# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=509 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 510 --- ## [Monitor packetbeat via Zabbix](https://discuss.elastic.co/t/monitor-packetbeat-via-zabbix/95106)
**Author:** [@sheldon](https://discuss.elastic.co/u/sheldon)\ **Replies:** 1\ **Last updated:** [July 31, 2017, 4:41am UTC](https://discuss.elastic.co/t/monitor-packetbeat-via-zabbix/95106 "2017-07-31T04:41:39Z")
Hi, I am new to packetbeat and also ELK…I would like to ask is there any way to monitor packetbeat through Zabbix? or importing packetbeat to Zabbix? I am using Linux Centos 7. --- ## [Filebeat lost data](https://discuss.elastic.co/t/filebeat-lost-data/90631)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 12\ **Last updated:** [July 31, 2017, 4:24am UTC](https://discuss.elastic.co/t/filebeat-lost-data/90631 "2017-07-31T04:24:15Z")
Hi all, We have experienced a lost data issue with filebeat \> logstash. Our Logstash server was down for 4 hours and some events have not been indexed. The filebeat configuration is as follows : scan\_frequency: 3… --- ## [Can't drop events from metricbeat](https://discuss.elastic.co/t/cant-drop-events-from-metricbeat/94602)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 9\ **Last updated:** [July 31, 2017, 4:15am UTC](https://discuss.elastic.co/t/cant-drop-events-from-metricbeat/94602 "2017-07-31T04:15:03Z")
Hi folks, We encountered an issue while the metricbeat is trying to send their metrics to elasticsearch. even with some drop events rules, but can't drop the events we don't want. we still can see some particular value… --- ## [Filebeat local date wrong](https://discuss.elastic.co/t/filebeat-local-date-wrong/95100)
**Author:** [@Puk](https://discuss.elastic.co/u/Puk)\ **Replies:** 1\ **Last updated:** [July 31, 2017, 3:25am UTC](https://discuss.elastic.co/t/filebeat-local-date-wrong/95100 "2017-07-31T03:25:55Z")
Total newbie here trying to get ELK Stack working in a test environment first ahead of deploying. I’ve managed to get everything working fine, including Winlogbeat and metricbeat, but filebeat for my linux hosts is giv… --- ## [How to make Metricbeat emit a event in a single long message](https://discuss.elastic.co/t/how-to-make-metricbeat-emit-a-event-in-a-single-long-message/94919)
**Author:** [@Teng-Jing\_Wang](https://discuss.elastic.co/u/Teng-Jing_Wang)\ **Replies:** 2\ **Last updated:** [July 29, 2017, 7:15am UTC](https://discuss.elastic.co/t/how-to-make-metricbeat-emit-a-event-in-a-single-long-message/94919 "2017-07-29T07:15:33Z")
Greetings, I have been tasked by my team to extract status of our machines using Metricbeat. However I have observed Metricbeat emits message by each metric basis: {"@metadata":{"type":"metricsets","beat":"metricbeat"}… --- ## [Specifying \_type with Filebeat](https://discuss.elastic.co/t/specifying--type-with-filebeat/94957)
**Author:** [@spur01](https://discuss.elastic.co/u/spur01)\ **Replies:** 13\ **Last updated:** [July 28, 2017, 8:47pm UTC](https://discuss.elastic.co/t/specifying--type-with-filebeat/94957 "2017-07-28T20:47:36Z")
I’m at a bit of a loss on how to do this correctly. I have a Filebeat pushing to a pipeline which targets an index that has dynamic mapping set to false and a type that enforces strict mapping. The type I’m using is no… --- ## [Filebeat and Logstash connection refused error](https://discuss.elastic.co/t/filebeat-and-logstash-connection-refused-error/94862)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 2:39am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-connection-refused-error/94862 "2017-07-28T02:39:30Z")
Hi ! I am trying to send the logs to logstash using filebeats I'm getting this error I ran the commands : 1) sudo /etc/init.d/filebeat start and then after I ran 2) ./filebeat -e -v -c filebeat.yml 2017/07/27… --- ## [Error installing beats input plugin](https://discuss.elastic.co/t/error-installing-beats-input-plugin/94848)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 4\ **Last updated:** [July 28, 2017, 2:40pm UTC](https://discuss.elastic.co/t/error-installing-beats-input-plugin/94848 "2017-07-28T14:40:06Z")
