# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=510 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 511 --- ## [DiskIO on macOS](https://discuss.elastic.co/t/diskio-on-macos/92371)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 4\ **Last updated:** [July 25, 2017, 4:59am UTC](https://discuss.elastic.co/t/diskio-on-macos/92371 "2017-07-25T04:59:07Z")
Any chance of getting diskio available for Mac / darwin servers? System Diskio Metricset The System diskio metricset provides disk IO metrics collected from the operating system. One event is created for each disk mou… --- ## [Get Updated data From Powercfg Battery Report](https://discuss.elastic.co/t/get-updated-data-from-powercfg-battery-report/94081)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 4\ **Last updated:** [July 25, 2017, 4:51am UTC](https://discuss.elastic.co/t/get-updated-data-from-powercfg-battery-report/94081 "2017-07-25T04:51:24Z")
Is there anyone here who tried to get the logs of powercfg /batteryreport? --- ## [Cann't use custom fields as a condition to drop fields](https://discuss.elastic.co/t/cannt-use-custom-fields-as-a-condition-to-drop-fields/94304)
**Author:** [@Yaohua](https://discuss.elastic.co/u/Yaohua)\ **Replies:** 2\ **Last updated:** [July 25, 2017, 1:49am UTC](https://discuss.elastic.co/t/cannt-use-custom-fields-as-a-condition-to-drop-fields/94304 "2017-07-25T01:49:43Z")
This is my config filebeat.prospectors: - input\_type: log paths: - /var/log/xaa fields: Host: ${HOSTNAME} fields\_under\_root: true document\_type: nginx tags: test exclude\_lines: \['GET / HTTP/1.1"'\] pr… --- ## [Custom fields are empty](https://discuss.elastic.co/t/custom-fields-are-empty/94171)
**Author:** [@Justin.DynamicD](https://discuss.elastic.co/u/Justin.DynamicD)\ **Replies:** 12\ **Last updated:** [July 24, 2017, 11:16pm UTC](https://discuss.elastic.co/t/custom-fields-are-empty/94171 "2017-07-24T23:16:22Z")
Testing the functionality of using custom fields in order to better sort data for users, but I'v not been able to get it to work properly. In my test case, I have a simple Ubuntu client with metricbeat installed locall… --- ## [Beats input documentation/specification](https://discuss.elastic.co/t/beats-input-documentation-specification/94397)
**Author:** [@fmhwong](https://discuss.elastic.co/u/fmhwong)\ **Replies:** 0\ **Last updated:** [July 24, 2017, 9:42pm UTC](https://discuss.elastic.co/t/beats-input-documentation-specification/94397 "2017-07-24T21:42:36Z")
I am trying to see if it is possible to develop a Java client which sends events to the Logstash's beats input. Where can I find the specification or documentation of the beats input? --- ## [Filebeat stops sending logs](https://discuss.elastic.co/t/filebeat-stops-sending-logs/93914)
**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\ **Replies:** 7\ **Last updated:** [July 24, 2017, 5:13pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs/93914 "2017-07-24T17:13:11Z")
Hi , I have elastic search, logstash, kibana installed and configured on a single server and filebeat installed on another. After configuring filebeat when i start filebeat it gets started, and one can see logs comin… --- ## [How to read json file using filebeat and send it to elasticsearch](https://discuss.elastic.co/t/how-to-read-json-file-using-filebeat-and-send-it-to-elasticsearch/91802)
**Author:** [@aditya\_b](https://discuss.elastic.co/u/aditya_b)\ **Replies:** 27\ **Last updated:** [July 24, 2017, 2:56pm UTC](https://discuss.elastic.co/t/how-to-read-json-file-using-filebeat-and-send-it-to-elasticsearch/91802 "2017-07-24T14:56:05Z")
How to read json file using filebeat and send it to elasticsearch. --- ## [Apache config](https://discuss.elastic.co/t/apache-config/93410)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 3\ **Last updated:** [July 24, 2017, 12:52pm UTC](https://discuss.elastic.co/t/apache-config/93410 "2017-07-24T12:52:43Z")
