# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=521 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 522 --- ## [Very long to load prospectors and start harvesting](https://discuss.elastic.co/t/very-long-to-load-prospectors-and-start-harvesting/86625)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 8\ **Last updated:** [May 29, 2017, 8:07am UTC](https://discuss.elastic.co/t/very-long-to-load-prospectors-and-start-harvesting/86625 "2017-05-29T08:07:04Z")
Hi all, We are encountering a strange behaviour with filebeat. Let me explain our use case as it is not the typical goal of the filebeat log prospector : We use filebeat with 5 log prospectors. Each prospector obs… --- ## [Filebeat has to be restarted to send logs to elasticsearch](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330)
**Author:** [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)\ **Replies:** 7\ **Last updated:** [May 27, 2017, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330 "2017-05-27T19:10:21Z")
I can see that logs are added only after i restart filebeat in client machine. Everytime I have to restart to get the logs updated. Need help in figuring out where the fault is. Thanks in advance. --- ## [Indexes being created as %{\[@metadata\]\[beat\]}-2017.05.26 instead of "filebeat-2017.05.26"](https://discuss.elastic.co/t/indexes-being-created-as-metadata-beat-2017-05-26-instead-of-filebeat-2017-05-26/87290)
**Author:** [@Landon\_Edwards](https://discuss.elastic.co/u/Landon_Edwards)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 8:28pm UTC](https://discuss.elastic.co/t/indexes-being-created-as-metadata-beat-2017-05-26-instead-of-filebeat-2017-05-26/87290 "2017-05-26T20:28:46Z")
I am having a similar issue to this thread, but the solution does not appear to be the same for me, and I have not been able to figure out how to fix it. I am actually thinking the issue may be with filebeat, and not log… --- ## [Can I turn the path (or parts of it) into a variable?](https://discuss.elastic.co/t/can-i-turn-the-path-or-parts-of-it-into-a-variable/87129)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 12:16pm UTC](https://discuss.elastic.co/t/can-i-turn-the-path-or-parts-of-it-into-a-variable/87129 "2017-05-26T12:16:54Z")
I want to ship some syslog out from our syslog server into Elastic, and obviously Filebeat works for this. But I want to send part of the path as a variable within the beat. So, for instance, my path will look like /… --- ## [Filebeat decode\_json\_fields Can not index event](https://discuss.elastic.co/t/filebeat-decode-json-fields-can-not-index-event/85074)
**Author:** [@Jeff](https://discuss.elastic.co/u/Jeff)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 9:56am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-can-not-index-event/85074 "2017-05-26T09:56:48Z")
I have a log event where the field "log" has the value (JSON): {“caller”:“server.go:53",“msg”:“server starting”,“port”:8080} In our filebeat configuration, we have the config: processors: - decode\_json\_fields: f… --- ## [Filebeat preventing freeing up disk space](https://discuss.elastic.co/t/filebeat-preventing-freeing-up-disk-space/87179)
**Author:** [@rrs](https://discuss.elastic.co/u/rrs)\ **Replies:** 1\ **Last updated:** [May 26, 2017, 8:30am UTC](https://discuss.elastic.co/t/filebeat-preventing-freeing-up-disk-space/87179 "2017-05-26T08:30:20Z")
Hello, We have filebeat-1.2.3-1 installed configured. Since it running so far, we faced an issue with disk space being prevented by filebeat, which required restarting filebeat periodically. Can anyone please help t… --- ## [Filebeat harvester picks up files in random order when scanning](https://discuss.elastic.co/t/filebeat-harvester-picks-up-files-in-random-order-when-scanning/86542)
**Author:** [@menezeswayne](https://discuss.elastic.co/u/menezeswayne)\ **Replies:** 7\ **Last updated:** [May 26, 2017, 7:02am UTC](https://discuss.elastic.co/t/filebeat-harvester-picks-up-files-in-random-order-when-scanning/86542 "2017-05-26T07:02:33Z")
I used the harvester\_limit: 1 option along with close\_inactive option to close a file after 1 min. This works for my use case. However when there are multiple older log files to be harvested, filebeat picks up the files … --- ## [Filebeat input paths](https://discuss.elastic.co/t/filebeat-input-paths/86809)
