# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=519 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 520 --- ## [Cross compilation of filebeat for embedded device - Nitrogen iMX6 - ARM-Cortex A9 processor](https://discuss.elastic.co/t/cross-compilation-of-filebeat-for-embedded-device-nitrogen-imx6-arm-cortex-a9-processor/87750)
**Author:** [@abhijeku](https://discuss.elastic.co/u/abhijeku)\ **Replies:** 3\ **Last updated:** [June 6, 2017, 9:40am UTC](https://discuss.elastic.co/t/cross-compilation-of-filebeat-for-embedded-device-nitrogen-imx6-arm-cortex-a9-processor/87750 "2017-06-06T09:40:01Z")
I am trying to cross compile filebeats to be run on nitrogen iMX6 hardware https://boundarydevices.com/product/nit6\_solox-imx6/ Does it support file beat? --- ## [Filebeat output to logstash potential bug report](https://discuss.elastic.co/t/filebeat-output-to-logstash-potential-bug-report/86466)
**Author:** [@wq\_Huang](https://discuss.elastic.co/u/wq_Huang)\ **Replies:** 2\ **Last updated:** [June 6, 2017, 8:40am UTC](https://discuss.elastic.co/t/filebeat-output-to-logstash-potential-bug-report/86466 "2017-06-06T08:40:15Z")
Hi,I am using filebeat to send logs to logstash,if there is something wrong with the network,logstash will reset the connection,filebeat will reconnect but it will not send logs to logstash anymore.Here are the steps to … --- ## [Auth logs not parsed in filebeat 5.4.0](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707)
**Author:** [@nbrys](https://discuss.elastic.co/u/nbrys)\ **Replies:** 5\ **Last updated:** [June 6, 2017, 8:35am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707 "2017-06-06T08:35:51Z")
On my elk server (ubuntu) and source host (ubuntu) i've upgraded the filebeat module to 5.4.0. I send my logs using filebeat to the elasticsearch service (not to logstash). The logs from /var/log/auth.log are inserted in… --- ## [Connection issue on publishing events on elastic clould](https://discuss.elastic.co/t/connection-issue-on-publishing-events-on-elastic-clould/86444)
**Author:** [@kevinitx](https://discuss.elastic.co/u/kevinitx)\ **Replies:** 1\ **Last updated:** [June 6, 2017, 8:32am UTC](https://discuss.elastic.co/t/connection-issue-on-publishing-events-on-elastic-clould/86444 "2017-06-06T08:32:35Z")
Hi i have following issue when i run the heartbeat with elasticseach clould All the login name and password is correct but just can't connect to is. Does anyone know is it some issue on my setting? 2017-05-20T00:3… --- ## [How to configure filebeat to read data from several paths using a path varible in it's configuration?](https://discuss.elastic.co/t/how-to-configure-filebeat-to-read-data-from-several-paths-using-a-path-varible-in-its-configuration/86355)
**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\ **Replies:** 5\ **Last updated:** [June 6, 2017, 8:27am UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-to-read-data-from-several-paths-using-a-path-varible-in-its-configuration/86355 "2017-06-06T08:27:46Z")
I need to configure filebeat to read log files from several locations and send them to logstash on user request. How can I do that? --- ## [Winlogbeat event\_id](https://discuss.elastic.co/t/winlogbeat-event-id/88209)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [June 5, 2017, 11:54pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id/88209 "2017-06-05T23:54:22Z")
Hi there, Is there a way to include meaningful descriptions to each of the event\_ids that are being ingested into logstash? When I use the event\_id to display top five for example I get the actual Event ID from Windows … --- ## [Using single filebeat installation for multiple servers](https://discuss.elastic.co/t/using-single-filebeat-installation-for-multiple-servers/88313)
**Author:** [@spasupuleti](https://discuss.elastic.co/u/spasupuleti)\ **Replies:** 0\ **Last updated:** [June 5, 2017, 6:17pm UTC](https://discuss.elastic.co/t/using-single-filebeat-installation-for-multiple-servers/88313 "2017-06-05T18:17:42Z")
Here is our ELK setup and issue we are facing with our use case. We have multiple filebeat agents that ship logs to logstash where it groks and sends to elastic search servers. We have close to 150 VMs in our enviro… --- ## [publisher#Client.Publish and backpressure](https://discuss.elastic.co/t/publisher-client-publish-and-backpressure/88125)