Hi, i have apache log string like this apache www.wol.it.access\_log\_ip-10-0-6-24\_i-060f9005e487ea3 15.28.95.25, 10.0.7.17, 10.0.7.17 - - \[17/Jul/2017:10:29:53 +0200\] "GET /privat/mobile/assist/?source=600000&ns=0&gclid… --- ## [Want FIleBeat client IP not hostname](https://discuss.elastic.co/t/want-filebeat-client-ip-not-hostname/93957)
**Author:** [@hasan\_sharekhan](https://discuss.elastic.co/u/hasan_sharekhan)\ **Replies:** 7\ **Last updated:** [July 24, 2017, 1:28pm UTC](https://discuss.elastic.co/t/want-filebeat-client-ip-not-hostname/93957 "2017-07-24T13:28:01Z")
I am reading logs from FIleBeat \> Logstash \> ElasticSearch I am only able to capture FileBeat client systems hostname, but I want IP address not hostname. Unable to find working solution in this forum and internet. P… --- ## [Filebeat not reading log](https://discuss.elastic.co/t/filebeat-not-reading-log/94198)
**Author:** [@Aman\_Wadhwa](https://discuss.elastic.co/u/Aman_Wadhwa)\ **Replies:** 1\ **Last updated:** [July 24, 2017, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-log/94198 "2017-07-24T13:14:22Z")
I am facing an strange issue where filebeat is not able to read a log file (basically it just do nothing) and unable to send to logstash: Log: \[{"Client IP":"122.180.180.80","API ID":"25209983","API Name":"placeholder","… --- ## [Unable to download kibana dashboard](https://discuss.elastic.co/t/unable-to-download-kibana-dashboard/93381)
**Author:** [@SFace](https://discuss.elastic.co/u/SFace)\ **Replies:** 9\ **Last updated:** [July 24, 2017, 1:11pm UTC](https://discuss.elastic.co/t/unable-to-download-kibana-dashboard/93381 "2017-07-24T13:11:11Z")
Hi im having issues in setting up winlogbeats, i cant seem to get past the point ( currently following official logstash tutorial) of installing the kibana dash board whenever i run this command: scripts\\import\_das… --- ## [ELK 5.5 : Winlogbeats no Messages displayed form ForwardedEvents](https://discuss.elastic.co/t/elk-5-5-winlogbeats-no-messages-displayed-form-forwardedevents/93170)
**Author:** [@prott8gf](https://discuss.elastic.co/u/prott8gf)\ **Replies:** 6\ **Last updated:** [July 24, 2017, 1:08pm UTC](https://discuss.elastic.co/t/elk-5-5-winlogbeats-no-messages-displayed-form-forwardedevents/93170 "2017-07-24T13:08:44Z")
Hi, I cannot see any messages of ForwardedEvents (WinlogBeats 5.5) in the WebUI. Setup: Many Remote Servers \<-\> Windows Log Subscription \<-\> One Windows Server Log Collector (Winlogbeats) \<-\> ELK Stak Server Messa… --- ## [Filebeat custom module is not parsing logs correctly](https://discuss.elastic.co/t/filebeat-custom-module-is-not-parsing-logs-correctly/93902)
**Author:** [@stack\_overflow](https://discuss.elastic.co/u/stack_overflow)\ **Replies:** 1\ **Last updated:** [July 24, 2017, 12:43pm UTC](https://discuss.elastic.co/t/filebeat-custom-module-is-not-parsing-logs-correctly/93902 "2017-07-24T12:43:27Z")
Hey I created a custom module in filebeat module directory for glassfish server logs, I could not use command make create-fileset to create a fileset in my windows, I was getting error. So I just updated apache2 folde… --- ## [Jolokia module enabled by default?](https://discuss.elastic.co/t/jolokia-module-enabled-by-default/94155)
**Author:** [@godefroi](https://discuss.elastic.co/u/godefroi)\ **Replies:** 3\ **Last updated:** [July 24, 2017, 12:37pm UTC](https://discuss.elastic.co/t/jolokia-module-enabled-by-default/94155 "2017-07-24T12:37:38Z")
Having just installed Metricbeat, using nearly exactly the default config file, I was surprised to see error messages show up in Elasticsearch that mention the Jolokia module. It's definitely not enabled in my configfile… --- ## [SIP Integration](https://discuss.elastic.co/t/sip-integration/94324)
**Author:** [@luis.carvalho](https://discuss.elastic.co/u/luis.carvalho)\ **Replies:** 1\ **Last updated:** [July 24, 2017, 12:20pm UTC](https://discuss.elastic.co/t/sip-integration/94324 "2017-07-24T12:20:48Z")
Hi! I have a pcaps SIP source that i would like to index on Elasticsearch. Does anyone knows what is the best way to do it? Anyone knows when we have sip protocol support for packetbeat? Thanks, LC --- ## [How to add multiple host](https://discuss.elastic.co/t/how-to-add-multiple-host/94087)
