# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=517 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 518 --- ## [Filebeat reports :Error publishing events (retrying): read tcp IPA-\>9IPB5044: i/o timeout, why?](https://discuss.elastic.co/t/filebeat-reports-error-publishing-events-retrying-read-tcp-ipa-9ipb5044-i-o-timeout-why/89398)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 6\ **Last updated:** [June 15, 2017, 7:48pm UTC](https://discuss.elastic.co/t/filebeat-reports-error-publishing-events-retrying-read-tcp-ipa-9ipb5044-i-o-timeout-why/89398 "2017-06-15T19:48:05Z")
HEllo, I have updated my machine to filebeat 5 and now when trying to ship my logs I see that the shipping sometimes fails and I don't understand the reason. The error is the following when enabling debug 2017-06-… --- ## [How to make filebeat ship logs in the same order as in the log file](https://discuss.elastic.co/t/how-to-make-filebeat-ship-logs-in-the-same-order-as-in-the-log-file/89402)
**Author:** [@pratheek\_k](https://discuss.elastic.co/u/pratheek_k)\ **Replies:** 2\ **Last updated:** [June 15, 2017, 3:25pm UTC](https://discuss.elastic.co/t/how-to-make-filebeat-ship-logs-in-the-same-order-as-in-the-log-file/89402 "2017-06-15T15:25:35Z")
I can see that filebeat is not shipping the logs in the same order to logstash as in the log file. So can i make filebeat to ship the logs in the same order as in the log file. Sorting it later in elasticsearch based on … --- ## [Customized logstash ip for each filebeat prospectors](https://discuss.elastic.co/t/customized-logstash-ip-for-each-filebeat-prospectors/89235)
**Author:** [@mahsa\_b](https://discuss.elastic.co/u/mahsa_b)\ **Replies:** 3\ **Last updated:** [June 15, 2017, 2:54pm UTC](https://discuss.elastic.co/t/customized-logstash-ip-for-each-filebeat-prospectors/89235 "2017-06-15T14:54:33Z")
Hi I was wondering if it's possible to have multiple prospectors to read from different directory and based on that, send the events to a specific logstash. ex: I want to read from router-log and send it to :5044 read … --- ## [Packetbeat is not running on SUSE Linux Enterprise Server 11](https://discuss.elastic.co/t/packetbeat-is-not-running-on-suse-linux-enterprise-server-11/89551)
**Author:** [@spry\_free](https://discuss.elastic.co/u/spry_free)\ **Replies:** 1\ **Last updated:** [June 15, 2017, 2:11pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-running-on-suse-linux-enterprise-server-11/89551 "2017-06-15T14:11:13Z")
Hi! Can u help me pls? Why is it not starting? SUSE Linux Enterprise Server 11 SP3 (x86\_64) On other system (Debian) packetbeat is running with same configuration. vpn1:~ # service packetbeat start /etc/init.d/packe… --- ## [How long filebeat harvester will be alive by default?](https://discuss.elastic.co/t/how-long-filebeat-harvester-will-be-alive-by-default/89170)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 3\ **Last updated:** [June 15, 2017, 2:08pm UTC](https://discuss.elastic.co/t/how-long-filebeat-harvester-will-be-alive-by-default/89170 "2017-06-15T14:08:02Z")
HI, I used filebeat to get my logs from one server to another , usually my logs generation is slow. I want to know how long the filebeat harvester will be alive ? Is there any possible case where the filebeat harvester… --- ## [Add mapping for keyword on http.url for aggregation](https://discuss.elastic.co/t/add-mapping-for-keyword-on-http-url-for-aggregation/89435)
**Author:** [@lowlevelio](https://discuss.elastic.co/u/lowlevelio)\ **Replies:** 1\ **Last updated:** [June 15, 2017, 10:10am UTC](https://discuss.elastic.co/t/add-mapping-for-keyword-on-http-url-for-aggregation/89435 "2017-06-15T10:10:03Z")
Could you please add a keyword field on the http.url mapping to be able to aggregate the url field, because it's currently only text which cannot be aggregated. Most, if not all, text field other beat agent have also has… --- ## [INFO Error publishing events](https://discuss.elastic.co/t/info-error-publishing-events/88521)
**Author:** [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\ **Replies:** 2\ **Last updated:** [June 15, 2017, 5:33am UTC](https://discuss.elastic.co/t/info-error-publishing-events/88521 "2017-06-15T05:33:53Z")
Hi i have set up elk on centos machine my client is a ubuntu machine all the service are running but when i try to send logs to my elk server filebeat log reports error INFO Error publishing events (retrying): read … --- ## [How to connect filebeat to logstash via datapower?](https://discuss.elastic.co/t/how-to-connect-filebeat-to-logstash-via-datapower/88812)
