# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=518 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 519 --- ## [Filebeat to lagstash to kafka or Filebeat to kafka for \>= 10,000 servers](https://discuss.elastic.co/t/filebeat-to-lagstash-to-kafka-or-filebeat-to-kafka-for-10-000-servers/88138)
**Author:** [@amarc](https://discuss.elastic.co/u/amarc)\ **Replies:** 2\ **Last updated:** [June 9, 2017, 5:31pm UTC](https://discuss.elastic.co/t/filebeat-to-lagstash-to-kafka-or-filebeat-to-kafka-for-10-000-servers/88138 "2017-06-09T17:31:52Z")
Hi, We have a project to fingerprint logs from 10,000 servers and I am in process of designing a system for it. Looking at the design guide https://www.elastic.co/blog/just-enough-kafka-for-the-elastic-stack-part1 Filebe… --- ## [Multiple prospectors not working under filebeat](https://discuss.elastic.co/t/multiple-prospectors-not-working-under-filebeat/87119)
**Author:** [@punit\_j](https://discuss.elastic.co/u/punit_j)\ **Replies:** 5\ **Last updated:** [June 9, 2017, 3:43pm UTC](https://discuss.elastic.co/t/multiple-prospectors-not-working-under-filebeat/87119 "2017-06-09T15:43:44Z")
Hi, I am using filebeat 5.4.0 with below configuration, however multiline is somehow not woking. filebeat.prospectors: - input\_type: log paths: - '/var/logs/JINK/\*.log' tags: \[jinklogs\] multiline.patter… --- ## [Metricbeat json parser fails to get Docker images](https://discuss.elastic.co/t/metricbeat-json-parser-fails-to-get-docker-images/88825)
**Author:** [@sadok-f](https://discuss.elastic.co/u/sadok-f)\ **Replies:** 2\ **Last updated:** [June 9, 2017, 12:37pm UTC](https://discuss.elastic.co/t/metricbeat-json-parser-fails-to-get-docker-images/88825 "2017-06-09T12:37:35Z")
Hello, I installed Metricbeat in debian server and it send all metrics to Eleasticsearch, however when I added docker module to see information about running containers and images, it works fine but I don't get any info… --- ## [Http://localhost:9200/packetbeat-\*/ empty](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640)
**Author:** [@commonman.net](https://discuss.elastic.co/u/commonman.net)\ **Replies:** 5\ **Last updated:** [June 8, 2017, 4:49am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640 "2017-06-08T04:49:52Z")
Dears, I have setup ELK windows 10 and trying to retrieve IIS logs through packetbeat =\> ES =\> Kibana. However stuck up by this http://localhost:9200/packetbeat-\*/ {} Thanks in advance --- ## [Configuring FileBeat.yml For Windows](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623)
**Author:** [@jshahid](https://discuss.elastic.co/u/jshahid)\ **Replies:** 6\ **Last updated:** [June 8, 2017, 7:32pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623 "2017-06-08T19:32:40Z")
Hi, I have been looking for some time on how set up configuration of filebeat.yml on a windows client to ship logs to a ubuntu host that has the elk stack installed. I have the service installed and running, but am compl… --- ## [Duplicated events using Filebeat](https://discuss.elastic.co/t/duplicated-events-using-filebeat/87453)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 13\ **Last updated:** [June 8, 2017, 3:02pm UTC](https://discuss.elastic.co/t/duplicated-events-using-filebeat/87453 "2017-06-08T15:02:08Z")
hi, I'm using Filebeat to read a custom log file; every record (line) is sent to Logstash to normalize it, then into Elastic and then into Kibana to visualize it. Unfortunately, I saw a lot of duplicated events; I know t… --- ## [Aerospike module for Metricbeat](https://discuss.elastic.co/t/aerospike-module-for-metricbeat/88614)
**Author:** [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)\ **Replies:** 2\ **Last updated:** [June 8, 2017, 1:07pm UTC](https://discuss.elastic.co/t/aerospike-module-for-metricbeat/88614 "2017-06-08T13:07:29Z")
Hi guys, We want to send Aerospike metrics from one point to another and checking the metricbeat could be a candidate for that. FYI, http://www.aerospike.com/docs/operations/monitor At the moment it looks like ther… --- ## [Wireless LAN: Unsupported link type](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 3\ **Last updated:** [June 8, 2017, 12:54pm UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571 "2017-06-08T12:54:05Z")