**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\ **Replies:** 3\ **Last updated:** [July 24, 2017, 7:37am UTC](https://discuss.elastic.co/t/how-to-add-multiple-host/94087 "2017-07-24T07:37:54Z")
I have a filebeat installed on server and topbeat on another, and i want to see the filebeat log in topbeat dashboard. (what changes should be done in topbeat .yml) ?? --- ## [Cannot use env variables in filebeat!](https://discuss.elastic.co/t/cannot-use-env-variables-in-filebeat/94270)
**Author:** [@Yaohua](https://discuss.elastic.co/u/Yaohua)\ **Replies:** 1\ **Last updated:** [July 24, 2017, 5:40am UTC](https://discuss.elastic.co/t/cannot-use-env-variables-in-filebeat/94270 "2017-07-24T05:40:40Z")
My filebeat version is 5.5.0 and OS is CentOS7 ###The config as following: filebeat.prospectors: - input\_type: log paths: - /var/log/xaa fields: docker: ${HOSTNAME} fields\_under\_root: true document\_type… --- ## [Installing filebeat in multiple users question](https://discuss.elastic.co/t/installing-filebeat-in-multiple-users-question/94212)
**Author:** [@patrickian](https://discuss.elastic.co/u/patrickian)\ **Replies:** 1\ **Last updated:** [July 23, 2017, 12:51am UTC](https://discuss.elastic.co/t/installing-filebeat-in-multiple-users-question/94212 "2017-07-23T00:51:19Z")
This is more of a question rather than an issue. I'm installing filebeat in multiple PCs. Here are the steps I follow: 1.) Copy the filebeat directory to the C drive. 2.) Open Powershell as administrator. 3.) Install … --- ## [How to pass custom filebeat.yml to docker.elastic.co/beats/filebeat?](https://discuss.elastic.co/t/how-to-pass-custom-filebeat-yml-to-docker-elastic-co-beats-filebeat/94140)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 1\ **Last updated:** [July 21, 2017, 5:52pm UTC](https://discuss.elastic.co/t/how-to-pass-custom-filebeat-yml-to-docker-elastic-co-beats-filebeat/94140 "2017-07-21T17:52:20Z")
Can someone share steps to pass custom filebeat.yml to filebeat docker ? Inside docker I see config in /usr/share/filebeat/filebeat.yml. I plan to volume mount the logs directory from host. Do I have to do the same… --- ## [Filebeat reading file even after not mentioning it in filebeat.yml](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 9\ **Last updated:** [July 21, 2017, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098 "2017-07-21T14:23:19Z")
Hello, I have a file which is not mentioned in the filebeat.yml but i can still see that opened by filebeat in lsof -c filebeat output. anyone any idea about what is happening here?? Thanks, Nitin --- ## [Filebeat -\> Logstash :connection reset by peer](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/94117)
**Author:** [@yeruvass](https://discuss.elastic.co/u/yeruvass)\ **Replies:** 1\ **Last updated:** [July 21, 2017, 2:20pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer/94117 "2017-07-21T14:20:31Z")
I'm shipping logs from filebeat to logstash with tls and getting below error and tried lot of ways to resolve but helpless. 2017-07-21T18:24:27+05:30 ERR Failed to publish events caused by: read tcp 10.197.53.179:41349… --- ## [Inject extra fields into metricbeat stats](https://discuss.elastic.co/t/inject-extra-fields-into-metricbeat-stats/93917)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 4\ **Last updated:** [July 21, 2017, 9:21am UTC](https://discuss.elastic.co/t/inject-extra-fields-into-metricbeat-stats/93917 "2017-07-21T09:21:59Z")
Hi Elastic Team, I've been reading about creating a beat and creating metricsets for metricbeat but would like your advise on creating extra fields. What I would like to do is to add one extra field such as datacente… --- ## [Running filebeat as a binary, got log ERR on invalid config file](https://discuss.elastic.co/t/running-filebeat-as-a-binary-got-log-err-on-invalid-config-file/92737)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 6\ **Last updated:** [July 21, 2017, 12:27am UTC](https://discuss.elastic.co/t/running-filebeat-as-a-binary-got-log-err-on-invalid-config-file/92737 "2017-07-21T00:27:26Z")
