# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=514 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 515 --- ## [Mysql.unmatched\_requests and mysql.unmatched\_response](https://discuss.elastic.co/t/mysql-unmatched-requests-and-mysql-unmatched-response/91652)
**Author:** [@Rajeev\_Singh](https://discuss.elastic.co/u/Rajeev_Singh)\ **Replies:** 0\ **Last updated:** [July 3, 2017, 2:41pm UTC](https://discuss.elastic.co/t/mysql-unmatched-requests-and-mysql-unmatched-response/91652 "2017-07-03T14:41:31Z")
What is the meaning of mysql.unmatched\_requests and mysql.unmatched\_response. I am getting these in every data that is sent to elasticsearch and wondering how can I make the unmatched requests to 0. Any guidance notes … --- ## [Metricbeat add fields in index elasticsearch](https://discuss.elastic.co/t/metricbeat-add-fields-in-index-elasticsearch/91626)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 2:31pm UTC](https://discuss.elastic.co/t/metricbeat-add-fields-in-index-elasticsearch/91626 "2017-07-03T14:31:06Z")
Hello I am using Metricbeat and I want to name each Elasticsearch index specifically so I tried this: elasticsearch { hosts =\> \[ "172.17.0.22:9200" \] index =\> "idx-metric… --- ## [Multiple Logstash output with different SSL signing authorities, certificates and keys](https://discuss.elastic.co/t/multiple-logstash-output-with-different-ssl-signing-authorities-certificates-and-keys/91398)
**Author:** [@Platypus](https://discuss.elastic.co/u/Platypus)\ **Replies:** 3\ **Last updated:** [July 3, 2017, 1:45pm UTC](https://discuss.elastic.co/t/multiple-logstash-output-with-different-ssl-signing-authorities-certificates-and-keys/91398 "2017-07-03T13:45:14Z")
Hello, I need Filebeat to send the same logs to two different logstash endpoints with differents signing authorities, certificates and keys. I have test them separetly and the connexion with both endpoints works fine.… --- ## [Log level of "ERR Failed to publish events caused by: EOF"](https://discuss.elastic.co/t/log-level-of-err-failed-to-publish-events-caused-by-eof/91613)
**Author:** [@Paul\_Seiffert](https://discuss.elastic.co/u/Paul_Seiffert)\ **Replies:** 1\ **Last updated:** [July 3, 2017, 1:42pm UTC](https://discuss.elastic.co/t/log-level-of-err-failed-to-publish-events-caused-by-eof/91613 "2017-07-03T13:42:34Z")
Hi, We run a custom beat based on libbeat to stream logs to logstash and see a lot of log messages like "ERR Failed to publish events caused by: EOF" in the beat's output. I know that these messages occur when a client… --- ## [Schedule not working correctly anymore](https://discuss.elastic.co/t/schedule-not-working-correctly-anymore/91238)
**Author:** [@dosera](https://discuss.elastic.co/u/dosera)\ **Replies:** 4\ **Last updated:** [July 3, 2017, 8:23am UTC](https://discuss.elastic.co/t/schedule-not-working-correctly-anymore/91238 "2017-07-03T08:23:22Z")
Hello, after the most recent update of heartbeat (5.2.0 to 5.4.2), heartbeat apparently sends more than one event per minute, even though it is defined to send one per minute. The last few months, we got 1440 (sometime… --- ## [Beat.name change in Filebeat 5.4](https://discuss.elastic.co/t/beat-name-change-in-filebeat-5-4/91587)
**Author:** [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\ **Replies:** 1\ **Last updated:** [July 3, 2017, 6:00am UTC](https://discuss.elastic.co/t/beat-name-change-in-filebeat-5-4/91587 "2017-07-03T06:00:37Z")
Hi I have installed Filebeat 5.4 on ubuntu server and where multiple logs like web.log, email.log available, need to forward to logstash server (ELK) to see in kibana. Here my filebeat.yml file as below filebeat.pro… --- ## [Does the field "system.cpu.user.pct" represent the server usage? and what are the contributing fields for the same](https://discuss.elastic.co/t/does-the-field-system-cpu-user-pct-represent-the-server-usage-and-what-are-the-contributing-fields-for-the-same/91506)
**Author:** [@prosenjit](https://discuss.elastic.co/u/prosenjit)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 5:25am UTC](https://discuss.elastic.co/t/does-the-field-system-cpu-user-pct-represent-the-server-usage-and-what-are-the-contributing-fields-for-the-same/91506 "2017-07-03T05:25:28Z")
I have implemented ELK stack for logging solutions and aslo set up metricbeat for measuring server performance. I stumbled on system module's "system.cpu.user.pct" which is the system's cpu usage. Now, I need to understa… --- ## [Filebeat panic error while running in Windows based Docker container](https://discuss.elastic.co/t/filebeat-panic-error-while-running-in-windows-based-docker-container/91512)
