# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=522 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 523 --- ## [Some lines sent to Logstash are truncated](https://discuss.elastic.co/t/some-lines-sent-to-logstash-are-truncated/79900)
**Author:** [@Pierre\_Vincent\_Ledou](https://discuss.elastic.co/u/Pierre_Vincent_Ledou)\ **Replies:** 14\ **Last updated:** [May 22, 2017, 11:51am UTC](https://discuss.elastic.co/t/some-lines-sent-to-logstash-are-truncated/79900 "2017-05-22T11:51:52Z")
Hi, I'm parsing a lot of old logs files. All logs are in gz, so I have to uncompress then move it a folder watched by filebeat. On about 30millions of entries, I have about 1300 failures in logstash logs. I'm logging… --- ## [Filebeat publishing events delay (windows)](https://discuss.elastic.co/t/filebeat-publishing-events-delay-windows/86421)
**Author:** [@kalman](https://discuss.elastic.co/u/kalman)\ **Replies:** 1\ **Last updated:** [May 22, 2017, 11:19am UTC](https://discuss.elastic.co/t/filebeat-publishing-events-delay-windows/86421 "2017-05-22T11:19:32Z")
I'm working with Filebeat on a system that collects log events from files on a windows endpoint and sends them directly to elastic while using Filebeat I have noticed it has a big delay of a few seconds until the da… --- ## [Is there a way to send the path as a parameter to the the filebeat.yml configuration file?](https://discuss.elastic.co/t/is-there-a-way-to-send-the-path-as-a-parameter-to-the-the-filebeat-yml-configuration-file/86389)
**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\ **Replies:** 3\ **Last updated:** [May 22, 2017, 10:51am UTC](https://discuss.elastic.co/t/is-there-a-way-to-send-the-path-as-a-parameter-to-the-the-filebeat-yml-configuration-file/86389 "2017-05-22T10:51:09Z")
I have configured filebeat to read different log files from several paths and I need to configure filebeat in a way that I can send path as a parameter to the configuration file. Is it possible? --- ## [Filebeat not working](https://discuss.elastic.co/t/filebeat-not-working/86364)
**Author:** [@nmane](https://discuss.elastic.co/u/nmane)\ **Replies:** 2\ **Last updated:** [May 22, 2017, 6:00am UTC](https://discuss.elastic.co/t/filebeat-not-working/86364 "2017-05-22T06:00:34Z")
I am using filebeat and the data is passed to logstash. My filebeat code is: filebeat.prospectors: - input\_type: log paths: - etc\\access.log fields: {log\_type: access} I want to add multiple input files an… --- ## [Can Packetbeat be configured to use Npcap by default?](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 4\ **Last updated:** [May 19, 2017, 7:24pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166 "2017-05-19T19:24:14Z")
In this part of Packetbeat's FAQ section, Npcap is mentioned to be an alternative to WinPcap. I tried running Packetbeat after installing Npcap, but still hit the error "The program can't start because wpcap.dll is missi… --- ## [How to create a single index when using with filebeats](https://discuss.elastic.co/t/how-to-create-a-single-index-when-using-with-filebeats/86342)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 4\ **Last updated:** [May 19, 2017, 4:50pm UTC](https://discuss.elastic.co/t/how-to-create-a-single-index-when-using-with-filebeats/86342 "2017-05-19T16:50:41Z")
I'm using filebeats to ship application logs from a server with index name created "iis\_logs". I want to create a single index as "iis\_logs" in elastic search but its creating new indexes daily adding the date to the ind… --- ## [Winlogbeat : Microsoft-Windows-PrintService/Operational](https://discuss.elastic.co/t/winlogbeat-microsoft-windows-printservice-operational/86200)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 8\ **Last updated:** [May 19, 2017, 1:50pm UTC](https://discuss.elastic.co/t/winlogbeat-microsoft-windows-printservice-operational/86200 "2017-05-19T13:50:05Z")
Hi, I want to index in Elasticsearch all print jobs via Winlogbeat. So i installed on a Windows Server 2008 R2 Winlogbeat and configured to send via Logstash the events. I recieve events but not the one i want. I hav… --- ## [Filebeat with Logstash failed to create index in Elasticsearch](https://discuss.elastic.co/t/filebeat-with-logstash-failed-to-create-index-in-elasticsearch/86428)
**Author:** [@munotshubham](https://discuss.elastic.co/u/munotshubham)\ **Replies:** 4\ **Last updated:** [May 19, 2017, 1:40pm UTC](https://discuss.elastic.co/t/filebeat-with-logstash-failed-to-create-index-in-elasticsearch/86428 "2017-05-19T13:40:48Z")
Everything was working fine after installing the elk-stack. But then i deleted my index once and restarted all services again, it is failing to create new index. Logstash log files seems to be normal. \[2017-05-19T08:51… --- ## [How to let filebeat process exit when service is stopped?](https://discuss.elastic.co/t/how-to-let-filebeat-process-exit-when-service-is-stopped/86270)