**Author:** [@HeyImAlex](https://discuss.elastic.co/u/HeyImAlex)\ **Replies:** 2\ **Last updated:** [June 5, 2017, 6:06pm UTC](https://discuss.elastic.co/t/publisher-client-publish-and-backpressure/88125 "2017-06-05T18:06:06Z")
I'm trying to do some work on journalbeat, but the specifics around how publisher#Client.Publish works are kinda murky to me. Just for context, journalbeat basically polls journald for new entries, so the "event source… --- ## [Filebeat re-opens a harvester for a inactive file](https://discuss.elastic.co/t/filebeat-re-opens-a-harvester-for-a-inactive-file/84903)
**Author:** [@sameer\_srivastava](https://discuss.elastic.co/u/sameer_srivastava)\ **Replies:** 6\ **Last updated:** [June 5, 2017, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-re-opens-a-harvester-for-a-inactive-file/84903 "2017-06-05T17:02:51Z")
We are using filebeat on windows 7 to send logs to kafka. Filebeat version used is 5.2.2. Filebeat.yml has config similar to following - paths: - somepath\\\*.txt input\_type: log document\_typ… --- ## [Filebeat is not sending logs to logstash getting A plugin had an unrecoverable error](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-getting-a-plugin-had-an-unrecoverable-error/87455)
**Author:** [@abinstephen1989](https://discuss.elastic.co/u/abinstephen1989)\ **Replies:** 7\ **Last updated:** [June 5, 2017, 11:57am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash-getting-a-plugin-had-an-unrecoverable-error/87455 "2017-06-05T11:57:36Z")
i am getting below error in logstash logs , Could you please help me to understand why i am getting this error \[2017-05-29T12:45:12,250\]\[ERROR\]\[logstash.pipeline \] A plugin had an unrecoverable error. Will res… --- ## [Filebeat unable to send logs to logstash](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 4\ **Last updated:** [June 5, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-to-logstash/88224 "2017-06-05T10:04:49Z")
Hi Team, While sending logs from one server to another server, i'm getting below error in filebeat. I'm using ELK 5.4 version and i'm sending logs through below order. filebeat-\>logstash-\>elasticsearch Since file… --- ## [Packetbeat template](https://discuss.elastic.co/t/packetbeat-template/88227)
**Author:** [@AadarshKumayan](https://discuss.elastic.co/u/AadarshKumayan)\ **Replies:** 3\ **Last updated:** [June 5, 2017, 7:38am UTC](https://discuss.elastic.co/t/packetbeat-template/88227 "2017-06-05T07:38:00Z")
Mapping conflict! A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable… --- ## [Multiline is not working when i am sending logs to logstash through filebeat?](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 4\ **Last updated:** [June 4, 2017, 9:09am UTC](https://discuss.elastic.co/t/multiline-is-not-working-when-i-am-sending-logs-to-logstash-through-filebeat/88170 "2017-06-04T09:09:42Z")
Hi, Logs: \[2017-05-25 01:00:00,647\]\[ERROR\]\[marvel.agent.exporter.local\] local exporter \[default\_local\] - ... \[2017-05-18 00:00:06,339\]\[DEBUG\]\[action.admin.indices.create\] \[data-2\] \[data-may-2017,data-apr-.. When i … --- ## [Forcing Filebeat to drop events when files deleted](https://discuss.elastic.co/t/forcing-filebeat-to-drop-events-when-files-deleted/86599)
**Author:** [@kjtsanaktsidis](https://discuss.elastic.co/u/kjtsanaktsidis)\ **Replies:** 6\ **Last updated:** [June 2, 2017, 10:51pm UTC](https://discuss.elastic.co/t/forcing-filebeat-to-drop-events-when-files-deleted/86599 "2017-06-02T22:51:33Z")
I'm trying to use Filebeat to ingest our rsyslogd logfiles and send them to logstash. Unfortunately we can send quite a large volume of logs sometimes, and have relatively small disks. We have logrotate configured to rot… --- ## [Jolokia Module No key error](https://discuss.elastic.co/t/jolokia-module-no-key-error/87979)