**Author:** [@pbering](https://discuss.elastic.co/u/pbering)\ **Replies:** 5\ **Last updated:** [July 2, 2017, 6:18pm UTC](https://discuss.elastic.co/t/filebeat-panic-error-while-running-in-windows-based-docker-container/91512 "2017-07-02T18:18:16Z")
Hi, I'm trying to make a Docker container based on "microsoft/nanoserver" to run on my Windows based Docker hosts (in a Swarm). But I can't get Filebeat to work. Observations: Seems related to the the volume mounti… --- ## [PF\_RING on Packetbeat error](https://discuss.elastic.co/t/pf-ring-on-packetbeat-error/91356)
**Author:** [@pgyggi](https://discuss.elastic.co/u/pgyggi)\ **Replies:** 2\ **Last updated:** [July 1, 2017, 8:02am UTC](https://discuss.elastic.co/t/pf-ring-on-packetbeat-error/91356 "2017-07-01T08:02:11Z")
everybody, 1、I want to use PF\_RING for Packetbeat and then install PF\_RING on my CentOS(1161 min),PF\_RING is work. see: \[root@packetbeat packetbeat\]# lsmod |grep pf\_ring pf\_ring 1234205 0 2、 I clone the la… --- ## [Retrieve log line given offset](https://discuss.elastic.co/t/retrieve-log-line-given-offset/91308)
**Author:** [@hding](https://discuss.elastic.co/u/hding)\ **Replies:** 3\ **Last updated:** [June 30, 2017, 8:49pm UTC](https://discuss.elastic.co/t/retrieve-log-line-given-offset/91308 "2017-06-30T20:49:06Z")
Since the size of our log files is huge, I choose not to store the original log lines, but instead store the filepath and the offset of the log line so as to retrieve the log lines later. It says here that "(The expor… --- ## [Mutiline pattern Filebeat](https://discuss.elastic.co/t/mutiline-pattern-filebeat/91277)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 5\ **Last updated:** [June 30, 2017, 12:53pm UTC](https://discuss.elastic.co/t/mutiline-pattern-filebeat/91277 "2017-06-30T12:53:27Z")
Hello EveryOne, I send data with filebeat and I want to use mutiline. Every event start with date like this : 2017-06-12T15:52:56.201\_I\_I\_01de02a1ec3d0b28 \[07:48\] func will be continued(0,0000000001800094) In logs… --- ## [Any documentation of the Prometheus Metricseats?](https://discuss.elastic.co/t/any-documentation-of-the-prometheus-metricseats/91153)
**Author:** [@Grigory\_Shamov](https://discuss.elastic.co/u/Grigory_Shamov)\ **Replies:** 1\ **Last updated:** [June 30, 2017, 8:48am UTC](https://discuss.elastic.co/t/any-documentation-of-the-prometheus-metricseats/91153 "2017-06-30T08:48:24Z")
HI All, Are there any examples and documentation on how to connect Prometheus metrics collectors to Metricbeat? There is some for the Metricbeat side (https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat… --- ## [Filebeat - Multiple server instance configuration](https://discuss.elastic.co/t/filebeat-multiple-server-instance-configuration/90825)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 2\ **Last updated:** [June 30, 2017, 8:30am UTC](https://discuss.elastic.co/t/filebeat-multiple-server-instance-configuration/90825 "2017-06-30T08:30:40Z")
I did configure the Elastic Stack (Logstash + Elastic search + Kibana ) with filebeat. So my question is I have multiple servers where I deployed my application instances (Microservices applications ). I want to capture … --- ## [How to configure my packbeat to write http access information in my index?](https://discuss.elastic.co/t/how-to-configure-my-packbeat-to-write-http-access-information-in-my-index/91199)
**Author:** [@esportuga](https://discuss.elastic.co/u/esportuga)\ **Replies:** 2\ **Last updated:** [June 29, 2017, 8:11pm UTC](https://discuss.elastic.co/t/how-to-configure-my-packbeat-to-write-http-access-information-in-my-index/91199 "2017-06-29T20:11:56Z")
I want to record the access information to websites coming from a pc. I am using packetbeat but the information that is recorded still does not answer me. I believe I'm configuring wrong my packetbeat.yml file --- ## [Unable to start service](https://discuss.elastic.co/t/unable-to-start-service/90506)
**Author:** [@sbach](https://discuss.elastic.co/u/sbach)\ **Replies:** 2\ **Last updated:** [June 29, 2017, 8:06pm UTC](https://discuss.elastic.co/t/unable-to-start-service/90506 "2017-06-29T20:06:53Z")
Have ELK running on CentOS, Linux servers are sending logs as expected. Installed service in Windows Server 16, Config test passed, getting error 1053 when trying to start service. Running winlogbeat in foreground, w… --- ## [Problem with indexes - Logstash dont create filebeat indexes](https://discuss.elastic.co/t/problem-with-indexes-logstash-dont-create-filebeat-indexes/91117)
