# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=520 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 521 --- ## [\[Solved\] Filebeat -\> Logstash : connection reset by peer](https://discuss.elastic.co/t/solved-filebeat-logstash-connection-reset-by-peer/87012)
**Author:** [@CyrilD](https://discuss.elastic.co/u/CyrilD)\ **Replies:** 4\ **Last updated:** [June 1, 2017, 2:41pm UTC](https://discuss.elastic.co/t/solved-filebeat-logstash-connection-reset-by-peer/87012 "2017-06-01T14:41:53Z")
Hi there ! I'm testing a pipe like that for dumping my logs : filebeat -\> logstash -\> elasticsearch and I have strange errors from filebeat : 2017-05-24T18:08:51+02:00 DBG Try to publish 2 events to logstash with wi… --- ## [Filebeat: Read the whole file every X regardless if it has changed or not](https://discuss.elastic.co/t/filebeat-read-the-whole-file-every-x-regardless-if-it-has-changed-or-not/87909)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 0\ **Last updated:** [June 1, 2017, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-read-the-whole-file-every-x-regardless-if-it-has-changed-or-not/87909 "2017-06-01T12:38:17Z")
I have a few "state" files that change every now and then but I would like Filebeat to read each file either when it changes or every X, and not just read the latest line but read the whole file. What complicates thing… --- ## [Filebeat sending data to Logstash seems too slow](https://discuss.elastic.co/t/filebeat-sending-data-to-logstash-seems-too-slow/37596)
**Author:** [@bluesman](https://discuss.elastic.co/u/bluesman)\ **Replies:** 19\ **Last updated:** [June 1, 2017, 12:34pm UTC](https://discuss.elastic.co/t/filebeat-sending-data-to-logstash-seems-too-slow/37596 "2017-06-01T12:34:27Z")
Hello, I'm trying out filebeat and Beat protocol with RPM Filebeat 1.0.0 and RPM Logstash 2.1.0 on two separated machine with 4 VCPU and 16 GB of RAM, Gigabit and SSD disk. I've configured filebeat to send 250GB of pla… --- ## [Unable to map Filebeat in Kibana (5.4.0)](https://discuss.elastic.co/t/unable-to-map-filebeat-in-kibana-5-4-0/87742)
**Author:** [@BMV](https://discuss.elastic.co/u/BMV)\ **Replies:** 3\ **Last updated:** [June 1, 2017, 7:20am UTC](https://discuss.elastic.co/t/unable-to-map-filebeat-in-kibana-5-4-0/87742 "2017-06-01T07:20:43Z")
Hi there, I am having some trouble mapping Filebeat in Kibana after doing a clean install to 5.4.0. I have followed the Filebeat guide and have attempted to get it working for a while with no success. I have added a scr… --- ## [Can FileBeat correctly handle log rotation and network disruption/failure mode?](https://discuss.elastic.co/t/can-filebeat-correctly-handle-log-rotation-and-network-disruption-failure-mode/87314)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 4\ **Last updated:** [May 31, 2017, 7:46pm UTC](https://discuss.elastic.co/t/can-filebeat-correctly-handle-log-rotation-and-network-disruption-failure-mode/87314 "2017-05-31T19:46:18Z")
Hello, there, In our log system, our local log files is automatically rotated, for example, every hour or every midnight, the current log file (e.g., myapp.log) will be renamed (maybe be also compressed) to myapp.l… --- ## [Metricbeat 5.4.0 Jolokia module](https://discuss.elastic.co/t/metricbeat-5-4-0-jolokia-module/86319)
**Author:** [@joshuaclark](https://discuss.elastic.co/u/joshuaclark)\ **Replies:** 8\ **Last updated:** [May 31, 2017, 5:45pm UTC](https://discuss.elastic.co/t/metricbeat-5-4-0-jolokia-module/86319 "2017-05-31T17:45:32Z")
Hi, I'm trying to use the Jolokia module. When I try to start metricbeats it gives me an error "missing required field accessing 'metricbeat.modules.1.jmx.mappings'" when I try to start metricbeats. This is my config … --- ## [Issue with Filebeat and Multiple Logstash Conf files](https://discuss.elastic.co/t/issue-with-filebeat-and-multiple-logstash-conf-files/87301)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [May 31, 2017, 2:21pm UTC](https://discuss.elastic.co/t/issue-with-filebeat-and-multiple-logstash-conf-files/87301 "2017-05-31T14:21:21Z")
I have 2 Logstash.conf files under Configurations folder. Logstash is configured to run using logstash -f \\Configurations command. 2 conf files are nothing but IIS.conf and Services.conf Everything worked smoothly usin… --- ## [Filebeat error not sending logs](https://discuss.elastic.co/t/filebeat-error-not-sending-logs/87588)
