# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=511 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 512 --- ## [Can packetbeat send pcap to http end point?](https://discuss.elastic.co/t/can-packetbeat-send-pcap-to-http-end-point/93191)
**Author:** [@sandman](https://discuss.elastic.co/u/sandman)\ **Replies:** 6\ **Last updated:** [July 19, 2017, 6:03pm UTC](https://discuss.elastic.co/t/can-packetbeat-send-pcap-to-http-end-point/93191 "2017-07-19T18:03:31Z")
My use case in short: I want to run packetbeat on one of my servers and pipe the pcap directly into snort. How can this be done? Details: I want to use packetbeat to just capture packets as they are (I dont care mu… --- ## [Filter Total time a user Logged in ( Log on to Log Off time ) to RDP of Windows Server](https://discuss.elastic.co/t/filter-total-time-a-user-logged-in-log-on-to-log-off-time-to-rdp-of-windows-server/93139)
**Author:** [@amarjeetxc](https://discuss.elastic.co/u/amarjeetxc)\ **Replies:** 5\ **Last updated:** [July 19, 2017, 4:11pm UTC](https://discuss.elastic.co/t/filter-total-time-a-user-logged-in-log-on-to-log-off-time-to-rdp-of-windows-server/93139 "2017-07-19T16:11:52Z")
I want to know the total time a user logged in to Windows Server i.e. user log on to log off in a Data Table. I am using the following configurations in Logstash : input { beats { port =\> 5044 } } filter { if \[ty… --- ## [How to load the old data (such as MySQL slow sql log) by filebeat?](https://discuss.elastic.co/t/how-to-load-the-old-data-such-as-mysql-slow-sql-log-by-filebeat/93786)
**Author:** [@Steven\_Li](https://discuss.elastic.co/u/Steven_Li)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 2:29pm UTC](https://discuss.elastic.co/t/how-to-load-the-old-data-such-as-mysql-slow-sql-log-by-filebeat/93786 "2017-07-19T14:29:07Z")
For confirmed bugs, please report: Version: 5.3.0 Operating System: CentOS Steps to Reproduce: Now, only the logs after 09:07(time) can be sent to Logstash, then persisted to Elasticsearch. Others before the date can't… --- ## [Filebeat, SMTP headers, and multiline flush\_pattern (filebeat 6 beta 1)](https://discuss.elastic.co/t/filebeat-smtp-headers-and-multiline-flush-pattern-filebeat-6-beta-1/93508)
**Author:** [@bjorn](https://discuss.elastic.co/u/bjorn)\ **Replies:** 4\ **Last updated:** [July 19, 2017, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-smtp-headers-and-multiline-flush-pattern-filebeat-6-beta-1/93508 "2017-07-19T14:04:18Z")
I'd like to extract the SMTP headers from my honeypot's logs, using multiline. I was hoping to be able to carve out the headers only, using flush\_pattern. Below is an example email: From user@example.com Tue Jul 18 00… --- ## [Filebeat: Select index based on prospector](https://discuss.elastic.co/t/filebeat-select-index-based-on-prospector/93691)
**Author:** [@Brian\_Topping](https://discuss.elastic.co/u/Brian_Topping)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-select-index-based-on-prospector/93691 "2017-07-19T13:59:48Z")
I am trying to find the best way to set the index name based on the prospector that picked up the log entry. In general, I would like everything to default to index, then use indices for the specific changes as outlined … --- ## [How to check the filebeat logs](https://discuss.elastic.co/t/how-to-check-the-filebeat-logs/93132)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 2\ **Last updated:** [July 19, 2017, 1:52am UTC](https://discuss.elastic.co/t/how-to-check-the-filebeat-logs/93132 "2017-07-19T01:52:30Z")
How will I know if I the filebeat already started without errors and ready to ship data logs to logstash? I check the services, and the filebeat is currently running. I also check the logs in C:/ProgramData/filebeat/re… --- ## [Issue with 32bit Counter Metricbeat 5.5 and 5.4.3 for Windows](https://discuss.elastic.co/t/issue-with-32bit-counter-metricbeat-5-5-and-5-4-3-for-windows/93473)
**Author:** [@FrankS](https://discuss.elastic.co/u/FrankS)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 1:15am UTC](https://discuss.elastic.co/t/issue-with-32bit-counter-metricbeat-5-5-and-5-4-3-for-windows/93473 "2017-07-19T01:15:05Z")
Hi, I have some systems running server2012r2. I installed Metricbeat 5.5 to monitor the network traffic with this counter: System.network.in.bytes System.network.out.bytes After 4GBytes of traffic the counter Startes a… --- ## [Import cycle not allowed when trying to make "protologbeat"](https://discuss.elastic.co/t/import-cycle-not-allowed-when-trying-to-make-protologbeat/93583)