**Author:** [@ramuklawjju](https://discuss.elastic.co/u/ramuklawjju)\ **Replies:** 1\ **Last updated:** [June 14, 2017, 11:55pm UTC](https://discuss.elastic.co/t/how-to-connect-filebeat-to-logstash-via-datapower/88812 "2017-06-14T23:55:32Z")
We have a requirement where we need to get data into logstash from filebeat via datapower. thing happening is : Filebeat \>\> datapower \>\> logstash. Is there any way to achieve this ? --- ## [CITRIX ICA protocol](https://discuss.elastic.co/t/citrix-ica-protocol/89380)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [June 14, 2017, 11:25pm UTC](https://discuss.elastic.co/t/citrix-ica-protocol/89380 "2017-06-14T23:25:34Z")
Hi All, Is it possible monitor CITRIX ICA Protocol using Packetbeats or any other beats can help to monitor the Citrix environment.So that I could use the ELK platform for creating dashboards and alerting . Any help… --- ## [Logstash data appears but filebeat data not appearing in kibana after x-pack is enabled](https://discuss.elastic.co/t/logstash-data-appears-but-filebeat-data-not-appearing-in-kibana-after-x-pack-is-enabled/89365)
**Author:** [@priyam](https://discuss.elastic.co/u/priyam)\ **Replies:** 3\ **Last updated:** [June 14, 2017, 8:26pm UTC](https://discuss.elastic.co/t/logstash-data-appears-but-filebeat-data-not-appearing-in-kibana-after-x-pack-is-enabled/89365 "2017-06-14T20:26:51Z")
I have configured filebeat to send logs to logstash followed by logstash sending logs to elasticsearch. All worked fine .. i could see logstash-\* and filebeat-\* data getting updated in kibana .. until i enabled x-pack s… --- ## [Can't get winlogbeat to send logs](https://discuss.elastic.co/t/cant-get-winlogbeat-to-send-logs/89416)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 5\ **Last updated:** [June 14, 2017, 7:23pm UTC](https://discuss.elastic.co/t/cant-get-winlogbeat-to-send-logs/89416 "2017-06-14T19:23:29Z")
Hello, all. In my continuing quest to get ELK 5.x set up, I've managed to get logstash, filebeat, and topbeat logging working. However, despite hours and hours spent researching the issue, then trying every tweak unde… --- ## [Metricbeat - logstash - redis - elasticsearch](https://discuss.elastic.co/t/metricbeat-logstash-redis-elasticsearch/89059)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 5\ **Last updated:** [June 14, 2017, 12:47pm UTC](https://discuss.elastic.co/t/metricbeat-logstash-redis-elasticsearch/89059 "2017-06-14T12:47:06Z")
Hello, I am trying to use Metricbeat for a few days ago. I did installed Metricbeat on a windows server with "memory" metricsets only. Metricbeat is sendind logs to a Logstash server and Logstash is sending logs to… --- ## [Filebeat to ouput which pattern matched from the include\_lines list](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600)
**Author:** [@ragurajendran86](https://discuss.elastic.co/u/ragurajendran86)\ **Replies:** 4\ **Last updated:** [June 14, 2017, 9:24am UTC](https://discuss.elastic.co/t/filebeat-to-ouput-which-pattern-matched-from-the-include-lines-list/88600 "2017-06-14T09:24:57Z")
We use file beat extensively to capture exception in the log files. We define all the error pattern inside the include\_lines in the prospector section in array. This can identify the error pattern and using multi line it… --- ## [Filebeat Logs are created with 600 mode](https://discuss.elastic.co/t/filebeat-logs-are-created-with-600-mode/88839)
**Author:** [@Christophe\_Journel](https://discuss.elastic.co/u/Christophe_Journel)\ **Replies:** 2\ **Last updated:** [June 13, 2017, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-logs-are-created-with-600-mode/88839 "2017-06-13T13:00:34Z")
Hello, WIth then version 5.3 of filebeat , the log file created has a 600 mode : \[user@server ~\]$ ll /var/log/filebeat/filebeat -rw------- 1 root root 1404586 Jun 9 13:43 /var/log/filebeat/filebeat However on my … --- ## [Cannot see Filebeats - logstash data in Kibana](https://discuss.elastic.co/t/cannot-see-filebeats-logstash-data-in-kibana/89053)