**Author:** [@sravankumarch](https://discuss.elastic.co/u/sravankumarch)\ **Replies:** 22\ **Last updated:** [May 31, 2017, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-error-not-sending-logs/87588 "2017-05-31T13:10:05Z")
filebeat.service - filebeat Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: Active: inactive (dead) (Result: exit-code) since Tue 2017-05-30 12:28:22 UTC Docs: https://www.elastic.co/guide/… --- ## [Packetbeat 5.4.0 can't sniff tun device - raw ip datalink](https://discuss.elastic.co/t/packetbeat-5-4-0-cant-sniff-tun-device-raw-ip-datalink/87710)
**Author:** [@Giacomo\_Milani](https://discuss.elastic.co/u/Giacomo_Milani)\ **Replies:** 5\ **Last updated:** [May 31, 2017, 11:28am UTC](https://discuss.elastic.co/t/packetbeat-5-4-0-cant-sniff-tun-device-raw-ip-datalink/87710 "2017-05-31T11:28:30Z")
VPN softwares like OpenVPN create on linux "tun devices", a network device that represents the network tunnel and presents directly IP frames (without datalink) to the operative system. Tun devices are preferred than TAP… --- ## [Filebeat: how to define a date pattern fo prospector's path?](https://discuss.elastic.co/t/filebeat-how-to-define-a-date-pattern-fo-prospectors-path/87697)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [May 31, 2017, 9:43am UTC](https://discuss.elastic.co/t/filebeat-how-to-define-a-date-pattern-fo-prospectors-path/87697 "2017-05-31T09:43:50Z")
Hi, I have logs which are named like mylog-20170531.log. The logs are pre-rotated at midnight UTC. If I define path/mylog-\*.log It would read all logfiles, regardless of the date, if they have been created / modified… --- ## [Filebeat: read allways from beginning, even if no update](https://discuss.elastic.co/t/filebeat-read-allways-from-beginning-even-if-no-update/87702)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [May 31, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-read-allways-from-beginning-even-if-no-update/87702 "2017-05-31T09:31:28Z")
Hi, when developing new filters usually do it locally on my machine. In my current setup I allways need to add new lines to a sample logfile. Is it also possible to configure filebeat this way, that it ships the conf… --- ## [Thread consumption in Filebeats](https://discuss.elastic.co/t/thread-consumption-in-filebeats/87313)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 3\ **Last updated:** [May 31, 2017, 8:46am UTC](https://discuss.elastic.co/t/thread-consumption-in-filebeats/87313 "2017-05-31T08:46:38Z")
Hello, I have a question on Filebeat internal: From reading Filebeat documentation "https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html", One harvester is started for each file. I am wonderin… --- ## [Packetbeat debugging - no file output](https://discuss.elastic.co/t/packetbeat-debugging-no-file-output/87496)
**Author:** [@tiburblium](https://discuss.elastic.co/u/tiburblium)\ **Replies:** 4\ **Last updated:** [May 31, 2017, 8:26am UTC](https://discuss.elastic.co/t/packetbeat-debugging-no-file-output/87496 "2017-05-31T08:26:54Z")
I am trying to debug my standalone installation of packetbeat, which I've configured to output to a file. I am not getting any file output and I'm not clear on how to get more information on what the problem would be. Ap… --- ## [NGINX module grok error](https://discuss.elastic.co/t/nginx-module-grok-error/86109)
**Author:** [@Andarius](https://discuss.elastic.co/u/Andarius)\ **Replies:** 15\ **Last updated:** [May 31, 2017, 8:09am UTC](https://discuss.elastic.co/t/nginx-module-grok-error/86109 "2017-05-31T08:09:33Z")
Hi, I'm trying to use the NGINX module on the output of my docker logs. So far I managed to get as output: { "@timestamp": "2017-05-17T13:12:48.507Z", "beat": { "hostname": "86ba9026f4b1", "name": "86ba90… --- ## [Topbeat logs not showed in kibana](https://discuss.elastic.co/t/topbeat-logs-not-showed-in-kibana/87536)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 4\ **Last updated:** [May 31, 2017, 8:05am UTC](https://discuss.elastic.co/t/topbeat-logs-not-showed-in-kibana/87536 "2017-05-31T08:05:27Z")