**Author:** [@kalman](https://discuss.elastic.co/u/kalman)\ **Replies:** 3\ **Last updated:** [May 26, 2017, 5:49am UTC](https://discuss.elastic.co/t/filebeat-input-paths/86809 "2017-05-26T05:49:57Z")
I'm working on a system that is monitoring logs files from a about 10 network paths. both the log files and the elastic will be running on windows mentions. I wanted to know if filebeat can handle the number of network p… --- ## [Tomcat HTTP requests are not showing up in kibana](https://discuss.elastic.co/t/tomcat-http-requests-are-not-showing-up-in-kibana/87101)
**Author:** [@sksamy](https://discuss.elastic.co/u/sksamy)\ **Replies:** 5\ **Last updated:** [May 25, 2017, 1:14pm UTC](https://discuss.elastic.co/t/tomcat-http-requests-are-not-showing-up-in-kibana/87101 "2017-05-25T13:14:19Z")
I installed Elastic Search, Kibana and Packet Beat. I have apache tomcat running on my same windows machine. localhost:8080 requests are not showing up. packetbeat.yml file #################### Packetbeat Configura… --- ## [Filebeat index pattern](https://discuss.elastic.co/t/filebeat-index-pattern/86837)
**Author:** [@Bouali\_Inass](https://discuss.elastic.co/u/Bouali_Inass)\ **Replies:** 6\ **Last updated:** [May 25, 2017, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-index-pattern/86837 "2017-05-25T13:11:11Z")
Hey i just installed a kibana and elasticsearch and logstash on a server and filebeat on a nother server that has apache logs and i wanna monitor those logs on kibana. I'm not sur what i've done is right ?? the problem… --- ## [Filebeat -\> logstash -\> kibana](https://discuss.elastic.co/t/filebeat-logstash-kibana/86641)
**Author:** [@Globule](https://discuss.elastic.co/u/Globule)\ **Replies:** 1\ **Last updated:** [May 25, 2017, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-logstash-kibana/86641 "2017-05-25T12:46:41Z")
Hi, I send my apache log filebeat -\> logstash in kibana I see this: { "@timestamp": "2017-05-22T09:23:33.000Z", "apache2": { "access": { "referrer": "-", "response\_code": "200", "remote\_ip": "80.12.110.201", "geo… --- ## [Docker module: Can't connect to /var/run/docker.sock](https://discuss.elastic.co/t/docker-module-cant-connect-to-var-run-docker-sock/86835)
**Author:** [@BeLi4L](https://discuss.elastic.co/u/BeLi4L)\ **Replies:** 1\ **Last updated:** [May 25, 2017, 12:39pm UTC](https://discuss.elastic.co/t/docker-module-cant-connect-to-var-run-docker-sock/86835 "2017-05-25T12:39:49Z")
Hi, I'm running metricbeat with the docker module, with the following configuration: metricbeat.modules: - module: docker period: 20s metricsets: - container - cpu - diskio - image - info - … --- ## [Heartbeat ssl self signed certificate](https://discuss.elastic.co/t/heartbeat-ssl-self-signed-certificate/86830)
**Author:** [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\ **Replies:** 1\ **Last updated:** [May 25, 2017, 12:12pm UTC](https://discuss.elastic.co/t/heartbeat-ssl-self-signed-certificate/86830 "2017-05-25T12:12:57Z")
Hi I'm new in the ELK stack , I've configured some things , now I'm trying to monitor the urls with heartbeat , the problem is that one of my urls is configured using self signed ssl certificate , is there any heartbeat… --- ## [Winlogbeat not creating index in Elastic Search](https://discuss.elastic.co/t/winlogbeat-not-creating-index-in-elastic-search/85658)
**Author:** [@ONeil](https://discuss.elastic.co/u/ONeil)\ **Replies:** 6\ **Last updated:** [May 25, 2017, 2:15am UTC](https://discuss.elastic.co/t/winlogbeat-not-creating-index-in-elastic-search/85658 "2017-05-25T02:15:36Z")
I've configured winlogbeat already and I'm trying to get it to populate records in elasticsearch. This is the error I'm getting when I try to check if elastic search has created an index for winlogbeat. Mind you I'm new … --- ## [Beat.name not populated with logstash output](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419)
**Author:** [@christiaanvanaken](https://discuss.elastic.co/u/christiaanvanaken)\ **Replies:** 7\ **Last updated:** [May 24, 2017, 7:47pm UTC](https://discuss.elastic.co/t/beat-name-not-populated-with-logstash-output/86419 "2017-05-24T19:47:02Z")
Data from Metricbeat is send to my central Logstash server and from there the output goes to Elasticsearch. If I do this, the field beat.name is always empty. If I change the Metricbeat configuration to send it to Elasti… --- ## [Import Saved Windows Event Logs](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302)