**Author:** [@4mine](https://discuss.elastic.co/u/4mine)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 12:32am UTC](https://discuss.elastic.co/t/import-cycle-not-allowed-when-trying-to-make-protologbeat/93583 "2017-07-19T00:32:36Z")
Hello, when I'm trying to make protologbeat, I get these errors: vendor/github.com/elastic/beats/libbeat/scripts/Makefile:89: warning: overriding commands for target libbeat' vendor/github.com/elastic/beats/libbeat/scr… --- ## [Initial Configuration](https://discuss.elastic.co/t/initial-configuration/93653)
**Author:** [@viralblack](https://discuss.elastic.co/u/viralblack)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 11:21pm UTC](https://discuss.elastic.co/t/initial-configuration/93653 "2017-07-18T23:21:55Z")
Well, everything else seems to be configured correctly from what I can tell. Now this is repeating in the winlogbeat log 2017-07-18T14:38:21-04:00 ERR Failed to publish events caused by: EOF 2017-07-18T14:38:21-04:00 I… --- ## [Interpreting Filebeat INFO logs](https://discuss.elastic.co/t/interpreting-filebeat-info-logs/93589)
**Author:** [@hding](https://discuss.elastic.co/u/hding)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 9:33pm UTC](https://discuss.elastic.co/t/interpreting-filebeat-info-logs/93589 "2017-07-18T21:33:36Z")
I'm trying to understand the following Filebeat INFO log: INFO Non-zero metrics in the last 30s: filebeat.harvester.closed=2 filebeat.harvester.open\_files=-1 filebeat.harvester.running=-2 libbeat.es.call\_count.PublishE… --- ## [Can someone suggest tips for debugging Redis traffic listening?](https://discuss.elastic.co/t/can-someone-suggest-tips-for-debugging-redis-traffic-listening/93197)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 5\ **Last updated:** [July 18, 2017, 7:47pm UTC](https://discuss.elastic.co/t/can-someone-suggest-tips-for-debugging-redis-traffic-listening/93197 "2017-07-18T19:47:47Z")
I'm testing packetbeat on an Azure Cloud Instance VM (Running Windows Server 2012 r2) . I have it configured to output dns, http, memcache, redis, and flow. It outputs to a logstash instance. So far, when I search in k… --- ## [Pushing logfiles to logstash](https://discuss.elastic.co/t/pushing-logfiles-to-logstash/93637)
**Author:** [@kg162](https://discuss.elastic.co/u/kg162)\ **Replies:** 0\ **Last updated:** [July 18, 2017, 5:24pm UTC](https://discuss.elastic.co/t/pushing-logfiles-to-logstash/93637 "2017-07-18T17:24:19Z")
To my understanding, filebeat finds logfiles from applications then sends to logstash. But is there a way to send logfiles directly to logstash or through filebeat because it seems to complicated with many different appl… --- ## [No connection could be made because the target machine actively refused filebeat](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 14\ **Last updated:** [July 18, 2017, 6:20am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-filebeat/93152 "2017-07-18T06:20:10Z")
After starting file filebeat I encountered an error in the filebeat log file which is the "No connection could be made because the target machine actively refused it" --- ## [Metric beat jolokia module cannot read attribute "Value"](https://discuss.elastic.co/t/metric-beat-jolokia-module-cannot-read-attribute-value/92190)
**Author:** [@hacktopia](https://discuss.elastic.co/u/hacktopia)\ **Replies:** 4\ **Last updated:** [July 18, 2017, 6:17am UTC](https://discuss.elastic.co/t/metric-beat-jolokia-module-cannot-read-attribute-value/92190 "2017-07-18T06:17:49Z")
Jolokia agent version: "1.3.6" METRICBEAT\_VERSION=6.0.0-alpha1 I get the following error message while trying to read kafka jmx metric from jolokia Error: "message": "1 error: No key found for metric: 'kafka.controll… --- ## [Metricbeat multiple metricsets configuration issue](https://discuss.elastic.co/t/metricbeat-multiple-metricsets-configuration-issue/93208)