Hello, I am trying to package and run filebeat as a self-contained binary, as opposed to running it as system service: "sudo /etc/init.d/filebeat start" I supplied various path parameters in command line when running … --- ## [Metricbeat vs Telegraf](https://discuss.elastic.co/t/metricbeat-vs-telegraf/93365)
**Author:** [@mahadevaprasadap](https://discuss.elastic.co/u/mahadevaprasadap)\ **Replies:** 6\ **Last updated:** [July 20, 2017, 9:20pm UTC](https://discuss.elastic.co/t/metricbeat-vs-telegraf/93365 "2017-07-20T21:20:32Z")
I have a requirement to collect system and application metrics from servers. But before that any one please let me know Metricbeat vs Telegraf to understand better. --- ## [Filebeats filters under load](https://discuss.elastic.co/t/filebeats-filters-under-load/93825)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 2\ **Last updated:** [July 20, 2017, 12:52pm UTC](https://discuss.elastic.co/t/filebeats-filters-under-load/93825 "2017-07-20T12:52:29Z")
Hi there! It's me again! Running into some inexplicable behaviour. I am deployed a filebeater, and it spammed millions of messages up to the Kibana server. I identified some garbage lines, and added "exclude\_lines:"… --- ## [Issues with multiline](https://discuss.elastic.co/t/issues-with-multiline/93355)
**Author:** [@Ron\_Sevet](https://discuss.elastic.co/u/Ron_Sevet)\ **Replies:** 5\ **Last updated:** [July 20, 2017, 6:23am UTC](https://discuss.elastic.co/t/issues-with-multiline/93355 "2017-07-20T06:23:51Z")
Hi, I'm trying to use multiline on filebeat, here is the config - filebeat.prospectors: - input\_type: log paths: #- /var/log/\*.log - c:\\inetpub\\logs\\LogFiles\\W3SVC161606440\\\* document\_type: iis-il2 - i… --- ## [How to install filebeat as a service and start it everytime windows start?](https://discuss.elastic.co/t/how-to-install-filebeat-as-a-service-and-start-it-everytime-windows-start/93777)
**Author:** [@patrickian](https://discuss.elastic.co/u/patrickian)\ **Replies:** 4\ **Last updated:** [July 20, 2017, 1:16am UTC](https://discuss.elastic.co/t/how-to-install-filebeat-as-a-service-and-start-it-everytime-windows-start/93777 "2017-07-20T01:16:26Z")
I'm installing filebeat in client PCs and basically, I don't want them seeing what filebeat does. I want to install it as a service in windows, run it everytime their machine starts and read from a defined directory (not… --- ## [Does the Final Flow log aggregate the previous (non-final) flow logs?](https://discuss.elastic.co/t/does-the-final-flow-log-aggregate-the-previous-non-final-flow-logs/93797)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 3\ **Last updated:** [July 19, 2017, 9:40pm UTC](https://discuss.elastic.co/t/does-the-final-flow-log-aggregate-the-previous-non-final-flow-logs/93797 "2017-07-19T21:40:49Z")
Hi, I'm looking to get clarification on what my flow logs are telling me. For a given request, I'd like to know the total number of bytes that have been sent and received by that request. Currently, I have my period c… --- ## [Filebeat and topbeat custimze filed](https://discuss.elastic.co/t/filebeat-and-topbeat-custimze-filed/93788)
**Author:** [@pravej](https://discuss.elastic.co/u/pravej)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 9:14pm UTC](https://discuss.elastic.co/t/filebeat-and-topbeat-custimze-filed/93788 "2017-07-19T21:14:58Z")
Hi, I have to set same field both topbeat and filebeat configration file for global setting please tell me if any setting. --- ## [Improve readability of Exclude\_lines:](https://discuss.elastic.co/t/improve-readability-of-exclude-lines/93819)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 7:07pm UTC](https://discuss.elastic.co/t/improve-readability-of-exclude-lines/93819 "2017-07-19T19:07:58Z")
Ok, Iffen I want to exclude me some lines, I do it thusly: exclude\_lines: \["exclude me","and me","and me too"\] This works, but I have some long strings In need to exclude, and it makes it tough to read. When set… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=509) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=511)