**Author:** [@Gregory\_Green](https://discuss.elastic.co/u/Gregory_Green)\ **Replies:** 4\ **Last updated:** [May 16, 2017, 9:47pm UTC](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302 "2017-05-16T21:47:30Z")
Hello, I have .evtx logs saved to CD/DVDs that I would like elasticsearch to ingest. Is there a way to change the path that winlogbeat uses to check for logs? I've tried converting them to .csv files and utilizing file… --- ## [Best beat to get tcp package losses](https://discuss.elastic.co/t/best-beat-to-get-tcp-package-losses/86821)
**Author:** [@isaacpm](https://discuss.elastic.co/u/isaacpm)\ **Replies:** 2\ **Last updated:** [May 23, 2017, 4:08pm UTC](https://discuss.elastic.co/t/best-beat-to-get-tcp-package-losses/86821 "2017-05-23T16:08:27Z")
Hi, we are trying to get statistics on packet losses and connection resets from TCP. I've tried flows but it doesn't know how many packages are lost and I can't see if there are any counts of the resets. I was wonderin… --- ## [Filebeat performance issue](https://discuss.elastic.co/t/filebeat-performance-issue/86558)
**Author:** [@kalman](https://discuss.elastic.co/u/kalman)\ **Replies:** 3\ **Last updated:** [May 23, 2017, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-performance-issue/86558 "2017-05-23T13:57:58Z")
I'm using filebeat 5.4.4 on windows to harvest from log file directly to elastic stack, the requirement is that the logs come in to elastic as soon as possible (near real-time). for some reson the logs only show up in ki… --- ## [Filebeat sends health metrics to elasticsearch?](https://discuss.elastic.co/t/filebeat-sends-health-metrics-to-elasticsearch/86774)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 1\ **Last updated:** [May 23, 2017, 1:49pm UTC](https://discuss.elastic.co/t/filebeat-sends-health-metrics-to-elasticsearch/86774 "2017-05-23T13:49:00Z")
Does filebeat have a feature to send its own metrics to elasticsearch ? I saw an issue #463 was raised and closed, but failed to find how to configure it. --- ## [How can I overwrite default index pattern name while importing dashboards for beats](https://discuss.elastic.co/t/how-can-i-overwrite-default-index-pattern-name-while-importing-dashboards-for-beats/85857)
**Author:** [@zaqweb](https://discuss.elastic.co/u/zaqweb)\ **Replies:** 9\ **Last updated:** [May 23, 2017, 1:43pm UTC](https://discuss.elastic.co/t/how-can-i-overwrite-default-index-pattern-name-while-importing-dashboards-for-beats/85857 "2017-05-23T13:43:23Z")
I've installed Filebeat and Metricbeat via YUM repo. And everything runs ok. now, I have a problem to overwrite default index pattern name. no matter I use ./script/importdashboards -i\_ or dashboards.index: customize-m… --- ## [File Diff Beat or File Meta Beat](https://discuss.elastic.co/t/file-diff-beat-or-file-meta-beat/86683)
**Author:** [@pat\_hougi](https://discuss.elastic.co/u/pat_hougi)\ **Replies:** 1\ **Last updated:** [May 23, 2017, 1:03pm UTC](https://discuss.elastic.co/t/file-diff-beat-or-file-meta-beat/86683 "2017-05-23T13:03:50Z")
Hi There, I have a microService that computes diffs for config files, stores it off to a graphDB and does all sorts versioning and other fun stuff. I want to see if it's possible to use Beats and Logstash to invoke … --- ## [ERR SSL client failed to connect with: read tcp -\>:5044: i/o timeout in kubernetes](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-read-tcp-5044-i-o-timeout-in-kubernetes/85712)
**Author:** [@rohan89](https://discuss.elastic.co/u/rohan89)\ **Replies:** 7\ **Last updated:** [May 23, 2017, 12:54pm UTC](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-read-tcp-5044-i-o-timeout-in-kubernetes/85712 "2017-05-23T12:54:40Z")
Hi, I have created a one filebeat docker image. which i am using in kubernetes cluster. I am getting the below error. transport.go:125: ERR SSL client failed to connect with: dial tcp 172.35.5.125:5044: getsockopt: con… --- ## [Filebeat does not release log files issue](https://discuss.elastic.co/t/filebeat-does-not-release-log-files-issue/85971)