Hi! I'm trying to index a pcap-file with wireless traffic using Packetbeat 5.4.1: packetbeat -e -v -waitstop 10 -t -d publish -I c:\\temp\\wlan-132\_07.06.17\_1232.eth but getting the following error: 2017/06/07 11:52:0… --- ## [Packet occasionally hung when using sniffer type af\_packet](https://discuss.elastic.co/t/packet-occasionally-hung-when-using-sniffer-type-af-packet/88649)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 2\ **Last updated:** [June 8, 2017, 10:35am UTC](https://discuss.elastic.co/t/packet-occasionally-hung-when-using-sniffer-type-af-packet/88649 "2017-06-08T10:35:49Z")
I ran into a weird case that packetbeat not working when i specify using af\_packet, after starting seems noting is runing, no cpu consumption, no logs generated, just hung in there, and cannot be stopped using CtrlC bu… --- ## [Gitlab elasticsearch compatibility](https://discuss.elastic.co/t/gitlab-elasticsearch-compatibility/88653)
**Author:** [@amruthapbhat](https://discuss.elastic.co/u/amruthapbhat)\ **Replies:** 1\ **Last updated:** [June 8, 2017, 6:49am UTC](https://discuss.elastic.co/t/gitlab-elasticsearch-compatibility/88653 "2017-06-08T06:49:22Z")
Is GitLab Enterprise Edition 9.0+ only applicable for Elasticsearch 5.1 - 5.3 and not applicable for \> 5.3 version? --- ## [Should I add a output plugin named "tcp" into libbeats?](https://discuss.elastic.co/t/should-i-add-a-output-plugin-named-tcp-into-libbeats/88404)
**Author:** [@dongmx](https://discuss.elastic.co/u/dongmx)\ **Replies:** 3\ **Last updated:** [June 8, 2017, 1:52am UTC](https://discuss.elastic.co/t/should-i-add-a-output-plugin-named-tcp-into-libbeats/88404 "2017-06-08T01:52:44Z")
I implemented an output plugin named "tcp" with beats 6.0.0alpha. It just looks like logstash "tcp" output plugin. Write events over a TCP socket. Each event json is separated by a newline.Connect to a server to push eve… --- ## [Can't create Winlogbeat index in Elasticsearch](https://discuss.elastic.co/t/cant-create-winlogbeat-index-in-elasticsearch/88554)
**Author:** [@Pippo](https://discuss.elastic.co/u/Pippo)\ **Replies:** 6\ **Last updated:** [June 7, 2017, 2:39pm UTC](https://discuss.elastic.co/t/cant-create-winlogbeat-index-in-elasticsearch/88554 "2017-06-07T14:39:43Z")
Hi, I'm having trouble to send Winlogbeat index in Elasticsearch. I tried to do it from the config file In winlogbeat.yml : output.elasticsearch: hosts: \["172.25.3.18:9200"\] template.name: "winlogbeat" #templat… --- ## [Filebeat drop\_event](https://discuss.elastic.co/t/filebeat-drop-event/88559)
**Author:** [@shaktigupta200](https://discuss.elastic.co/u/shaktigupta200)\ **Replies:** 1\ **Last updated:** [June 7, 2017, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-drop-event/88559 "2017-06-07T12:55:48Z")
Hi Folks, I have an issue when using processors in filebeat for dropping event when certain condition matches. I am trying to drop event from log which contains "log\_time" in message field. But the drop filter is not w… --- ## [Packetbeat on windows](https://discuss.elastic.co/t/packetbeat-on-windows/86346)
**Author:** [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Replies:** 7\ **Last updated:** [June 7, 2017, 10:14am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346 "2017-06-07T10:14:59Z")
Dears, I am using windows 10 os, I have configured Elasicsearch, kibana and packebeat as per standard I have installed pcapng too In powershell after execute the .\\packetbeat.exe -devices command 0: \\Device\\NPF\_{5… --- ## [Filebeat multiline with line breaks](https://discuss.elastic.co/t/filebeat-multiline-with-line-breaks/88105)
**Author:** [@amruthapbhat](https://discuss.elastic.co/u/amruthapbhat)\ **Replies:** 9\ **Last updated:** [June 7, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-multiline-with-line-breaks/88105 "2017-06-07T10:04:45Z")
I have a file in the below format Ex: This is the first line. This is the second line. I am using no pattern since I want all the lines in the text to send to Logstash which is around 2000 lines. If the file is in… --- ## [Override module configuration on start](https://discuss.elastic.co/t/override-module-configuration-on-start/88279)