**Author:** [@priyam](https://discuss.elastic.co/u/priyam)\ **Replies:** 4\ **Last updated:** [June 13, 2017, 12:22pm UTC](https://discuss.elastic.co/t/cannot-see-filebeats-logstash-data-in-kibana/89053 "2017-06-13T12:22:00Z")
I have configured Filebeat to send data to logstash and logstash sends data to elasticsearch. Nothing appears in logstash-\* in kibana .. neither is there any data in filebeats-\*. Filebeat.yml: filebeat.prospectors: … --- ## [Where to install Filebeat?](https://discuss.elastic.co/t/where-to-install-filebeat/89069)
**Author:** [@teejayuu](https://discuss.elastic.co/u/teejayuu)\ **Replies:** 5\ **Last updated:** [June 13, 2017, 11:31am UTC](https://discuss.elastic.co/t/where-to-install-filebeat/89069 "2017-06-13T11:31:02Z")
Hi, Sorry about this, but where would I install filebeat? I have an ELK stack already created and want to track exchange messaging logs: would I install Filebeat on my ELK server or on the Exchange server? Thanks T… --- ## [Winlogbeat datetime conversion problem](https://discuss.elastic.co/t/winlogbeat-datetime-conversion-problem/88909)
**Author:** [@Dmitry\_Reshetnik](https://discuss.elastic.co/u/Dmitry_Reshetnik)\ **Replies:** 2\ **Last updated:** [June 13, 2017, 8:27am UTC](https://discuss.elastic.co/t/winlogbeat-datetime-conversion-problem/88909 "2017-06-13T08:27:17Z")
I have installed winlogbeat on 1 server. This server is configured with GMT-8 timezone - PST. But I see that @timestamp contains the date converted from GMT-7 (PDT). --- ## [Filebeat CRIT Exiting: Prospector with same ID already exists](https://discuss.elastic.co/t/filebeat-crit-exiting-prospector-with-same-id-already-exists/84897)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 11\ **Last updated:** [June 12, 2017, 11:14pm UTC](https://discuss.elastic.co/t/filebeat-crit-exiting-prospector-with-same-id-already-exists/84897 "2017-06-12T23:14:08Z")
I am getting the error same as the Title. Filebeat is not running. What is the reason and how to cure this problem ? --- ## [Using filebeat sending logs to logstash?](https://discuss.elastic.co/t/using-filebeat-sending-logs-to-logstash/89030)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 9\ **Last updated:** [June 12, 2017, 10:25pm UTC](https://discuss.elastic.co/t/using-filebeat-sending-logs-to-logstash/89030 "2017-06-12T22:25:52Z")
Hi, Two types of Logs: \[2017-06-12 01:00:00,155\]\[ERROR\]\[marvel.agent.exporter.local\] local exporter \[default\_local\] - failed to delete indices RemoteTransportException\[\[data-1\]\[x.x.x.x:9200\]\[indices:admin/delete\]\]; n… --- ## [Filebeat + Logstash + ElasticSearch](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch/89118)
**Author:** [@ryveradam](https://discuss.elastic.co/u/ryveradam)\ **Replies:** 1\ **Last updated:** [June 12, 2017, 10:20pm UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch/89118 "2017-06-12T22:20:31Z")
Greetings fellow Logstashers. I am fairly new to Logstash. I am trying to implement Persisted Queues but I am having trouble understanding some stuff. If my understand is accurate, I would have Logstash running on eac… --- ## [How can i give two paths in the same input\_type with different document\_type?](https://discuss.elastic.co/t/how-can-i-give-two-paths-in-the-same-input-type-with-different-document-type/89091)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 4\ **Last updated:** [June 12, 2017, 7:55pm UTC](https://discuss.elastic.co/t/how-can-i-give-two-paths-in-the-same-input-type-with-different-document-type/89091 "2017-06-12T19:55:45Z")
Hi, How can i give two paths in one input\_type with different document\_type for each path. I tried it by giving like this: - input\_type: log paths: - F:\\logstash-2.4.0\\logstash-2.4.0\\bin\\samp.txt document\_typ… --- ## [How Beats exactly handles files](https://discuss.elastic.co/t/how-beats-exactly-handles-files/88891)
**Author:** [@Fabio\_Salge](https://discuss.elastic.co/u/Fabio_Salge)\ **Replies:** 2\ **Last updated:** [June 12, 2017, 4:18pm UTC](https://discuss.elastic.co/t/how-beats-exactly-handles-files/88891 "2017-06-12T16:18:06Z")
Hi Everybody, I was challenged to make an architecture to get files from a Unix Server and make a dashboard to display errors and also make some alerts. I made a survey and found the Elastic Stack. My plan is to use Fi… --- ## [Filebeat stopped working post upgrade](https://discuss.elastic.co/t/filebeat-stopped-working-post-upgrade/88542)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 7\ **Last updated:** [June 12, 2017, 2:18pm UTC](https://discuss.elastic.co/t/filebeat-stopped-working-post-upgrade/88542 "2017-06-12T14:18:12Z")