**Author:** [@joshuaclark](https://discuss.elastic.co/u/joshuaclark)\ **Replies:** 6\ **Last updated:** [June 2, 2017, 6:08pm UTC](https://discuss.elastic.co/t/jolokia-module-no-key-error/87979 "2017-06-02T18:08:18Z")
Hi I'm trying to grab JVM metrics from -mbean: 'mbean:type=FormatStatus,client=Client,format=Format,ftp=FtpId,FtpProtocol=sftp,FtpServer=server,FtpPort=22,dir=directory,filename=file.txt' attributes: -… --- ## [App for monitoring Kafka consumer lag](https://discuss.elastic.co/t/app-for-monitoring-kafka-consumer-lag/86311)
**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\ **Replies:** 6\ **Last updated:** [June 2, 2017, 3:54pm UTC](https://discuss.elastic.co/t/app-for-monitoring-kafka-consumer-lag/86311 "2017-06-02T15:54:22Z")
I am wondering if there is an alternative to Kafkabeat app to perform Kafka consumer lag monitoring. It looks like Metricbeat doesn't collect related metrics. --- ## [Issue with multiple outputs in filebeat](https://discuss.elastic.co/t/issue-with-multiple-outputs-in-filebeat/87939)
**Author:** [@Chaitra\_Ranganna](https://discuss.elastic.co/u/Chaitra_Ranganna)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 3:41pm UTC](https://discuss.elastic.co/t/issue-with-multiple-outputs-in-filebeat/87939 "2017-06-02T15:41:23Z")
Hi , I am looking for an option to send logs to multiple outputs . I tried configuring multiple outputs, if all the out puts are reachable then logs are sent successfully. But if one of the output is not reachable, th… --- ## [Share filebeat config file between filebeats instance](https://discuss.elastic.co/t/share-filebeat-config-file-between-filebeats-instance/87895)
**Author:** [@SteelCrow](https://discuss.elastic.co/u/SteelCrow)\ **Replies:** 3\ **Last updated:** [June 2, 2017, 2:38pm UTC](https://discuss.elastic.co/t/share-filebeat-config-file-between-filebeats-instance/87895 "2017-06-02T14:38:55Z")
Hi, guys! I'm just curious, does anyone try to share config file between \*beat instance. Fo exmaple I try to change config path in windows service: -path.data "\\\\10.254.23.58\\filebeat.yaml" but it seems isn't workin… --- ## [Does filebeat cache setting on service start?](https://discuss.elastic.co/t/does-filebeat-cache-setting-on-service-start/87983)
**Author:** [@boxkiller](https://discuss.elastic.co/u/boxkiller)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 1:08pm UTC](https://discuss.elastic.co/t/does-filebeat-cache-setting-on-service-start/87983 "2017-06-02T13:08:19Z")
We have filebeat 5.4.0 installed , it seems when we update the DNS record that points to our logstash servers the filebeat agent needs to be restarted before it will use the updated DNS record. The hosts filebeat is … --- ## [INFO No non-zero metrics in the last 30s](https://discuss.elastic.co/t/info-no-non-zero-metrics-in-the-last-30s/87960)
**Author:** [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 7:48am UTC](https://discuss.elastic.co/t/info-no-non-zero-metrics-in-the-last-30s/87960 "2017-06-02T07:48:37Z")
Hello, i have a question where i change non-zero metrics in the last 30s from 30s i want change to 10s. i already search the configuration about that but i can't find that --- ## [Recommended configuration for write once files](https://discuss.elastic.co/t/recommended-configuration-for-write-once-files/86782)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 8\ **Last updated:** [June 2, 2017, 7:19am UTC](https://discuss.elastic.co/t/recommended-configuration-for-write-once-files/86782 "2017-06-02T07:19:45Z")
Hi all, I am looking for the most efficient configuration for our use case. We have almost 2000 files to index each day coming from several directories. Each file needs to be read only once as it is never updated. … --- ## [Monitoring HTTPS](https://discuss.elastic.co/t/monitoring-https/87940)
**Author:** [@Gilberto](https://discuss.elastic.co/u/Gilberto)\ **Replies:** 1\ **Last updated:** [June 2, 2017, 1:42am UTC](https://discuss.elastic.co/t/monitoring-https/87940 "2017-06-02T01:42:20Z")
How can I monitoring Https with packetbeat? --- ## [How to remove certain Filebeat output fields](https://discuss.elastic.co/t/how-to-remove-certain-filebeat-output-fields/87825)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 2\ **Last updated:** [June 1, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-remove-certain-filebeat-output-fields/87825 "2017-06-01T17:11:16Z")
