# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=513 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 514 --- ## [Multiple index in elasticsearch from filebeat](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154)
**Author:** [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\ **Replies:** 3\ **Last updated:** [July 7, 2017, 2:26pm UTC](https://discuss.elastic.co/t/multiple-index-in-elasticsearch-from-filebeat/92154 "2017-07-07T14:26:05Z")
Hi , I want to create a two outputs filters in logstash , that depends on the "type" field sent from filebeat: filebeat: prospectors: - paths: - /var/log/app.log … --- ## [WARN Invalid response: Data too small to contain a valid length](https://discuss.elastic.co/t/warn-invalid-response-data-too-small-to-contain-a-valid-length/91654)
**Author:** [@Rajeev\_Singh](https://discuss.elastic.co/u/Rajeev_Singh)\ **Replies:** 7\ **Last updated:** [July 7, 2017, 1:55pm UTC](https://discuss.elastic.co/t/warn-invalid-response-data-too-small-to-contain-a-valid-length/91654 "2017-07-07T13:55:00Z")
WARN Invalid response: Data too small to contain a valid length What could be the cause of this warning as this packetbeat is deployed on a database which is constantly processing --- ## [First level filtering with Filebeat](https://discuss.elastic.co/t/first-level-filtering-with-filebeat/92212)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 2\ **Last updated:** [July 7, 2017, 10:15am UTC](https://discuss.elastic.co/t/first-level-filtering-with-filebeat/92212 "2017-07-07T10:15:17Z")
Hi, Is it possible to use processors and fields from Filebeat modules and write the filtered out events through the output.file module ? I am hoping filebeat should be flexible enough to do this. I don't want to displa… --- ## [Combining multiple beats into a single agent](https://discuss.elastic.co/t/combining-multiple-beats-into-a-single-agent/90194)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 3\ **Last updated:** [July 7, 2017, 4:09am UTC](https://discuss.elastic.co/t/combining-multiple-beats-into-a-single-agent/90194 "2017-07-07T04:09:56Z")
Hi, We have a use case where we need multiple beats like filebeat,metricbeat,execbeat and many other community beats and also we are planning to write our own custom beats for other requirements. But running these many a… --- ## [Metricbeat "system.cpu.user.pct" alert?](https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081)
**Author:** [@Fdsfsddsf\_Sdfsd](https://discuss.elastic.co/u/Fdsfsddsf_Sdfsd)\ **Replies:** 0\ **Last updated:** [July 6, 2017, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081 "2017-07-06T10:48:25Z")
Send Request = { "error": { "root\_cause": \[ { "type": "general\_script\_exception", "reason": "failed to compile script \[ScriptException\[compile error\]; nested: IllegalArgumentException\[unexpec… --- ## [Filebeat 5.4.1 not updating registry when file closed/removed](https://discuss.elastic.co/t/filebeat-5-4-1-not-updating-registry-when-file-closed-removed/91952)
**Author:** [@Sean1e](https://discuss.elastic.co/u/Sean1e)\ **Replies:** 2\ **Last updated:** [July 6, 2017, 11:18am UTC](https://discuss.elastic.co/t/filebeat-5-4-1-not-updating-registry-when-file-closed-removed/91952 "2017-07-06T11:18:06Z")
Hello, I'm running Filebeat & ELK 5.4.1 on CentOS 7. The server where Filebeat runs hosts 2 applications whose logs get rotated weekly. Filebeat is setup to close an inactive file after 7 minutes and to remove a file… --- ## [Next filebeat alpha version](https://discuss.elastic.co/t/next-filebeat-alpha-version/92031)
**Author:** [@shyampr](https://discuss.elastic.co/u/shyampr)\ **Replies:** 2\ **Last updated:** [July 6, 2017, 10:36am UTC](https://discuss.elastic.co/t/next-filebeat-alpha-version/92031 "2017-07-06T10:36:39Z")
We are interested in using the add\_docker\_metadata feature of filebeat, and a new alpha version of filebeat has not been released after that enhancement was added. Just to be clear, the add\_docker\_metadta was added in al… --- ## [Unclear output on incorrect permissions of subdirectory](https://discuss.elastic.co/t/unclear-output-on-incorrect-permissions-of-subdirectory/92053)