Hi , I am trying to install logstash input beats plugin , I am getting the following error: File /opt/logstash/Gemfile does not exist or is writable, aborting I ran the command: /opt/logstash$ ./bin/logstash-plugi… --- ## [Filebeat is not monitoring logs on centos 7?](https://discuss.elastic.co/t/filebeat-is-not-monitoring-logs-on-centos-7/92787)
**Author:** [@atharvajava](https://discuss.elastic.co/u/atharvajava)\ **Replies:** 21\ **Last updated:** [July 28, 2017, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-is-not-monitoring-logs-on-centos-7/92787 "2017-07-28T13:57:35Z")
I just installed ELK stack everything seems to be working fine but the filebeat is not showing me logs beyond the date of installation and also it is only pointing to yum.log eventhough I specified inside filebeat.yml … --- ## [Custum beat exemple in documentation problem](https://discuss.elastic.co/t/custum-beat-exemple-in-documentation-problem/94818)
**Author:** [@boubker\_elamri](https://discuss.elastic.co/u/boubker_elamri)\ **Replies:** 5\ **Last updated:** [July 28, 2017, 10:34am UTC](https://discuss.elastic.co/t/custum-beat-exemple-in-documentation-problem/94818 "2017-07-28T10:34:54Z")
hi everyone, I was learning how to create beats this days, and i found out an lsbeat exemple on the documentations, I followed the instruction one by one, and the lsbeat compiled with success. However, when I tried to … --- ## [Index creation with and without useful file paths](https://discuss.elastic.co/t/index-creation-with-and-without-useful-file-paths/94928)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 9:53am UTC](https://discuss.elastic.co/t/index-creation-with-and-without-useful-file-paths/94928 "2017-07-28T09:53:06Z")
Hello, I have made a file prospectors in Filebeat with the following parameters: - input\_type: log - /opt/test/test\_file - /var/log/syslog document\_type: test Which is parsed correctly and index is created n… --- ## [Data not diplayed with filebeat](https://discuss.elastic.co/t/data-not-diplayed-with-filebeat/94921)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 8:31am UTC](https://discuss.elastic.co/t/data-not-diplayed-with-filebeat/94921 "2017-07-28T08:31:10Z")
Hello, I have created a new document\_type in my filebeat configuration. I specified no template matching it, hoping data would have been shew natively in kibana (yes, i am new…). But nothing appears, even the index was … --- ## [Shipping whole file as message?](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 4:26am UTC](https://discuss.elastic.co/t/shipping-whole-file-as-message/94609 "2017-07-28T04:26:33Z")
Hello everyone, I am kindly new to ELK and now I want to ship the content of a whole file as message into logstash and elastic. So as I have different files, each file should be a single event with all its content as m… --- ## [Reading values from lsbeat.yml](https://discuss.elastic.co/t/reading-values-from-lsbeat-yml/94838)
**Author:** [@soaguru](https://discuss.elastic.co/u/soaguru)\ **Replies:** 4\ **Last updated:** [July 27, 2017, 5:19pm UTC](https://discuss.elastic.co/t/reading-values-from-lsbeat-yml/94838 "2017-07-27T17:19:22Z")
I have written a custom beat lsbeat.yml (similar to the tutorial) and it works fine. I have a question on reading values from yml file. I added a new property in the lsbeat.yml called lastRunTimestamp: "2017-07-27 0… --- ## [What's the best way to track calls to a specific URL?](https://discuss.elastic.co/t/whats-the-best-way-to-track-calls-to-a-specific-url/94825)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 3\ **Last updated:** [July 27, 2017, 5:10pm UTC](https://discuss.elastic.co/t/whats-the-best-way-to-track-calls-to-a-specific-url/94825 "2017-07-27T17:10:09Z")
I have Packetbeat installed on an application server. I'd like a way to determine how many calls to a given URL (say, www.xyz.com) are made per time frame I'm searching on in Kibana. What would be the best way to accompl… --- ## [Multiline Matching based on Same Timestamp](https://discuss.elastic.co/t/multiline-matching-based-on-same-timestamp/93055)
