# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=516 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 517 --- ## [Limit database connections](https://discuss.elastic.co/t/limit-database-connections/90264)
**Author:** [@Daniel\_DNP](https://discuss.elastic.co/u/Daniel_DNP)\ **Replies:** 1\ **Last updated:** [June 22, 2017, 9:44am UTC](https://discuss.elastic.co/t/limit-database-connections/90264 "2017-06-22T09:44:05Z")
Hello, I'm writing a metricbeat module for Oracle Database (module: oracledb) monitoring. For each metricset (e.g. status, fra, ...) one database connection is opened. I try to reduce the number of connections becaus… --- ## [FIlebeat MapperParsingException](https://discuss.elastic.co/t/filebeat-mapperparsingexception/90329)
**Author:** [@manojkal](https://discuss.elastic.co/u/manojkal)\ **Replies:** 1\ **Last updated:** [June 21, 2017, 5:51pm UTC](https://discuss.elastic.co/t/filebeat-mapperparsingexception/90329 "2017-06-21T17:51:03Z")
WARN Can not index event (status=400): "RemoteTransportException\[\[es-elasticsearch-masters-1\]\[inet\[/10.42.8.185:9300\]\]\[indices:admin/create\]\]; nested: MapperParsingException\[mapping \[\_default\_\]\]; nested: MapperParsingEx… --- ## [Beats make package fails with \`gotpl: not found\` error](https://discuss.elastic.co/t/beats-make-package-fails-with-gotpl-not-found-error/90277)
**Author:** [@fld](https://discuss.elastic.co/u/fld)\ **Replies:** 1\ **Last updated:** [June 21, 2017, 1:33pm UTC](https://discuss.elastic.co/t/beats-make-package-fails-with-gotpl-not-found-error/90277 "2017-06-21T13:33:53Z")
A bit like https://discuss.elastic.co/t/make-package-broken-for-community-beats/70511 (but topic closed so cannot edit it) but with a later commit (tried d561c30cb731ae5e14ea43f46b1a093084c96413 and more recently 36e212d… --- ## [Filebeat on windows not updating registry file](https://discuss.elastic.co/t/filebeat-on-windows-not-updating-registry-file/90267)
**Author:** [@punit\_j](https://discuss.elastic.co/u/punit_j)\ **Replies:** 0\ **Last updated:** [June 21, 2017, 10:41am UTC](https://discuss.elastic.co/t/filebeat-on-windows-not-updating-registry-file/90267 "2017-06-21T10:41:15Z")
Hi, I am facing an issue in filebeat registry file under windows platform. The registry file is not getting updated at all.I am running filebeat 5.4.0. The file under C:\\Program Files\\filebeat\\data\\registry shows empt… --- ## [Windows 10 - Not capturing HTTP traffic](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896)
**Author:** [@commonman.net](https://discuss.elastic.co/u/commonman.net)\ **Replies:** 3\ **Last updated:** [June 21, 2017, 9:27am UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896 "2017-06-21T09:27:17Z")
Dears, I have successfully installed packetbeat-5.4.0 and pointing to Elastic search. I kept the default configs as it is. However I'm getting "INFO No non-zero metrics in the last 30s" in the log. My intention is to g… --- ## [Filebeat in docker, cannot reload configuration](https://discuss.elastic.co/t/filebeat-in-docker-cannot-reload-configuration/90210)
**Author:** [@delphi1989](https://discuss.elastic.co/u/delphi1989)\ **Replies:** 2\ **Last updated:** [June 21, 2017, 9:10am UTC](https://discuss.elastic.co/t/filebeat-in-docker-cannot-reload-configuration/90210 "2017-06-21T09:10:59Z")
Hello :smiley: I'm wondering why it's not working if I modify the filebeat.yml file Here is my configuration: # ========= # input # ========= filebeat.prospectors: - input\_type: log … --- ## [Filebeat status failed . Please help](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132)
**Author:** [@manojkal](https://discuss.elastic.co/u/manojkal)\ **Replies:** 5\ **Last updated:** [June 20, 2017, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132 "2017-06-20T23:25:34Z")
filebeat.yml filebeat: prospectors: - input\_type: log paths: - /var/log/\*.log registry\_file: /var/lib/filebeat/registry output.elasticsearch: hosts: \["10.8.20.138:80/es"\] output: logstash: ho… --- ## [Winlogbeat vs Syslog-NG](https://discuss.elastic.co/t/winlogbeat-vs-syslog-ng/89892)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 3\ **Last updated:** [June 20, 2017, 2:13pm UTC](https://discuss.elastic.co/t/winlogbeat-vs-syslog-ng/89892 "2017-06-20T14:13:53Z")