**Author:** [@rwagner](https://discuss.elastic.co/u/rwagner)\ **Replies:** 4\ **Last updated:** [June 29, 2017, 6:05pm UTC](https://discuss.elastic.co/t/problem-with-indexes-logstash-dont-create-filebeat-indexes/91117 "2017-06-29T18:05:20Z")
I am not able to create indexes using filebeat on windows. Apparently logstash is not even getting the logs. I disabled the firewalld and selinux on the server that is logstash + elasticsearch, I can also see the commu… --- ## [All for custom configurations in docker image](https://discuss.elastic.co/t/all-for-custom-configurations-in-docker-image/90983)
**Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 6\ **Last updated:** [June 29, 2017, 12:30pm UTC](https://discuss.elastic.co/t/all-for-custom-configurations-in-docker-image/90983 "2017-06-29T12:30:43Z")
The current docker image ships with a default configuration file that filebeat uses and with auto-reloading disabled. When using this in practice most folks are going to need a custom configuration file. The completely t… --- ## [ERR Connecting error publishing events (retrying) - help me](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-help-me/91213)
**Author:** [@feelboy](https://discuss.elastic.co/u/feelboy)\ **Replies:** 1\ **Last updated:** [June 29, 2017, 12:07pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-help-me/91213 "2017-06-29T12:07:10Z")
HI. I am getting these error messages and I have the most basic configuration of Logstash/FileBeat. error ERR Connecting error publishing events (retrying): Get http://172.30.17.118:5044: read tcp 172.30.17.118:59086… --- ## [Packetbeat: runtime error: invalid memory address or nil pointer dereference after running for ~16 hours](https://discuss.elastic.co/t/packetbeat-runtime-error-invalid-memory-address-or-nil-pointer-dereference-after-running-for-16-hours/91109)
**Author:** [@salekseev](https://discuss.elastic.co/u/salekseev)\ **Replies:** 1\ **Last updated:** [June 29, 2017, 12:00pm UTC](https://discuss.elastic.co/t/packetbeat-runtime-error-invalid-memory-address-or-nil-pointer-dereference-after-running-for-16-hours/91109 "2017-06-29T12:00:57Z")
Version: 5.4.2 Operating System: 3.8.13-118.14.1.el6uek.x86\_64 2017-06-26T20:31:01-04:00 ERR ParseMemcache(UDP) exception. Recovering, but please report this: runtime error: invalid memory address or nil pointer deref… --- ## [Filbeat tail\_filter Logs 5.4 Version](https://discuss.elastic.co/t/filbeat-tail-filter-logs-5-4-version/90821)
**Author:** [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\ **Replies:** 8\ **Last updated:** [June 29, 2017, 11:45am UTC](https://discuss.elastic.co/t/filbeat-tail-filter-logs-5-4-version/90821 "2017-06-29T11:45:36Z")
Hi, I have installed filebeat on ubuntu and ELK master is also ubuntu. By following Where in my ELK server input.conf input { beats { host =\> "0.0.0.0" port =\> 5443 type =\> weblog #ssl =\> … --- ## [Is Rabbitmq Plugin for Filebeat available?](https://discuss.elastic.co/t/is-rabbitmq-plugin-for-filebeat-available/89843)
**Author:** [@bhupathireddys](https://discuss.elastic.co/u/bhupathireddys)\ **Replies:** 2\ **Last updated:** [June 29, 2017, 7:09am UTC](https://discuss.elastic.co/t/is-rabbitmq-plugin-for-filebeat-available/89843 "2017-06-29T07:09:34Z")
Hello, would like to send my filebeat logs to rabbitmq before it pushes to logstash. Is there any plugin available for the same? Thanks --- ## [Multiline.pattern: '^\\\[\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}' not working](https://discuss.elastic.co/t/multiline-pattern-0-9-4-0-9-2-0-9-2-not-working/91156)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 11\ **Last updated:** [June 29, 2017, 5:42am UTC](https://discuss.elastic.co/t/multiline-pattern-0-9-4-0-9-2-0-9-2-not-working/91156 "2017-06-29T05:42:15Z")
multiline.pattern: '^\\\[\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2}' not working for filebeat . my log lines are starting with \[2017-05-22 00:00:00,007\] :|: INFO :|: lvprdsndlbfe1.lv.jabodo.com :|: :|: :|: :|: :|: … --- ## [Import dashboards sample](https://discuss.elastic.co/t/import-dashboards-sample/90947)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 8\ **Last updated:** [June 29, 2017, 3:32am UTC](https://discuss.elastic.co/t/import-dashboards-sample/90947 "2017-06-29T03:32:44Z")