**Author:** [@jeremmm](https://discuss.elastic.co/u/jeremmm)\ **Replies:** 3\ **Last updated:** [June 7, 2017, 10:00am UTC](https://discuss.elastic.co/t/override-module-configuration-on-start/88279 "2017-06-07T10:00:03Z")
Hello, I would like to know if it was possible to override the configuration of a module with the option -E. I tried several syntax but no effect. Thanks --- ## [Error when inporting index by import\_dashboards -only-index](https://discuss.elastic.co/t/error-when-inporting-index-by-import-dashboards-only-index/88541)
**Author:** [@028ef201e86809101f43](https://discuss.elastic.co/u/028ef201e86809101f43)\ **Replies:** 0\ **Last updated:** [June 7, 2017, 9:30am UTC](https://discuss.elastic.co/t/error-when-inporting-index-by-import-dashboards-only-index/88541 "2017-06-07T09:30:44Z")
Good day. I have error when importing index /import\_dashboards -insecure -only-index Create temporary directory /tmp/tmp706160171 Downloading https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboard… --- ## [Assigning @timeout from JSON log4j2 logs via Filebeat](https://discuss.elastic.co/t/assigning-timeout-from-json-log4j2-logs-via-filebeat/88501)
**Author:** [@Brian\_Topping](https://discuss.elastic.co/u/Brian_Topping)\ **Replies:** 11\ **Last updated:** [June 7, 2017, 8:22am UTC](https://discuss.elastic.co/t/assigning-timeout-from-json-log4j2-logs-via-filebeat/88501 "2017-06-07T08:22:21Z")
Hi all, I'm looking to use log4j2 JSONLayout to generate log entries to be read by Filebeat. Everything works so far, but the timestamp on the log entries in the Kibana UI is set to when Filebeat read the logs, not when … --- ## [How can we moniter MySql port 3306 and Postgresql port 5432 in windows](https://discuss.elastic.co/t/how-can-we-moniter-mysql-port-3306-and-postgresql-port-5432-in-windows/85886)
**Author:** [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Replies:** 11\ **Last updated:** [June 7, 2017, 1:59am UTC](https://discuss.elastic.co/t/how-can-we-moniter-mysql-port-3306-and-postgresql-port-5432-in-windows/85886 "2017-06-07T01:59:06Z")
Dears I wanted to get monitor from MySQL(3306) or PostgreSQL(5432) in windows 10 os I have created inbound and outbound about 3306 and 5432 ports I set configuration in packetbeat.yml like packetbeat.interfaces.devi… --- ## [Rename filebeat default fields](https://discuss.elastic.co/t/rename-filebeat-default-fields/88002)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 6\ **Last updated:** [June 6, 2017, 10:48pm UTC](https://discuss.elastic.co/t/rename-filebeat-default-fields/88002 "2017-06-06T22:48:03Z")
Is there a way for me to rename "beat.hostname" to "hostname" in filebeat output? the documentation mentioned filter, but this seems like a filter setup in logstash, not in filebeat, right? per https://www.elastic.co/… --- ## [Packetbeat support for tcp6](https://discuss.elastic.co/t/packetbeat-support-for-tcp6/87894)
**Author:** [@rychu777](https://discuss.elastic.co/u/rychu777)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 8:08pm UTC](https://discuss.elastic.co/t/packetbeat-support-for-tcp6/87894 "2017-06-06T20:08:26Z")
I cannot get proc details for tcp6 port, not sure if Packetbeat is able to grab it. I want to monitor http 8181 port, for java process (currently pid 8985). netstat --all --program | grep 8985: tcp 0 0 :5… --- ## [GO Build wmibeat error throwing me for a loop](https://discuss.elastic.co/t/go-build-wmibeat-error-throwing-me-for-a-loop/88140)
**Author:** [@dealerof21](https://discuss.elastic.co/u/dealerof21)\ **Replies:** 3\ **Last updated:** [June 6, 2017, 5:45pm UTC](https://discuss.elastic.co/t/go-build-wmibeat-error-throwing-me-for-a-loop/88140 "2017-06-06T17:45:09Z")
So i have invested many an hour trying to build eskibars wmibeat. After resolving many error messages, I thought I was finally on my way to actually building the .exe only to be stumped on this message: c:\\Users\\haywo… --- ## [Single line log into multiple logs](https://discuss.elastic.co/t/single-line-log-into-multiple-logs/87595)