Hello. If I just install "Elasticsearch", "Kibana" and "Logstash" then can I use "Winlogbeat" on a Windows OS for forward evetlogs to my elastic box? In Elastic box I configured Syslog-NG. Thank you. --- ## [ERR Failed to publish events caused by: write tcp - Filebeat](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-filebeat/89983)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 2\ **Last updated:** [June 20, 2017, 2:07pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-filebeat/89983 "2017-06-20T14:07:35Z")
Hey guys , Can someone please please help me resolve this . I am new to this trying to implement it prod environment ASAP . 017-06-19T14:16:10-04:00 ERR Failed to publish events caused by: write tcp 10.140.76.11:3526… --- ## [Filebeat indexing on Windows](https://discuss.elastic.co/t/filebeat-indexing-on-windows/89962)
**Author:** [@matt.wilcock](https://discuss.elastic.co/u/matt.wilcock)\ **Replies:** 3\ **Last updated:** [June 20, 2017, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-indexing-on-windows/89962 "2017-06-20T13:55:17Z")
Hi, I'm new to the Elastic Stack and came across filebeat when trying to find a way to push custom logfiles from windows through to Elasticsearch. I've got filebeat installed and have got the logs going to AWS Elasti… --- ## [Close\_removed not working properly?](https://discuss.elastic.co/t/close-removed-not-working-properly/89055)
**Author:** [@ashak](https://discuss.elastic.co/u/ashak)\ **Replies:** 6\ **Last updated:** [June 20, 2017, 12:44pm UTC](https://discuss.elastic.co/t/close-removed-not-working-properly/89055 "2017-06-20T12:44:31Z")
Hi, We've an ELK setup that we recently introduced filebeat too. Part of our testing was to stop the logstash instances that filebeat writes to for a while to backlog some data to confirm that it cause no issues and th… --- ## [Filebeat delays message sending](https://discuss.elastic.co/t/filebeat-delays-message-sending/88307)
**Author:** [@hc4](https://discuss.elastic.co/u/hc4)\ **Replies:** 2\ **Last updated:** [June 20, 2017, 9:18am UTC](https://discuss.elastic.co/t/filebeat-delays-message-sending/88307 "2017-06-20T09:18:49Z")
It can work normally for many days, but randomly it begins to delay messages. Just look at messages count chart: y-axis is messages per second. Time is from logs time (not message receive time). This holes will be ev… --- ## [Multiplu keys for filebeat redis output plugin is no work](https://discuss.elastic.co/t/multiplu-keys-for-filebeat-redis-output-plugin-is-no-work/89908)
**Author:** [@zacker330](https://discuss.elastic.co/u/zacker330)\ **Replies:** 3\ **Last updated:** [June 20, 2017, 9:12am UTC](https://discuss.elastic.co/t/multiplu-keys-for-filebeat-redis-output-plugin-is-no-work/89908 "2017-06-20T09:12:34Z")
output.redis: hosts: \["localhost"\] keys: - key: "info\_list" # send to info\_list if \`message\` field contains INFO when.contains: message: "INFO" - key: "debug\_list" # send to debug\_list if \`m… --- ## [FileBeat not able to read new files](https://discuss.elastic.co/t/filebeat-not-able-to-read-new-files/89650)
**Author:** [@vishalkin](https://discuss.elastic.co/u/vishalkin)\ **Replies:** 4\ **Last updated:** [June 20, 2017, 9:10am UTC](https://discuss.elastic.co/t/filebeat-not-able-to-read-new-files/89650 "2017-06-20T09:10:04Z")
Filebeat : 5.1.1 ELK stack 5.1.1 I have a filebeat running on my server which has following config. filebeat.prospectors: - input\_type: log # Paths that should be crawled and fetched. Glob based paths. paths: … --- ## [Multi-line pattern matching help](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993)
**Author:** [@amarc](https://discuss.elastic.co/u/amarc)\ **Replies:** 1\ **Last updated:** [June 19, 2017, 9:36pm UTC](https://discuss.elastic.co/t/multi-line-pattern-matching-help/89993 "2017-06-19T21:36:14Z")
I am trying to capture the following log using multiline pattern. If I try to capture it with date '^\\d{4}-\\d{2}-\\d{2}' then all the logs (not multine) also get concatenated. If I try to capture with '^\[\[:space:\]\]+|^at' … --- ## [Error on filebeat -ERR Failed to publish events caused by: read tcp](https://discuss.elastic.co/t/error-on-filebeat-err-failed-to-publish-events-caused-by-read-tcp/89740)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 5\ **Last updated:** [June 19, 2017, 2:21pm UTC](https://discuss.elastic.co/t/error-on-filebeat-err-failed-to-publish-events-caused-by-read-tcp/89740 "2017-06-19T14:21:39Z")