**Author:** [@can.zhang](https://discuss.elastic.co/u/can.zhang)\ **Replies:** 18\ **Last updated:** [May 23, 2017, 12:52pm UTC](https://discuss.elastic.co/t/filebeat-does-not-release-log-files-issue/85971 "2017-05-23T12:52:50Z")
My Filebeat version is 1.3.1(amd64) filebeat.yml config like this: - paths: - /opt/mateinfo/logs/app/app.log input\_type: log fields: log\_format: wfm\_log4j fields\_under\_root: … --- ## [Filebeat Apache2 module vs Logstash parsing](https://discuss.elastic.co/t/filebeat-apache2-module-vs-logstash-parsing/86643)
**Author:** [@povils](https://discuss.elastic.co/u/povils)\ **Replies:** 1\ **Last updated:** [May 23, 2017, 12:47pm UTC](https://discuss.elastic.co/t/filebeat-apache2-module-vs-logstash-parsing/86643 "2017-05-23T12:47:21Z")
Hey, When I should use filebeat apache2 module and when I should use Logstash grok for parsing apache access log? It seems they doing pretty same job. Regards --- ## [Metricbeat post in every index](https://discuss.elastic.co/t/metricbeat-post-in-every-index/86639)
**Author:** [@ImJezz](https://discuss.elastic.co/u/ImJezz)\ **Replies:** 1\ **Last updated:** [May 23, 2017, 12:41pm UTC](https://discuss.elastic.co/t/metricbeat-post-in-every-index/86639 "2017-05-23T12:41:16Z")
Hello, I am trying to combine data in a way that everything will be clean and seperated. I am using a index for the database information and another index for metricbeat. For the combined data of those two, I use the sa… --- ## [Filebeat output to logstash](https://discuss.elastic.co/t/filebeat-output-to-logstash/82177)
**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\ **Replies:** 16\ **Last updated:** [May 23, 2017, 12:31pm UTC](https://discuss.elastic.co/t/filebeat-output-to-logstash/82177 "2017-05-23T12:31:46Z")
So am using filebeat to fetch 3 types of logs from websphere paths: - /opt/IBM/HTTPServer/logs/access\_log document\_type: access\_log - paths: - /opt/IBM/WebSphere/AppServer/profiles/WP… --- ## [Best configuration to avoid message loss due to inode reuse?](https://discuss.elastic.co/t/best-configuration-to-avoid-message-loss-due-to-inode-reuse/86014)
**Author:** [@Grundlefleck](https://discuss.elastic.co/u/Grundlefleck)\ **Replies:** 4\ **Last updated:** [May 23, 2017, 11:07am UTC](https://discuss.elastic.co/t/best-configuration-to-avoid-message-loss-due-to-inode-reuse/86014 "2017-05-23T11:07:14Z")
I am using Filebeat to read a set of files logged using the Java Logback library. Files are named with the format "prefix-%d{yyyy-MM-dd}.%i.json", where %i is an index that is incremented when Logback rolls over. Logback… --- ## [Install Filebeat in remote server (Different from log servers)](https://discuss.elastic.co/t/install-filebeat-in-remote-server-different-from-log-servers/86692)
**Author:** [@ThaPoox](https://discuss.elastic.co/u/ThaPoox)\ **Replies:** 1\ **Last updated:** [May 23, 2017, 7:57am UTC](https://discuss.elastic.co/t/install-filebeat-in-remote-server-different-from-log-servers/86692 "2017-05-23T07:57:24Z")
I have 4 servers to check logs from, but I don't have access to install stuff in them, so I can't install Filebeat there. So I installed Filebeat locally (Just to test), and I was wondering if there's any way to get the … --- ## [FileBeat Output to Solr](https://discuss.elastic.co/t/filebeat-output-to-solr/86450)
**Author:** [@Raja.Rangineni](https://discuss.elastic.co/u/Raja.Rangineni)\ **Replies:** 2\ **Last updated:** [May 22, 2017, 5:39pm UTC](https://discuss.elastic.co/t/filebeat-output-to-solr/86450 "2017-05-22T17:39:05Z")
Hi Filebeat Community, I have requirement to use Filebeat to collect logs and push them into Solr(SolrCloud cluster) directly as the client doesn't want use any management/enrichment layer like LogStash in the pipeline… --- ## [Filebeat didn't drop some of the fields](https://discuss.elastic.co/t/filebeat-didnt-drop-some-of-the-fields/86545)
**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\ **Replies:** 1\ **Last updated:** [May 22, 2017, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-didnt-drop-some-of-the-fields/86545 "2017-05-22T13:17:55Z")
I am trying to drop some not needed fields with Filebeat: filebeat.yml: filebeat.prospectors: - input\_type: log paths: - /var/log/app1.log fields: app\_name: app1 fields\_under\_root: true processors: - d… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=520) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=522)