**Author:** [@csobchuk](https://discuss.elastic.co/u/csobchuk)\ **Replies:** 6\ **Last updated:** [July 27, 2017, 3:58pm UTC](https://discuss.elastic.co/t/multiline-matching-based-on-same-timestamp/93055 "2017-07-27T15:58:46Z")
Is there a means to consolidate log lines that have the same timestamp (in ms resolution) as a single line. This occurs rather frequently with Openstack logs in oslofmt where an Error will come in first and then its tra… --- ## [Filebeat: If tcp write or read error then filebeat stops harvesting files until restart](https://discuss.elastic.co/t/filebeat-if-tcp-write-or-read-error-then-filebeat-stops-harvesting-files-until-restart/94590)
**Author:** [@Alexkl](https://discuss.elastic.co/u/Alexkl)\ **Replies:** 3\ **Last updated:** [July 27, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-if-tcp-write-or-read-error-then-filebeat-stops-harvesting-files-until-restart/94590 "2017-07-27T14:41:30Z")
Hello I am currently using the elk stack in v5.5 and i have a quite big issue: Everytime i have a tcp write or read error i have to restart filebeat because it stops sending messages. 2017-07-25T11:14:46+02:00 ERR Fa… --- ## [How can specify the log message](https://discuss.elastic.co/t/how-can-specify-the-log-message/94766)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 5\ **Last updated:** [July 27, 2017, 1:35pm UTC](https://discuss.elastic.co/t/how-can-specify-the-log-message/94766 "2017-07-27T13:35:53Z")
I'm newbie at ELK stack. I have installed and the ELK working find but now i want to visualize the content of my log after filebeat send it to logstash. I had read some topic still cant find how to do it so i post the is… --- ## [Filebeat cannot send to Amazon ElasticSearch Service](https://discuss.elastic.co/t/filebeat-cannot-send-to-amazon-elasticsearch-service/94786)
**Author:** [@ssmishra](https://discuss.elastic.co/u/ssmishra)\ **Replies:** 0\ **Last updated:** [July 27, 2017, 12:30pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-to-amazon-elasticsearch-service/94786 "2017-07-27T12:30:28Z")
I am trying to send log files using filebeat to Amazon elasticsearch service. The filebeat runs on amazon EC2 servers. I wanted to configure Amazon elasticsearch service with IAM user policies. In doing so, i get 403 for… --- ## [Need to connect File beat to MapR Stream](https://discuss.elastic.co/t/need-to-connect-file-beat-to-mapr-stream/94764)
**Author:** [@sachinjadhav25](https://discuss.elastic.co/u/sachinjadhav25)\ **Replies:** 0\ **Last updated:** [July 27, 2017, 9:43am UTC](https://discuss.elastic.co/t/need-to-connect-file-beat-to-mapr-stream/94764 "2017-07-27T09:43:25Z")
I am trying to ship logs to MapR Stream using file beat, but I am not able to find any useful information regarding this. Can anybody help me to set output section in file beat config file? Has anybody tried this? --- ## [Filebeat binary for ARM64 kernel](https://discuss.elastic.co/t/filebeat-binary-for-arm64-kernel/94718)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 0\ **Last updated:** [July 27, 2017, 12:56am UTC](https://discuss.elastic.co/t/filebeat-binary-for-arm64-kernel/94718 "2017-07-27T00:56:09Z")
Are there pre-built filebeat binaries for available to run Linux ARM64 ? I couldn't locate one in https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/ --- ## [When I install x-pack, filebeat can not connect to Logstash](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166)
**Author:** [@dog](https://discuss.elastic.co/u/dog)\ **Replies:** 2\ **Last updated:** [July 27, 2017, 1:47am UTC](https://discuss.elastic.co/t/when-i-install-x-pack-filebeat-can-not-connect-to-logstash/93166 "2017-07-27T01:47:56Z")
Before I installed x-pack, everything worked well. When I installed x-pack, I received a 401 error and I configured the user according to the official document. But my filebeat can not connect to logstash. Logstash error… --- ## [Remove \\n Characters in Filebeat](https://discuss.elastic.co/t/remove-n-characters-in-filebeat/94544)