Hello , i am seeing following errors in logs can someone help 2017-06-16T11:39:30-04:00 INFO Error publishing events (retrying): read tcp 10.140.76.11:37670-\>10.140.223.89:5044: i/o timeout 2017-06-16T11:39:36-04:00 … --- ## [Metricbeat jolokia module: "Cannot unmarshal json response"](https://discuss.elastic.co/t/metricbeat-jolokia-module-cannot-unmarshal-json-response/89744)
**Author:** [@gregbk](https://discuss.elastic.co/u/gregbk)\ **Replies:** 3\ **Last updated:** [June 19, 2017, 1:09pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-module-cannot-unmarshal-json-response/89744 "2017-06-19T13:09:42Z")
Hello Beats team! I am trying the Jolokia module on 2 different jmx env. I got for both the same error message in kibana: Cannot unmarshal json response: invalid character '\\x00' looking for beginning of value I u… --- ## [Performance Filebeat 5.0 vs 5.4](https://discuss.elastic.co/t/performance-filebeat-5-0-vs-5-4/87927)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 9\ **Last updated:** [June 19, 2017, 7:27am UTC](https://discuss.elastic.co/t/performance-filebeat-5-0-vs-5-4/87927 "2017-06-19T07:27:21Z")
Hi, I have filebeat 5.0 installed and running. I am testing the upgrade of Filebeat to release 5.4 Service is Windows Server, The filebeat accesses the log files using Shares on Windows. While comparing the performan… --- ## [Services metrics](https://discuss.elastic.co/t/services-metrics/89807)
**Author:** [@Quardo](https://discuss.elastic.co/u/Quardo)\ **Replies:** 13\ **Last updated:** [June 19, 2017, 12:52am UTC](https://discuss.elastic.co/t/services-metrics/89807 "2017-06-19T00:52:54Z")
Hey, I want to get metrics of windows services (like get-services command data) . I have not seen any metric module that doing so. Does someone know any? Thanks --- ## [How to have filebeat as part of my application installer](https://discuss.elastic.co/t/how-to-have-filebeat-as-part-of-my-application-installer/89208)
**Author:** [@Rubaiyat\_Islam\_Sadat](https://discuss.elastic.co/u/Rubaiyat_Islam_Sadat)\ **Replies:** 2\ **Last updated:** [June 18, 2017, 4:41pm UTC](https://discuss.elastic.co/t/how-to-have-filebeat-as-part-of-my-application-installer/89208 "2017-06-18T16:41:40Z")
quite new into this topic, sorry if this is quite naive question. I would like to make filebeat part of the installer of my Java application. also my application will run on multiple OS platforms (Windows, Linux, OSX). a… --- ## [Future of conf.d Directory](https://discuss.elastic.co/t/future-of-conf-d-directory/39788)
**Author:** [@pcfens](https://discuss.elastic.co/u/pcfens)\ **Replies:** 4\ **Last updated:** [June 17, 2017, 7:02pm UTC](https://discuss.elastic.co/t/future-of-conf-d-directory/39788 "2017-06-17T19:02:36Z")
I noticed that sometime recently mentions of the conf.d directory was pulled out of the documentation. Is this being deprecated? We prefer using the conf.d directory, but don't want to continue doing it if the plan is … --- ## [Amazon Beats](https://discuss.elastic.co/t/amazon-beats/89753)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 1\ **Last updated:** [June 17, 2017, 9:20am UTC](https://discuss.elastic.co/t/amazon-beats/89753 "2017-06-17T09:20:24Z")
Hi all; My first job at Samsung consisted of logging into all our AWS accounts (26 at the time) and searching all regions for EC2 instances that needed to be rebooted. Took me two days to go through them all. I ha… --- ## [Filebeat docker running on windows not allowing application to rotate the log!](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616)
**Author:** [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Replies:** 12\ **Last updated:** [June 16, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616 "2017-06-16T20:19:32Z")
I am using filebeat image - docker.elastic.co/beats/filebeat:5.4.1 to setup filebeat container locally on windows to read logs from an application and send data to logstash. The application which generate logs will rotat… --- ## [Lack of Beats resources](https://discuss.elastic.co/t/lack-of-beats-resources/89267)