**Author:** [@Ricks](https://discuss.elastic.co/u/Ricks)\ **Replies:** 3\ **Last updated:** [July 6, 2017, 9:29am UTC](https://discuss.elastic.co/t/unclear-output-on-incorrect-permissions-of-subdirectory/92053 "2017-07-06T09:29:05Z")
When one uses a subdirectory (e.g. conf.d) for its prospectors, not clear error message will be generated when (group) permissions are incorrect: \[root@host filebeat\]# ls -hal conf.d/ total 8.0K drwxr-xr-x 2 root ro… --- ## [Error with multiline codec](https://discuss.elastic.co/t/error-with-multiline-codec/92005)
**Author:** [@ahongyun](https://discuss.elastic.co/u/ahongyun)\ **Replies:** 2\ **Last updated:** [July 6, 2017, 9:28am UTC](https://discuss.elastic.co/t/error-with-multiline-codec/92005 "2017-07-06T09:28:43Z")
Below is my filebeat yml: --- filebeat.prospectors: ## mxtiming\_server.log ## - document\_type: timing\_server.log paths: - /appdir/logs/traces/timing\_\*\_\*\_\*.log ## launcherma… --- ## [Problem with Multiline pattern in Filebeat](https://discuss.elastic.co/t/problem-with-multiline-pattern-in-filebeat/91762)
**Author:** [@purvang](https://discuss.elastic.co/u/purvang)\ **Replies:** 7\ **Last updated:** [July 6, 2017, 6:44am UTC](https://discuss.elastic.co/t/problem-with-multiline-pattern-in-filebeat/91762 "2017-07-06T06:44:26Z")
Hi Team, I am trying to use multiline pattern in filebeat to append multiline code in specific log Below is my log pattern : 04 Jul 2017 14:47:35,982 \[INFO\] http-bio-48080-exec-6 \[AUTH\]: \[8548c77c-0296-4056-ad… --- ## [Docker fields documentation](https://discuss.elastic.co/t/docker-fields-documentation/91225)
**Author:** [@stickperson](https://discuss.elastic.co/u/stickperson)\ **Replies:** 2\ **Last updated:** [July 6, 2017, 1:15am UTC](https://discuss.elastic.co/t/docker-fields-documentation/91225 "2017-07-06T01:15:57Z")
I just setup metricbeat using the docker module and noticed that docker.memory.usage.pct seemed off by a factor of 100. However, docker.cpu.total.pct is accurate. The docker fields docs don't mention the memory percentag… --- ## [Metricbeat metrics collection process and period/aggregation](https://discuss.elastic.co/t/metricbeat-metrics-collection-process-and-period-aggregation/90855)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 9:21pm UTC](https://discuss.elastic.co/t/metricbeat-metrics-collection-process-and-period-aggregation/90855 "2017-07-05T21:21:04Z")
Hi All, I'm trying to understand something about the metricbeat metrics collection mechanism. My question is if I leave my metricbeat configs at defaults i.e. period set to 10s and outputting to local file, ES or LS,… --- ## [Problem with filebeat](https://discuss.elastic.co/t/problem-with-filebeat/91589)
**Author:** [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Replies:** 9\ **Last updated:** [July 5, 2017, 7:38pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589 "2017-07-05T19:38:39Z")
Hi, I followed this tutorial "https://www.elastic.co/guide/en/beats/filebeat/5.4/filebeat-getting-started.html" step by step, but Kibana shows me 0 hits and No results found. --- ## [Unable to use sub-fields of event\_data](https://discuss.elastic.co/t/unable-to-use-sub-fields-of-event-data/91480)
**Author:** [@ccampbell](https://discuss.elastic.co/u/ccampbell)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 6:37pm UTC](https://discuss.elastic.co/t/unable-to-use-sub-fields-of-event-data/91480 "2017-07-05T18:37:14Z")
I'm trying to replicate some of the examples found in this blog piece: But I can't enter sub-fields of event\_data as terms in a Kibana visualization -- To be clear, I can definitely create a filter or perform a sa… --- ## [Deleting source logs after shipping](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496)
**Author:** [@cdnnhicks](https://discuss.elastic.co/u/cdnnhicks)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 5:46pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496 "2017-07-05T17:46:21Z")
Hi, First post here. I've just finished setting up my ELK stack and I've got a number of Windows servers forwarding their System, Application and Security logs. I'm looking to see if there's a way to delete the logs from… --- ## [Volume mapped filebeat.yml permissions from Docker on Windows host](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893)