**Author:** [@Nikhil\_Jaiswal](https://discuss.elastic.co/u/Nikhil_Jaiswal)\ **Replies:** 2\ **Last updated:** [June 5, 2017, 6:26pm UTC](https://discuss.elastic.co/t/single-line-log-into-multiple-logs/87595 "2017-06-05T18:26:53Z")
Is there any way to break single line logs into multi line logs using filebeat? --- ## [Filebeat Multiline multiple patterns](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335)
**Author:** [@moncky](https://discuss.elastic.co/u/moncky)\ **Replies:** 4\ **Last updated:** [June 6, 2017, 1:22pm UTC](https://discuss.elastic.co/t/filebeat-multiline-multiple-patterns/45335 "2017-06-06T13:22:30Z")
I have a log file that has multiple, multi line events. For example I have: \[24-Mar-2016 03:27:31\] PHP Stack trace: \[24-Mar-2016 03:27:31\] PHP 1. {main}() /home/app/www/myapp.com/feed/feed.php:0 \[24-Mar-2016 03:27:… --- ## [Heartbeat - how to send respone.status field to kibana to get URL status](https://discuss.elastic.co/t/heartbeat-how-to-send-respone-status-field-to-kibana-to-get-url-status/87140)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 12:50pm UTC](https://discuss.elastic.co/t/heartbeat-how-to-send-respone-status-field-to-kibana-to-get-url-status/87140 "2017-06-06T12:50:57Z")
I have heartbeat for checking URL availability and data is available in Kibana. I have to create the line graph (trend chart) to see the URL status in the graph. Since there is no direct way, i am trying to use the movi… --- ## [Send old files to Kibana](https://discuss.elastic.co/t/send-old-files-to-kibana/88417)
**Author:** [@sarit](https://discuss.elastic.co/u/sarit)\ **Replies:** 0\ **Last updated:** [June 6, 2017, 12:40pm UTC](https://discuss.elastic.co/t/send-old-files-to-kibana/88417 "2017-06-06T12:40:24Z")
Hello, I installed filebeat 5.4.0 today on windows server. i the log path i configored i have logs 1 month old but filebeat is sending only today's logs to kibana. how can i change it ? thanks --- ## [Logs with lime breaks not working with multiline](https://discuss.elastic.co/t/logs-with-lime-breaks-not-working-with-multiline/87937)
**Author:** [@amruthapbhat](https://discuss.elastic.co/u/amruthapbhat)\ **Replies:** 5\ **Last updated:** [June 6, 2017, 11:00am UTC](https://discuss.elastic.co/t/logs-with-lime-breaks-not-working-with-multiline/87937 "2017-06-06T11:00:14Z")
I have a file in the below format Ex: This is the first line. This is the second line. I am using no pattern since I want all the lines in the text to send to Logstash which is around 2000 lines. If the file is… --- ## [Help with watch.poll\_file](https://discuss.elastic.co/t/help-with-watch-poll-file/88220)
**Author:** [@packland](https://discuss.elastic.co/u/packland)\ **Replies:** 1\ **Last updated:** [June 6, 2017, 9:59am UTC](https://discuss.elastic.co/t/help-with-watch-poll-file/88220 "2017-06-06T09:59:27Z")
I'm looking to make use of this feature by basically having a json file which contains all the details of the monitors I want to use and be able to change those on the fly but I'm not entirely sure how to set it up as th… --- ## [How to multiple events into one event in filebeat](https://discuss.elastic.co/t/how-to-multiple-events-into-one-event-in-filebeat/88108)
**Author:** [@pratheek\_k](https://discuss.elastic.co/u/pratheek_k)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 9:53am UTC](https://discuss.elastic.co/t/how-to-multiple-events-into-one-event-in-filebeat/88108 "2017-06-06T09:53:12Z")
I would like to combine multiple events into one event in the filebeat based on a unique string. I have the below log: June 1st 2017, 11:51:26.992 12345ab AAAAA ClassName:methodName:99 \[DEBUG\] - Received request: June 1s… --- ## [CPU utilizaiton up to 50%,any method to decrease the filebeat CPU utilization](https://discuss.elastic.co/t/cpu-utilizaiton-up-to-50-any-method-to-decrease-the-filebeat-cpu-utilization/88388)
**Author:** [@DongHuang](https://discuss.elastic.co/u/DongHuang)\ **Replies:** 1\ **Last updated:** [June 6, 2017, 9:48am UTC](https://discuss.elastic.co/t/cpu-utilizaiton-up-to-50-any-method-to-decrease-the-filebeat-cpu-utilization/88388 "2017-06-06T09:48:25Z")
CPU utilizaiton up to 50%,any method to decrease the filebeat CPU utilization? [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=517) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=519)