**Author:** [@StivOstenberg](https://discuss.elastic.co/u/StivOstenberg)\ **Replies:** 7\ **Last updated:** [June 16, 2017, 6:04pm UTC](https://discuss.elastic.co/t/lack-of-beats-resources/89267 "2017-06-16T18:04:06Z")
Hi All; I am new to ELK, and have been tasked with implementing the Beats side of the deployment. Sadly, I find that I cannot find any reference materials online that address working with Beats. Yes, I have seen the d… --- ## [Filebeat kafka output to multiple/different kafka clusters, depending on log file](https://discuss.elastic.co/t/filebeat-kafka-output-to-multiple-different-kafka-clusters-depending-on-log-file/89695)
**Author:** [@lolovarga](https://discuss.elastic.co/u/lolovarga)\ **Replies:** 1\ **Last updated:** [June 16, 2017, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-kafka-output-to-multiple-different-kafka-clusters-depending-on-log-file/89695 "2017-06-16T16:36:15Z")
Is it possible to output to multiple/different kafka clusters, depending on the logfile? I saw that is possible to output to different topics, depending on the logfile, wondering is that is the case for different cluster… --- ## [Filebeat logs with .txt extension -- no geoip.location or geoip\_point](https://discuss.elastic.co/t/filebeat-logs-with-txt-extension-no-geoip-location-or-geoip-point/89196)
**Author:** [@lewis15](https://discuss.elastic.co/u/lewis15)\ **Replies:** 10\ **Last updated:** [June 16, 2017, 11:34am UTC](https://discuss.elastic.co/t/filebeat-logs-with-txt-extension-no-geoip-location-or-geoip-point/89196 "2017-06-16T11:34:18Z")
Filebeat logs with .log somewhere in the extensions works fine, but will not present the IP address if the extension is .txt I have not been able to find how to resolve this opportunity on the web. Thanks for the hel… --- ## [Filebeat stops sending to es eventually, bulk index 400](https://discuss.elastic.co/t/filebeat-stops-sending-to-es-eventually-bulk-index-400/89114)
**Author:** [@JSkier](https://discuss.elastic.co/u/JSkier)\ **Replies:** 9\ **Last updated:** [June 16, 2017, 10:26am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-to-es-eventually-bulk-index-400/89114 "2017-06-16T10:26:17Z")
Hello, I'm running ES, kibana, and beat version 5.4.1, ArchLinux (64bit), nginx-mainline 1.13.1 on all nodes, and I'm having issues with them consistently sending data to ES. I'm relatively new to this whole projec… --- ## [Metricbeat apache - ERR Error on field 'children\_system': Key \`CPUChildrenSystem\` not found](https://discuss.elastic.co/t/metricbeat-apache-err-error-on-field-children-system-key-cpuchildrensystem-not-found/89631)
**Author:** [@egulik](https://discuss.elastic.co/u/egulik)\ **Replies:** 1\ **Last updated:** [June 16, 2017, 9:44am UTC](https://discuss.elastic.co/t/metricbeat-apache-err-error-on-field-children-system-key-cpuchildrensystem-not-found/89631 "2017-06-16T09:44:54Z")
Hello everyone, I've setup AWS elasticsearch (5.3), installed metricbeats on 2 amzlinux instances with apache 2.2.31 but I get a lot of errors: \> ERR Error on field 'user': Key \`CPUUser\` not found \> ERR Error on field … --- ## [Postgresql Searches, Visualizations & Dashboards for metricbeat](https://discuss.elastic.co/t/postgresql-searches-visualizations-dashboards-for-metricbeat/89566)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 2\ **Last updated:** [June 16, 2017, 9:12am UTC](https://discuss.elastic.co/t/postgresql-searches-visualizations-dashboards-for-metricbeat/89566 "2017-06-16T09:12:49Z")
Hi, We've just installed metricbeat (5.1.1) with the postgresql module and the default dashboards. I've noticed there aren't any dashboards for postgresql though. Are there any out there? Cheers, Dave --- ## [Harvesting same file with different prospector config](https://discuss.elastic.co/t/harvesting-same-file-with-different-prospector-config/89546)
**Author:** [@monitoring\_it](https://discuss.elastic.co/u/monitoring_it)\ **Replies:** 7\ **Last updated:** [June 16, 2017, 1:59am UTC](https://discuss.elastic.co/t/harvesting-same-file-with-different-prospector-config/89546 "2017-06-16T01:59:05Z")
Does anyone see any issue with harvesting same file from different filebeat prospectors each having its own custom fields and set of include exclude regexs? My usecase is, i want filebeat to parse a single file for cer… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=515) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=517)