**Author:** [@NathanBaulch](https://discuss.elastic.co/u/NathanBaulch)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 3:44pm UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893 "2017-07-05T15:44:17Z")
I'm trying to run the official 5.4.3 filebeat docker container via VirtualBox on a Windows host. Rather than creating a custom image, I'm using a volume mapping to pass the filebeat.yml file to the container using the au… --- ## [How can i process the duplication id or custome document\_id on filebeat?](https://discuss.elastic.co/t/how-can-i-process-the-duplication-id-or-custome-document-id-on-filebeat/91845)
**Author:** [@beanslee](https://discuss.elastic.co/u/beanslee)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 2:34pm UTC](https://discuss.elastic.co/t/how-can-i-process-the-duplication-id-or-custome-document-id-on-filebeat/91845 "2017-07-05T14:34:34Z")
in logstash ,i can set document\_id=xxx but in file beat， i can not find the way.... thanks!!!! --- ## [Can the filebeat clients do Kerberos authentication](https://discuss.elastic.co/t/can-the-filebeat-clients-do-kerberos-authentication/91875)
**Author:** [@venky1987](https://discuss.elastic.co/u/venky1987)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 1:57pm UTC](https://discuss.elastic.co/t/can-the-filebeat-clients-do-kerberos-authentication/91875 "2017-07-05T13:57:17Z")
Can the filebeat clients do Kerberos authentication to Kafka brokers? --- ## [Filebeat -getsockopt: connection refused](https://discuss.elastic.co/t/filebeat-getsockopt-connection-refused/91630)
**Author:** [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\ **Replies:** 6\ **Last updated:** [July 5, 2017, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-getsockopt-connection-refused/91630 "2017-07-05T12:26:44Z")
Hi, Here my filebeat.yml filebeat.prospectors: - input\_type: log document\_type: web\_log paths: - /var/log/web.log fields: log\_type: weblog fields\_under\_root: true - input\_type: log document\_type: e… --- ## [Metricbeat Kubernetes Module](https://discuss.elastic.co/t/metricbeat-kubernetes-module/91850)
**Author:** [@sukhada\_sankpal369](https://discuss.elastic.co/u/sukhada_sankpal369)\ **Replies:** 9\ **Last updated:** [July 5, 2017, 10:58am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module/91850 "2017-07-05T10:58:33Z")
My kubernetes node is tls configured. I am tring to use the metricset node, system, pod, container and volume which would be fetched from https://IP\_k8s:10255. It gives me logs saying "error making http request: Get http… --- ## [Filebeat 5.4.2 not processing JSON file](https://discuss.elastic.co/t/filebeat-5-4-2-not-processing-json-file/90700)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 8:10am UTC](https://discuss.elastic.co/t/filebeat-5-4-2-not-processing-json-file/90700 "2017-07-05T08:10:31Z")
Hi, I am trying to process a simple JSON file into Logstash but i see the logstash which is listening at port 5044 is not receiving any data from filebeat. Here is my filebeat config filebeat.prospectors: # Each -… --- ## [Winlogbeat only sending one first Log source out of three](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803)
**Author:** [@x0r](https://discuss.elastic.co/u/x0r)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 8:31pm UTC](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803 "2017-07-04T20:31:52Z")
Hey there everyone, I'm just wondering if anyone has ran into this issue or encountered what I have been struggling with. At this point in time I am using winlogbeat on a Domain Controller running windows 2012 R2 and … --- ## [Filebeat.full.yml Complete](https://discuss.elastic.co/t/filebeat-full-yml-complete/91782)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-full-yml-complete/91782 "2017-07-04T20:19:07Z")