**Author:** [@atharva07](https://discuss.elastic.co/u/atharva07)\ **Replies:** 4\ **Last updated:** [July 18, 2017, 5:04am UTC](https://discuss.elastic.co/t/metricbeat-multiple-metricsets-configuration-issue/93208 "2017-07-18T05:04:42Z")
Hi , We have configured metricbeats to montior our local system CPU,memory and disk space usage,the following is my metricbeat.yml file content: metricbeat.modules: module: system metricsets: CPU stats cpu #… --- ## [Filebeat perf benchmark numbers](https://discuss.elastic.co/t/filebeat-perf-benchmark-numbers/93247)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 2:02am UTC](https://discuss.elastic.co/t/filebeat-perf-benchmark-numbers/93247 "2017-07-18T02:02:16Z")
I am looking for Filebeat performance benchmark numbers and how it compares other shippers like FluentD. Any pointers would help. --- ## [Run Filebeat as either service in UNIX or Background Job](https://discuss.elastic.co/t/run-filebeat-as-either-service-in-unix-or-background-job/93314)
**Author:** [@Laker99](https://discuss.elastic.co/u/Laker99)\ **Replies:** 5\ **Last updated:** [July 17, 2017, 11:59pm UTC](https://discuss.elastic.co/t/run-filebeat-as-either-service-in-unix-or-background-job/93314 "2017-07-17T23:59:09Z")
Hello All, Good day :slight\_smile: Hope you're doing fine. May I please take a few minutes of your time? Q. How can I start Filebeat in background mode? Here's what I'm dealing with, filebeat installed in /home//file… --- ## [Weblogic access log lines being merged into a single event/message](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242)
**Author:** [@flasantos19](https://discuss.elastic.co/u/flasantos19)\ **Replies:** 3\ **Last updated:** [July 17, 2017, 11:18pm UTC](https://discuss.elastic.co/t/weblogic-access-log-lines-being-merged-into-a-single-event-message/93242 "2017-07-17T23:18:00Z")
Hello guys, i'm new to ELK Stack and i am having some troubles trying to parse weblogic access log files. In short, my problem is: log sample i need to parse (2 different events): 10.153.236.90 - 2017-07-14 - 16:48:14 … --- ## [Failed to upload data in Elasticsearch](https://discuss.elastic.co/t/failed-to-upload-data-in-elasticsearch/92794)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 7\ **Last updated:** [July 17, 2017, 11:11pm UTC](https://discuss.elastic.co/t/failed-to-upload-data-in-elasticsearch/92794 "2017-07-17T23:11:00Z")
Hi, i have this responds when i start filebeat. metrics.go:34: INFO No non-zero metrics in the last 30s metrics.go:34: INFO No non-zero metrics in the last 30s metrics.go:34: INFO No non-zero metrics in the last 30s … --- ## [New Beat or Metricbeat Module](https://discuss.elastic.co/t/new-beat-or-metricbeat-module/93176)
**Author:** [@berfinsari](https://discuss.elastic.co/u/berfinsari)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 11:00pm UTC](https://discuss.elastic.co/t/new-beat-or-metricbeat-module/93176 "2017-07-17T23:00:22Z")
Hi, I'm interested in beat for a while. I want to create a beat or module for etcd. I can't decide to create a beat or module. I'm doing an internship and, i will work this 2-3 months. Which one would you recommend? --- ## [MetricBeat TLS issue](https://discuss.elastic.co/t/metricbeat-tls-issue/93180)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 10:57pm UTC](https://discuss.elastic.co/t/metricbeat-tls-issue/93180 "2017-07-17T22:57:29Z")
Hi All, we configured a logstash instance to reach all the messages from some metricbeat instance with TLS 1.2 and a self signed certicate. The configuration is: input { beats { port =\> 5044 ssl =\> "true" … --- ## [How to find latency/time taken to display the URL using heartbeat](https://discuss.elastic.co/t/how-to-find-latency-time-taken-to-display-the-url-using-heartbeat/93007)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 4\ **Last updated:** [July 17, 2017, 10:54pm UTC](https://discuss.elastic.co/t/how-to-find-latency-time-taken-to-display-the-url-using-heartbeat/93007 "2017-07-17T22:54:31Z")
I have heartbeat to get the URL status in kibana. Also, I am trying to display the time it takes to load the web page in the browser/client from web server. In the curl command, there is an field "time\_total" by which we… --- ## [Could not test configuration of filebeat](https://discuss.elastic.co/t/could-not-test-configuration-of-filebeat/93159)