Hi, This is weird because yesterday i could see a graphic with topbeat metrics. However, sinoce 02:00 am i can't se anything coming from topbeat i kibana. Although the logs are received in elasticsearch. What can i do … --- ## [Understanding cpu metrics](https://discuss.elastic.co/t/understanding-cpu-metrics/87544)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [May 31, 2017, 7:41am UTC](https://discuss.elastic.co/t/understanding-cpu-metrics/87544 "2017-05-31T07:41:10Z")
Hi all, I am running ELK 5.1.2 as single instance on RHEL7.x. I also installed basic license to activate monitoring. We made some loadtest of a new application which should be monitored in ELK, which contained a new lo… --- ## [Filebeat throwing exception with increased value of max\_bytes](https://discuss.elastic.co/t/filebeat-throwing-exception-with-increased-value-of-max-bytes/87400)
**Author:** [@sumit\_monga](https://discuss.elastic.co/u/sumit_monga)\ **Replies:** 6\ **Last updated:** [May 31, 2017, 6:01am UTC](https://discuss.elastic.co/t/filebeat-throwing-exception-with-increased-value-of-max-bytes/87400 "2017-05-31T06:01:22Z")
I have a problem where I need to read a big xml file (say about 50 MB) through Filebeat and then send this whole content as a single event to logstash which will then use some filters such as xml , mutate etc and finall… --- ## [Topbeat Dashboard not working](https://discuss.elastic.co/t/topbeat-dashboard-not-working/87372)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [May 31, 2017, 3:59am UTC](https://discuss.elastic.co/t/topbeat-dashboard-not-working/87372 "2017-05-31T03:59:27Z")
I have Elastic, logstash, FB and kibana configured. Recently, I have added the topbeat on one of my server and have installed the beats dashboard. But when I try viewing the topbeat dashboard i see below error ... I… --- ## [Monitor the presence of a file](https://discuss.elastic.co/t/monitor-the-presence-of-a-file/87580)
**Author:** [@raazeev64](https://discuss.elastic.co/u/raazeev64)\ **Replies:** 1\ **Last updated:** [May 30, 2017, 4:04pm UTC](https://discuss.elastic.co/t/monitor-the-presence-of-a-file/87580 "2017-05-30T16:04:14Z")
I have an assignment at hand where we need to migrate from Nagios to ELK. There was an option to monitor the presence of a file in Nagios. Can this be achieved in ELK also?. Metricbeat especially. --- ## [Filebeat locking the file](https://discuss.elastic.co/t/filebeat-locking-the-file/87514)
**Author:** [@arya](https://discuss.elastic.co/u/arya)\ **Replies:** 2\ **Last updated:** [May 30, 2017, 2:14pm UTC](https://discuss.elastic.co/t/filebeat-locking-the-file/87514 "2017-05-30T14:14:18Z")
Hi , Will filebeat locks the files if logstash is down in the receiving end? I couldn't telnet from my filebeat server to logstash. I restarted logstash service and getting the below error even after logstash is up(te… --- ## [Packetbeat HighCPU monitoring memcache](https://discuss.elastic.co/t/packetbeat-highcpu-monitoring-memcache/86811)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 7\ **Last updated:** [May 30, 2017, 1:55pm UTC](https://discuss.elastic.co/t/packetbeat-highcpu-monitoring-memcache/86811 "2017-05-30T13:55:25Z")
Hi, I have been monitoring our memcached servers with packetbeat. This was noticed after deploying packetbeat 5.4.0, it may have been happening before, but I'm not 100% sure. I will consistently get packetbeat taking … --- ## [Topbeat processes name](https://discuss.elastic.co/t/topbeat-processes-name/87464)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 1\ **Last updated:** [May 30, 2017, 9:27am UTC](https://discuss.elastic.co/t/topbeat-processes-name/87464 "2017-05-30T09:27:46Z")
Hi, My question is simple. Topbeat sends information to elasticsearch and it is showed through kibana. I don't know why, i have some process names that are numbers. I checked on the server where topbeat is installed if… --- ## [Mysql module in metricbeats is displaying negative values](https://discuss.elastic.co/t/mysql-module-in-metricbeats-is-displaying-negative-values/87501)