Hi, my ocnfiguration filebeat.yml in like Filebeat.prospectors: -input\_type: log Paths: /mnt/analog/file\_name\_log Output.elasticsearch: hosts: \[“27.49.258.78”\] protocol: “https” when i try to upload log with c… --- ## [Registry file entry is empty](https://discuss.elastic.co/t/registry-file-entry-is-empty/90719)
**Author:** [@punit\_j](https://discuss.elastic.co/u/punit_j)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 10:28am UTC](https://discuss.elastic.co/t/registry-file-entry-is-empty/90719 "2017-07-04T10:28:16Z")
Hi, I am facing an issue in filebeat registry file under windows platform. Registry file under C:\\Program Files\\filebeat\\data\\registry shows empty array \[\]. I dont see this behavior under linux platform. Am I missing … --- ## [Why system.diskio doesn't produce I/O statistics fields like "iostat"](https://discuss.elastic.co/t/why-system-diskio-doesnt-produce-i-o-statistics-fields-like-iostat/91354)
**Author:** [@PChou](https://discuss.elastic.co/u/PChou)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 6:43pm UTC](https://discuss.elastic.co/t/why-system-diskio-doesnt-produce-i-o-statistics-fields-like-iostat/91354 "2017-07-04T18:43:36Z")
The system.diskio just outputs metrics below: { "io": { "time": 4130 }, "name": "vda1", "read": { "bytes": 204800, "count": 36, "time": 960 }, "write": { … --- ## [Настройка Filebeat на старый лог](https://discuss.elastic.co/t/filebeat/91650)
**Author:** [@admyin](https://discuss.elastic.co/u/admyin)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 6:34pm UTC](https://discuss.elastic.co/t/filebeat/91650 "2017-07-04T18:34:36Z")
Добрый день, подскажите пожалуйста, как заставить Filebeat проиндексировать старые события в логе? Спасибо! --- ## [Logstash config to filebeat](https://discuss.elastic.co/t/logstash-config-to-filebeat/91640)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 6:31pm UTC](https://discuss.elastic.co/t/logstash-config-to-filebeat/91640 "2017-07-04T18:31:42Z")
Hi, i want to copy the config find here:: https://github.com/elastic/examples/tree/master/ElasticStack\_apache into filebeat.full.yml. In that url there are three configuration that works fine. where i can copy the apache… --- ## [Is metricbeat preventing a container from being deleted? Some locking issue?](https://discuss.elastic.co/t/is-metricbeat-preventing-a-container-from-being-deleted-some-locking-issue/91236)
**Author:** [@MartinAhrer](https://discuss.elastic.co/u/MartinAhrer)\ **Replies:** 3\ **Last updated:** [July 4, 2017, 10:30am UTC](https://discuss.elastic.co/t/is-metricbeat-preventing-a-container-from-being-deleted-some-locking-issue/91236 "2017-07-04T10:30:48Z")
I have the elastic stack (elasticsearch,logstash,kibana) + filebeat + metricbeat running on a 14.04.5 LTS (GNU/Linux 3.13.0-115-generic x86\_64) host. All elastic software is running in their own Docker container. So I … --- ## [Filebeats behavior when new ES node elected up to Primary](https://discuss.elastic.co/t/filebeats-behavior-when-new-es-node-elected-up-to-primary/91687)
**Author:** [@rachelkelly](https://discuss.elastic.co/u/rachelkelly)\ **Replies:** 3\ **Last updated:** [July 3, 2017, 9:12pm UTC](https://discuss.elastic.co/t/filebeats-behavior-when-new-es-node-elected-up-to-primary/91687 "2017-07-03T21:12:23Z")
Hello, we are very close to the first version of our Elasticsearch, rather a proof of concept. For this basic version I'm trying to do: filebeats (application logs, http logs, /var/log\*) on a handful of servers (total i… --- ## [Feature request on Filebeat](https://discuss.elastic.co/t/feature-request-on-filebeat/88757)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 6\ **Last updated:** [July 3, 2017, 5:04pm UTC](https://discuss.elastic.co/t/feature-request-on-filebeat/88757 "2017-07-03T17:04:42Z")
Dear Filebeat developers, is this the right forum to send my wish-list on Filebeat? I would love to see Filebeat to include more features from logstash. e.g., 1. parse log message, e.g., extract the timestamp, log le… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=512) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=514)