/crit-exiting-no-prospectors-defined-what-files-do-you-want-me-to-watch/95728 "2017-08-04T06:27:39Z")
I am having problem with regular expression not working in filebeat 5.5 filebeat.prospectors: - input\_type: log paths: - D:\\uat\\beats\\filebeat550\\input\_logs\\tt\_tradingserver\\\* #use regular expression exclude… --- ## [Metricbeat Windows Module 6.0.0-alpha2, Output question](https://discuss.elastic.co/t/metricbeat-windows-module-6-0-0-alpha2-output-question/95676)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 5\ **Last updated:** [August 3, 2017, 4:17pm UTC](https://discuss.elastic.co/t/metricbeat-windows-module-6-0-0-alpha2-output-question/95676 "2017-08-03T16:17:25Z")
Hi Everyone, was since yesterday starting to test the alpha of the new windows module to use perfmon data to get a better overview of our .Net applications within IIS. Now is only one big remaining question mark over m… --- ## [Installing Jolikia for Metricbeat in Windows](https://discuss.elastic.co/t/installing-jolikia-for-metricbeat-in-windows/95741)
**Author:** [@bkumbar](https://discuss.elastic.co/u/bkumbar)\ **Replies:** 0\ **Last updated:** [August 3, 2017, 3:23pm UTC](https://discuss.elastic.co/t/installing-jolikia-for-metricbeat-in-windows/95741 "2017-08-03T15:23:30Z")
Hi Team, I am new to Elastic, trying to setup Metricbeat for pulling JVM information. Can someone explain how to install the Jolokia for Windows environment and what the changes need to be done for Jolokia and Metricbea… --- ## [Recreate index from scratch with static file](https://discuss.elastic.co/t/recreate-index-from-scratch-with-static-file/95690)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 2\ **Last updated:** [August 3, 2017, 2:59pm UTC](https://discuss.elastic.co/t/recreate-index-from-scratch-with-static-file/95690 "2017-08-03T14:59:38Z")
Hello, I have a static log file for testing, and every time I recreated the index (for testing purpose), there is no data in the index. I have to change the file name and restart the filebeat service. Is there an opti… --- ## [Packetbeat & MySQL Database](https://discuss.elastic.co/t/packetbeat-mysql-database/95644)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 3\ **Last updated:** [August 3, 2017, 2:29pm UTC](https://discuss.elastic.co/t/packetbeat-mysql-database/95644 "2017-08-03T14:29:57Z")
i have a doubt in packetbeat…do we have to install packetbeat in mysql database server to monitor the 3306 port…or we can install in other Ubuntu server and configure packetbeat to monitor the MySQL database server ?? --- ## [Kubernetes metadata not showing up for init-Containers](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-up-for-init-containers/95620)
**Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 2\ **Last updated:** [August 3, 2017, 2:08pm UTC](https://discuss.elastic.co/t/kubernetes-metadata-not-showing-up-for-init-containers/95620 "2017-08-03T14:08:39Z")
In Kubernetes you Init Containers can be specified for a Deployment. Unfortunately it appears that the kubernetes metadata fields are not showing up for logs from an init-container in a pod. The logs from the main app co… --- ## [Jenkins monitoring using Elastic stack](https://discuss.elastic.co/t/jenkins-monitoring-using-elastic-stack/95679)
**Author:** [@madou23](https://discuss.elastic.co/u/madou23)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 9:27am UTC](https://discuss.elastic.co/t/jenkins-monitoring-using-elastic-stack/95679 "2017-08-03T09:27:37Z")
Hi all, I’m trying to monitor Jenkins using Elastic stack but don’t know which Beat to choose Filebeat or Metricbeat ? I’m thinking to use Filebeat and Logstash to collect and filter these log files: /var/log/jenkins/… --- ## [Filebeat not picking logs when run as service](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632)
**Author:** [@pavanssetty](https://discuss.elastic.co/u/pavanssetty)\ **Replies:** 5\ **Last updated:** [August 2, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632 "2017-08-02T15:18:15Z")
I am using Filebeat 5.4 version on Windows Server 2012. When I run filebeat from PowerShell or Command Prompt it is shipping logs successfully to my logstash instance running on Command Prompt. But when I try installing … --- ## [Can Metricbeat allows to run a script or unix/application specific commands and to store its output into elastic search?](https://discuss.elastic.co/t/can-metricbeat-allows-to-run-a-script-or-unix-application-specific-commands-and-to-store-its-output-into-elastic-search/95638)
**Author:** [@mahadevaprasadap](https://discuss.elastic.co/u/mahadevaprasadap)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 4:18am UTC](https://discuss.elastic.co/t/can-metricbeat-allows-to-run-a-script-or-unix-application-specific-commands-and-to-store-its-output-into-elastic-search/95638 "2017-08-03T04:18:05Z")
For example, if you run “httpd fullstatus” command on a server where Apache Webserver is running, it will output usage statistics. In such case, Metricbeat should be able to either run the command directly or via script… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=506) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=508)