**Author:** [@shivnath](https://discuss.elastic.co/u/shivnath)\ **Replies:** 2\ **Last updated:** [May 30, 2017, 9:01am UTC](https://discuss.elastic.co/t/mysql-module-in-metricbeats-is-displaying-negative-values/87501 "2017-05-30T09:01:33Z")
I am seeing negative values for some of the fields. Please see attached screenshots. This happened when I stopped the MySQL database for some time. My version: yum list | grep metricbeat metricbeat.x86\_64 … --- ## [Filebeat holding deleted files which consumes disk space](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415)
**Author:** [@arya](https://discuss.elastic.co/u/arya)\ **Replies:** 5\ **Last updated:** [May 30, 2017, 8:41am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415 "2017-05-30T08:41:58Z")
Filebeat process in the server is holding the deleted files which are forwarded by logstash forwarder which makes the server disk space full. Currently a cron job is in place to restart filebeat at regular intervals. Bu… --- ## [Arithmetical operations on fields?](https://discuss.elastic.co/t/arithmetical-operations-on-fields/87446)
**Author:** [@fbonningues](https://discuss.elastic.co/u/fbonningues)\ **Replies:** 3\ **Last updated:** [May 29, 2017, 4:29pm UTC](https://discuss.elastic.co/t/arithmetical-operations-on-fields/87446 "2017-05-29T16:29:21Z")
Hi, I currently using metricbeat-5.4. I monitor some metrics and I add some fields on documents but can I make some arithmetical operations on fields ? Thanks --- ## [Filebeat in windows is unable to send logs to logstash in Ubuntu server](https://discuss.elastic.co/t/filebeat-in-windows-is-unable-to-send-logs-to-logstash-in-ubuntu-server/87344)
**Author:** [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)\ **Replies:** 31\ **Last updated:** [May 29, 2017, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-in-windows-is-unable-to-send-logs-to-logstash-in-ubuntu-server/87344 "2017-05-29T15:31:00Z")
My filebeat in windows runs fine. but i am unable to send logs from filebeat in windows to logstash in ubuntu server. Im running both windows and ubuntu in VM's. Here is my config file and the error. filebeat.prospecto… --- ## [\[6.0.0alpha\] Packetbeat - multiple types](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220)
**Author:** [@Oozza](https://discuss.elastic.co/u/Oozza)\ **Replies:** 7\ **Last updated:** [May 29, 2017, 3:14pm UTC](https://discuss.elastic.co/t/6-0-0alpha-packetbeat-multiple-types/87220 "2017-05-29T15:14:52Z")
While running fresh Elastic stack version 6.0.0 alpha, most Packetbeat events cannot be indexed. I have loaded Packetbeat template into Elasticsearch before running Logstash and Packetbeat. Logstash only indexes even… --- ## [Stop Filbeat service if no LS/ES connection after some time?](https://discuss.elastic.co/t/stop-filbeat-service-if-no-ls-es-connection-after-some-time/85803)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 4\ **Last updated:** [May 29, 2017, 2:46pm UTC](https://discuss.elastic.co/t/stop-filbeat-service-if-no-ls-es-connection-after-some-time/85803 "2017-05-29T14:46:57Z")
Hi All, I'm new to this discussion webpage but have been using the ELK stack for a fair amount of time now, and this page been a great help for me. I was recently looking into the full config yml file for Filebeat a… --- ## [Bulk Size error on filebeat](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 4\ **Last updated:** [May 29, 2017, 1:47pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373 "2017-05-29T13:47:33Z")
Hi there I'm seeing this on filebeat log file that I found just by accident while debuggin an issue. 2017-05-28T18:35:26Z INFO Error publishing events (retrying): 413 Request Entity Too Large In the configuration fil… --- ## [Windows module - The specified object was not found](https://discuss.elastic.co/t/windows-module-the-specified-object-was-not-found/86983)
**Author:** [@Jeff\_Davis](https://discuss.elastic.co/u/Jeff_Davis)\ **Replies:** 5\ **Last updated:** [May 29, 2017, 8:45am UTC](https://discuss.elastic.co/t/windows-module-the-specified-object-was-not-found/86983 "2017-05-29T08:45:06Z")
I am testing the new Windows module in metricbeat-6.0.0-alpha1 on Windows 7 and Windows 10 machines. I am very excited about this functionality! The issue/concern I have is if the perfmon counter does not exist on the… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=519) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=521)