Hello, I started to play with filebeat, just set it up on my local box. I have a newbie question. I set the output to be local file right now, eventually i would like to set it to kafka. While I examined the output fr… --- ## [How to Configure FileBeat for Spark Headnode ( HDInsight Cluster in Azure)](https://discuss.elastic.co/t/how-to-configure-filebeat-for-spark-headnode-hdinsight-cluster-in-azure/87995)
**Author:** [@arvindsing](https://discuss.elastic.co/u/arvindsing)\ **Replies:** 0\ **Last updated:** [June 1, 2017, 10:18pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-for-spark-headnode-hdinsight-cluster-in-azure/87995 "2017-06-01T22:18:30Z")
Our logs are at DFS and we can access them using .... hadoop fs -cat wasbs://yourcontainer@youraccount.blob.core.windows.net/testDir/testFile test file content Now we want to configure filebeats here so that we can shi… --- ## [Problem with Tomcat multiline entries](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768)
**Author:** [@hanover23](https://discuss.elastic.co/u/hanover23)\ **Replies:** 1\ **Last updated:** [June 1, 2017, 8:19pm UTC](https://discuss.elastic.co/t/problem-with-tomcat-multiline-entries/87768 "2017-06-01T20:19:58Z")
Hey all - I'm trying to get filebeats to forward some of my Tomcat logs, but I can't seem to get the multiline stuff quite right. The log file is a mix of single-line entries and multiline. Any help would be appreciate… --- ## [\[Solved\] - Force filebeat to reship file](https://discuss.elastic.co/t/solved-force-filebeat-to-reship-file/44415)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 3\ **Last updated:** [June 1, 2017, 8:11pm UTC](https://discuss.elastic.co/t/solved-force-filebeat-to-reship-file/44415 "2017-06-01T20:11:54Z")
Hello, how to force filebeat to ship files again? I tried to stop service, remove registry file, touch log files (even to append dummy line) but no luck. 2016-03-15T10:52:58+01:00 DBG Check file for harvesting: /elas… --- ## [Specific mount point monitoring using Metricbeat](https://discuss.elastic.co/t/specific-mount-point-monitoring-using-metricbeat/87548)
**Author:** [@raazeev64](https://discuss.elastic.co/u/raazeev64)\ **Replies:** 2\ **Last updated:** [June 1, 2017, 7:01pm UTC](https://discuss.elastic.co/t/specific-mount-point-monitoring-using-metricbeat/87548 "2017-06-01T19:01:32Z")
I want to monitor only limited number of mount points using metric beat. How do I filter out the rest? I did come across a filter - filters: - drop\_event.when.regexp.mount\_point: '^/(sys|cgroup|proc|dev|etc|host)($|… --- ## [Connecting error publishing events (retrying)](https://discuss.elastic.co/t/connecting-error-publishing-events-retrying/87610)
**Author:** [@Ranjeet\_Ranjan](https://discuss.elastic.co/u/Ranjeet_Ranjan)\ **Replies:** 4\ **Last updated:** [June 1, 2017, 5:44pm UTC](https://discuss.elastic.co/t/connecting-error-publishing-events-retrying/87610 "2017-06-01T17:44:17Z")
Hi, I am getting below error after installing X-pack. Connecting error publishing events (retrying): dial tcp 192.168.154.170:5044: getsockopt: connection refused Here is my filebeat.yml ###########################… --- ## [Filebeat.yml](https://discuss.elastic.co/t/filebeat-yml/87875)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 2\ **Last updated:** [June 1, 2017, 3:51pm UTC](https://discuss.elastic.co/t/filebeat-yml/87875 "2017-06-01T15:51:25Z")
I have migrated my filebeat to latest 5.4 and changed the filebeat.yml to latest config as below and sending output to logstash. But when i restart the filebeat service using /etc/init.d/filebeat restart it is giving the… --- ## [How to tail log file continuously for new log entries?](https://discuss.elastic.co/t/how-to-tail-log-file-continuously-for-new-log-entries/87814)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 8\ **Last updated:** [June 1, 2017, 3:38pm UTC](https://discuss.elastic.co/t/how-to-tail-log-file-continuously-for-new-log-entries/87814 "2017-06-01T15:38:30Z")
Hi , I am trying to tail log file with updating new log entries coming in log file . But with my current configuration its not working . Its starting it from first log entry when i start agent and it does not work if … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=518) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=520)