**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 10:53pm UTC](https://discuss.elastic.co/t/could-not-test-configuration-of-filebeat/93159 "2017-07-17T22:53:25Z")
after installing filebeat and configuring the file filebeat.yml to specify the host IP .I tried to test its configuration . after specifying the location of the installation of filebeat , i run this command to tst its co… --- ## [System uptime?](https://discuss.elastic.co/t/system-uptime/92966)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 0\ **Last updated:** [July 13, 2017, 8:47am UTC](https://discuss.elastic.co/t/system-uptime/92966 "2017-07-13T08:47:46Z")
I'm looking at replicating the functionality of a legacy monitoring system, and Metricbeat appears to collect most of the data I need, with one thing missing being system uptime. (Which is used to generate alarms if it's… --- ## [Metricbeat 5.5 at Win Server 2008 fails to send data to elasticsearch 5.5](https://discuss.elastic.co/t/metricbeat-5-5-at-win-server-2008-fails-to-send-data-to-elasticsearch-5-5/92944)
**Author:** [@jantoth](https://discuss.elastic.co/u/jantoth)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 4:34pm UTC](https://discuss.elastic.co/t/metricbeat-5-5-at-win-server-2008-fails-to-send-data-to-elasticsearch-5-5/92944 "2017-07-17T16:34:20Z")
Hello all, my problem is rather straightforward: I have spend more than one day investigating this issue. I have several linux servers set up with an exact configuration and I set it up literally in few minutes howe… --- ## [Jolokia jmx Mbean collection](https://discuss.elastic.co/t/jolokia-jmx-mbean-collection/91442)
**Author:** [@flowe](https://discuss.elastic.co/u/flowe)\ **Replies:** 10\ **Last updated:** [July 17, 2017, 2:45pm UTC](https://discuss.elastic.co/t/jolokia-jmx-mbean-collection/91442 "2017-07-17T14:45:00Z")
Hi there, I'm trying to parse jmx mbean properties using jolokia module with metricbeat but have problems when having multiple datasource mbean entries (no problem when having one unique entry). metricbeat 5.4.3 logst… --- ## [Filebeat multiline](https://discuss.elastic.co/t/filebeat-multiline/93326)
**Author:** [@ahongyun](https://discuss.elastic.co/u/ahongyun)\ **Replies:** 2\ **Last updated:** [July 17, 2017, 9:52am UTC](https://discuss.elastic.co/t/filebeat-multiline/93326 "2017-07-17T09:52:03Z")
Hi all, i have the following log file Start time Wednesday, July 12, 2017 07:34:19 PM SGT by murex File descriptors raised to 16384 for current cmd. Java option used : -d64 -showversion -Djavax.xml.stream.XMLEve… --- ## [Metricbeat bug: UTC timestamp in @timestamp and local date in \_index](https://discuss.elastic.co/t/metricbeat-bug-utc-timestamp-in-timestamp-and-local-date-in--index/90489)
**Author:** [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\ **Replies:** 11\ **Last updated:** [July 17, 2017, 2:57am UTC](https://discuss.elastic.co/t/metricbeat-bug-utc-timestamp-in-timestamp-and-local-date-in--index/90489 "2017-07-17T02:57:11Z")
Unlike Filebeat, Metricbeat uses UTC timestamp in @timestamp field and local date in \_index. That causes the records to go into the wrong index with Elasticsearch output. See \_index and @timestamp fields below: { "… --- ## [Issue with filebeat sending data to logstash](https://discuss.elastic.co/t/issue-with-filebeat-sending-data-to-logstash/93295)
**Author:** [@Raghunandan\_Sk](https://discuss.elastic.co/u/Raghunandan_Sk)\ **Replies:** 1\ **Last updated:** [July 16, 2017, 12:30pm UTC](https://discuss.elastic.co/t/issue-with-filebeat-sending-data-to-logstash/93295 "2017-07-16T12:30:05Z")
I have setup the filebeat to send logs to logstash . When I first started the filebeat it sent the data which I could see in kibana. (Data from filebeat to logstash to elasticsearch then to kibana) . But when when I stop… --- ## [@timestamp doesn't match with my computer times](https://discuss.elastic.co/t/timestamp-doesnt-match-with-my-computer-times/92797)
**Author:** [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\ **Replies:** 3\ **Last updated:** [July 15, 2017, 7:10pm UTC](https://discuss.elastic.co/t/timestamp-doesnt-match-with-my-computer-times/92797 "2017-07-15T19:10:40Z")
Hi, I having a problem with times. because this output doesn't match with my computer times. I used ctx.trigger.scheduled\_time to print times. this output 2017-07-12T11:11:38.878Z and time at my computer 2017-07-… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=510) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=512)