Hello, After installed Metricbeat on a Windows server, I can get metricbeat logs in my elasticsearch. Now, I want to import Metricbeat dashboards but I am failing with this error : ./import\_dashboards -es "http://loc… --- ## [URGENT: ERR Failed to publish events caused by: write tcp \[::1\]:60383-\>\[::1\]:5044: wsasend: An established connection was aborted by the software in your host machine](https://discuss.elastic.co/t/urgent-err-failed-to-publish-events-caused-by-write-tcp-1-60383-1-5044-wsasend-an-established-connection-was-aborted-by-the-software-in-your-host-machine/89621)
**Author:** [@debashree13](https://discuss.elastic.co/u/debashree13)\ **Replies:** 4\ **Last updated:** [June 28, 2017, 8:39pm UTC](https://discuss.elastic.co/t/urgent-err-failed-to-publish-events-caused-by-write-tcp-1-60383-1-5044-wsasend-an-established-connection-was-aborted-by-the-software-in-your-host-machine/89621 "2017-06-28T20:39:32Z")
Hi team, Please help urgently as we are doing Production deployment this week. I am getting errors in filebeat logs and data is not read and sent to logstash ...my data flow is filebeat-\>logstash-\>elasticsearch ERR Fai… --- ## [ERR SSL client failed to connect (1.x to 5.x upgrade)](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-1-x-to-5-x-upgrade/89603)
**Author:** [@jm\_peterson](https://discuss.elastic.co/u/jm_peterson)\ **Replies:** 6\ **Last updated:** [June 28, 2017, 7:49pm UTC](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-1-x-to-5-x-upgrade/89603 "2017-06-28T19:49:02Z")
I am running into this error. After what appears to be events successfully published to output. 2017/06/15 17:43:43.708785 publish.go:88: INFO Start sending events to output 2017/06/15 17:43:43.708851 log.go:115: INFO … --- ## [Metricbeat using notification to collect data?](https://discuss.elastic.co/t/metricbeat-using-notification-to-collect-data/90882)
**Author:** [@wanjingxu](https://discuss.elastic.co/u/wanjingxu)\ **Replies:** 4\ **Last updated:** [June 28, 2017, 4:42pm UTC](https://discuss.elastic.co/t/metricbeat-using-notification-to-collect-data/90882 "2017-06-28T16:42:13Z")
Right now, metricbeat uses polling to collect data from source, is there a way to use notification-based way? For example, it registers with events from source and in the callback of the event, extract data from event a… --- ## [Two pipelines for the same file](https://discuss.elastic.co/t/two-pipelines-for-the-same-file/90872)
**Author:** [@hding](https://discuss.elastic.co/u/hding)\ **Replies:** 5\ **Last updated:** [June 28, 2017, 12:51pm UTC](https://discuss.elastic.co/t/two-pipelines-for-the-same-file/90872 "2017-06-28T12:51:57Z")
My log file contains log lines of two types: "NORMAL" and "ERROR". Each line starts with its type. The logs are stored in the same directory. I have built two pipelines: "pipeline\_1" and "pipeline\_2". How do I con… --- ## [Kafka offset metrics](https://discuss.elastic.co/t/kafka-offset-metrics/90731)
**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\ **Replies:** 5\ **Last updated:** [June 28, 2017, 10:10am UTC](https://discuss.elastic.co/t/kafka-offset-metrics/90731 "2017-06-28T10:10:24Z")
I am curious if metrics kafka.partition.offset.oldest and kafka.partition.offset.newest are the same as CURRENT-OFFSET and LOG\_END\_OFFSET respectively? From console both CURRENT-OFFSET and LOG\_END\_OFFSET shows the sam… --- ## [Feature Request Flowbeat!](https://discuss.elastic.co/t/feature-request-flowbeat/1957)
**Author:** [@Steve\_Kelley](https://discuss.elastic.co/u/Steve_Kelley)\ **Replies:** 11\ **Last updated:** [June 28, 2017, 5:30am UTC](https://discuss.elastic.co/t/feature-request-flowbeat/1957 "2017-06-28T05:30:01Z")
Love the packet beat analyzer! Is there future plans for analyzing flows? IE: S-Flow, Netflow? --- ## [Kubernetes metadata](https://discuss.elastic.co/t/kubernetes-metadata/90865)
**Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 16\ **Last updated:** [June 28, 2017, 9:39am UTC](https://discuss.elastic.co/t/kubernetes-metadata/90865 "2017-06-28T09:39:03Z")
I'm trying to test the new kubernetes metadata features that were added to beats and therefore would like to pull the docker image for the alpha, but it appears it is not being published. Could it be published please? … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=513) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=515)