So i migrated filebeat to 5.x from 1.x now am not able to send the logs to logstash. Filebeat was working perfectly fine with previous version. Now am getting the error INFO File is inactive: /opt/IBM/WebSphere/AppSer… --- ## [Logstash vs Filebeat in server farm](https://discuss.elastic.co/t/logstash-vs-filebeat-in-server-farm/35881)
**Author:** [@dorr](https://discuss.elastic.co/u/dorr)\ **Replies:** 7\ **Last updated:** [June 12, 2017, 1:34pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-in-server-farm/35881 "2017-06-12T13:34:21Z")
Hello. I am currently examining how to deploy log shipping within my server farm, and trying to understand when is it right to use Logstash on the application servers and when it is right to use Filebeat. As you can unde… --- ## [Default prospector options - Filebeat 5.4.1](https://discuss.elastic.co/t/default-prospector-options-filebeat-5-4-1/88953)
**Author:** [@lefagr](https://discuss.elastic.co/u/lefagr)\ **Replies:** 2\ **Last updated:** [June 12, 2017, 1:22pm UTC](https://discuss.elastic.co/t/default-prospector-options-filebeat-5-4-1/88953 "2017-06-12T13:22:16Z")
Hello! I have several filebeat (5.4.1) prospectors and I want to use the same options for most of them. Is it possible to set the options as defaults for all prospectors and then overwrite them under prospector? As an… --- ## [Custom beats for statsd-like behavior (Python)](https://discuss.elastic.co/t/custom-beats-for-statsd-like-behavior-python/88914)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [June 12, 2017, 9:49am UTC](https://discuss.elastic.co/t/custom-beats-for-statsd-like-behavior-python/88914 "2017-06-12T09:49:28Z")
Hi— I came across your product: elastic search + beats and wonder if I can use it to do something similar to what I used to do with statsd and datadog. I looked into statsd + Graphite originally but it seems over-compl… --- ## [ELK Stack Confusion](https://discuss.elastic.co/t/elk-stack-confusion/88920)
**Author:** [@mvelez83](https://discuss.elastic.co/u/mvelez83)\ **Replies:** 2\ **Last updated:** [June 11, 2017, 7:02pm UTC](https://discuss.elastic.co/t/elk-stack-confusion/88920 "2017-06-11T19:02:58Z")
Hello, I'm VERY new to ELK and I wanted to confirm the order in which I need to deploy ELK. So, I believe the main components are of course Elastic Search, Logstash and Kibana. I also wanted to add a buffer layer usi… --- ## [Cannot get all fields in Kibana](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764)
**Author:** [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\ **Replies:** 3\ **Last updated:** [June 10, 2017, 5:06pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764 "2017-06-10T17:06:40Z")
I have the following packetbeat.yml packetbeat.flows: period: 60s packetbeat.interfaces.device: any packetbeat.protocols.icmp: enabled: true packetbeat.protocols.amqp: ports: \[5672\] packetbeat.protocols.nfs: … --- ## [Will filebeat be able read /dev/stdout and /dev/stderr?](https://discuss.elastic.co/t/will-filebeat-be-able-read-dev-stdout-and-dev-stderr/88880)
**Author:** [@skyrocknroll](https://discuss.elastic.co/u/skyrocknroll)\ **Replies:** 1\ **Last updated:** [June 10, 2017, 5:02pm UTC](https://discuss.elastic.co/t/will-filebeat-be-able-read-dev-stdout-and-dev-stderr/88880 "2017-06-10T17:02:21Z")
RUN ln -sf /dev/stdout /var/log/nginx/access.log \\ && ln -sf /dev/stderr /var/log/nginx/error.log I am using the above config to redirect nginx logs to stdout and stderr. In prospectors if i point to /dev/stdout & /de… --- ## [License on Filebeats](https://discuss.elastic.co/t/license-on-filebeats/88873)
**Author:** [@amarc](https://discuss.elastic.co/u/amarc)\ **Replies:** 1\ **Last updated:** [June 10, 2017, 12:17am UTC](https://discuss.elastic.co/t/license-on-filebeats/88873 "2017-06-10T00:17:50Z")
Hi, I am hoping to find what is the license with Filebeats (and ELK). The Github page and documentation just says that its open-source. [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=516) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=518)