**Author:** [@dmtd](https://discuss.elastic.co/u/dmtd)\ **Replies:** 1\ **Last updated:** [July 26, 2017, 9:06am UTC](https://discuss.elastic.co/t/remove-n-characters-in-filebeat/94544 "2017-07-26T09:06:05Z")
Removing the content of this topic because it is not an elastic issue. But for anyone else who comes across this: Logs should be written to disk with \\n for new lines, not \\\\n, and Kibana will read appropriately. --- ## [Logstash Not able to listen events from Filebeats](https://discuss.elastic.co/t/logstash-not-able-to-listen-events-from-filebeats/94660)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 1\ **Last updated:** [July 26, 2017, 8:55pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-listen-events-from-filebeats/94660 "2017-07-26T20:55:25Z")
Hi there! I'm trying to send logs through filebeats to logstash, I have: Logstash--on local machine filebeat-on local machine Elastic search---on host machine(server) In filebeat.yml I enabled logstash output. My … --- ## [Ship Filebeat data to public IP Logstash](https://discuss.elastic.co/t/ship-filebeat-data-to-public-ip-logstash/93855)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 6\ **Last updated:** [July 26, 2017, 12:11pm UTC](https://discuss.elastic.co/t/ship-filebeat-data-to-public-ip-logstash/93855 "2017-07-26T12:11:34Z")
I want to connect 2 different machines over the internet. My server is on public IP which holds the logstash and elasticsearch. It is possible to send data(filebeat) to the public ip server(logstash/elasticsearch) Can yo… --- ## [Metricbeat doesn't fill all available fields (eg. system.memory. ...)](https://discuss.elastic.co/t/metricbeat-doesnt-fill-all-available-fields-eg-system-memory/93959)
**Author:** [@elkinspace](https://discuss.elastic.co/u/elkinspace)\ **Replies:** 5\ **Last updated:** [July 26, 2017, 9:51am UTC](https://discuss.elastic.co/t/metricbeat-doesnt-fill-all-available-fields-eg-system-memory/93959 "2017-07-26T09:51:18Z")
Hi there, We have just started with the ELK stack to monitor our servers. The servers are running on Debian Jessie (8.8) and ELK Stack 5.5. On most of the machines metricbeat works as expected. But I have an issue wi… --- ## [Securing communication between Elasticsearch and Filebeat](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467)
**Author:** [@madou23](https://discuss.elastic.co/u/madou23)\ **Replies:** 1\ **Last updated:** [July 26, 2017, 9:12am UTC](https://discuss.elastic.co/t/securing-communication-between-elasticsearch-and-filebeat/94467 "2017-07-26T09:12:18Z")
Hi all, I am running Elasticsearch and Kibana stack 5.5.0 on an ubuntu server. My client servers are located in a local network so I need to run ES on 0.0.0.0:9200 to get logs from Filebeat. I know it's too risky to expo… --- ## [Need help tuning 3K+ EPS with ForwardedEvents](https://discuss.elastic.co/t/need-help-tuning-3k-eps-with-forwardedevents/94384)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 12\ **Last updated:** [July 25, 2017, 7:57pm UTC](https://discuss.elastic.co/t/need-help-tuning-3k-eps-with-forwardedevents/94384 "2017-07-25T19:57:09Z")
I'm running winlogbeats on a windows 2012 server that is used as a windows event forwarding aggregation point. 2700+ clients report security logs to this 1 server in near real-time with the built in windows event forward… --- ## [Dropping fields doesnt work](https://discuss.elastic.co/t/dropping-fields-doesnt-work/94469)
**Author:** [@randude](https://discuss.elastic.co/u/randude)\ **Replies:** 4\ **Last updated:** [July 25, 2017, 3:13pm UTC](https://discuss.elastic.co/t/dropping-fields-doesnt-work/94469 "2017-07-25T15:13:37Z")
Hi, I'd like to drop the beat fields. I've used the formal docs and added the processors part but the fields are still in the data for some reason. What am I doing wrong? This is my yaml file for metricbeat 5.5.0: m… --- ## [How to specify Docker host on Windows?](https://discuss.elastic.co/t/how-to-specify-docker-host-on-windows/94153)
**Author:** [@godefroi](https://discuss.elastic.co/u/godefroi)\ **Replies:** 4\ **Last updated:** [July 25, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-specify-docker-host-on-windows/94153 "2017-07-25T14:38:35Z")
I'm trying out Metricbeat, and attempting to get some data from the Docker module. I've got the thing configured (just the bare minimum so far, with the "container" metricset), and I've run into some difficulty in specif… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=508) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=510)