**Author:** [@tang](https://discuss.elastic.co/u/tang)\ **Replies:** 3\ **Last updated:** [May 19, 2017, 11:34am UTC](https://discuss.elastic.co/t/how-to-let-filebeat-process-exit-when-service-is-stopped/86270 "2017-05-19T11:34:51Z")
my service writes to stdin every some seconds. If I stop service, thus stdin is closed, but filebeat process still works. I hope when stopping my service, filebeat stops its process also. How can I do that? many thanks. … --- ## [Fields.stage is empty](https://discuss.elastic.co/t/fields-stage-is-empty/86366)
**Author:** [@rolandbp](https://discuss.elastic.co/u/rolandbp)\ **Replies:** 1\ **Last updated:** [May 19, 2017, 8:42am UTC](https://discuss.elastic.co/t/fields-stage-is-empty/86366 "2017-05-19T08:42:24Z")
Winlogbeat 5.3 and logstash 5.2.xx,I I would want in the elastic index fill a field named field.stage with an string like win or so. But i can't find an Statement in winlogbeat yml to do this. Example: event\_id … --- ## [Using packetbeat and metricbeats for real time monitoring](https://discuss.elastic.co/t/using-packetbeat-and-metricbeats-for-real-time-monitoring/86051)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 3\ **Last updated:** [May 19, 2017, 8:10am UTC](https://discuss.elastic.co/t/using-packetbeat-and-metricbeats-for-real-time-monitoring/86051 "2017-05-19T08:10:29Z")
Whether packetbeat and metricbeats can be used for the ELK based Real time monitoring solution where the SLAs are defined? This is in context to replace Sensu/Uchiwa/Grafana etc with ELK for System/infra/network and end-… --- ## [MOnitoring mysql & http traffic in Packetbeat dashboards](https://discuss.elastic.co/t/monitoring-mysql-http-traffic-in-packetbeat-dashboards/86305)
**Author:** [@JayArthur](https://discuss.elastic.co/u/JayArthur)\ **Replies:** 2\ **Last updated:** [May 19, 2017, 6:54am UTC](https://discuss.elastic.co/t/monitoring-mysql-http-traffic-in-packetbeat-dashboards/86305 "2017-05-19T06:54:14Z")
Hey guys, I cannot seem to monitor MySQL and http traffic using packetbeat dashboards despite opening the ports on client machines. someone kindly advise me on what to do. --- ## [Heartbeat scripts with check](https://discuss.elastic.co/t/heartbeat-scripts-with-check/85954)
**Author:** [@dodegaard](https://discuss.elastic.co/u/dodegaard)\ **Replies:** 6\ **Last updated:** [May 19, 2017, 2:45am UTC](https://discuss.elastic.co/t/heartbeat-scripts-with-check/85954 "2017-05-19T02:45:41Z")
I am wondering if Heartbeat allows us to take the HTTP response and scrape it for values or add a script that could do post-processing of the capture. I have a situation of needing to monitor pages beyond a login and ca… --- ## [MetricBeat - Sytem Module #Missing Version Details Metric](https://discuss.elastic.co/t/metricbeat-sytem-module-missing-version-details-metric/86189)
**Author:** [@ragurajendran86](https://discuss.elastic.co/u/ragurajendran86)\ **Replies:** 2\ **Last updated:** [May 19, 2017, 2:42am UTC](https://discuss.elastic.co/t/metricbeat-sytem-module-missing-version-details-metric/86189 "2017-05-19T02:42:03Z")
MetricBeat is awesome..... 95% of information what we were getting in sigar metric is matching with the metricbeat output.... so we have started to use metric beat now.... However, some details like OS version Info ar… --- ## [Modify config from server side](https://discuss.elastic.co/t/modify-config-from-server-side/86302)
**Author:** [@ogba](https://discuss.elastic.co/u/ogba)\ **Replies:** 2\ **Last updated:** [May 18, 2017, 6:04pm UTC](https://discuss.elastic.co/t/modify-config-from-server-side/86302 "2017-05-18T18:04:26Z")
Hello, newbie question. Say I have 100 instances of filebeat connected to elasticsearch via logstash. If i wanted to make a change to a config file in /etc/filebeat/conf.d, is there a way to do it from the server side … --- ## [Metricbeat 5.1.2 does not start automatically](https://discuss.elastic.co/t/metricbeat-5-1-2-does-not-start-automatically/86165)
**Author:** [@open\_door8](https://discuss.elastic.co/u/open_door8)\ **Replies:** 6\ **Last updated:** [May 18, 2017, 5:58pm UTC](https://discuss.elastic.co/t/metricbeat-5-1-2-does-not-start-automatically/86165 "2017-05-18T17:58:19Z")
Hi, Elastic team I have Metricbeat 5.1.2 installed on Client machine (Windows 7 32-bit). It does not start automatically (other Beats - Filebeat, Winlogbeat, Packetbeat, and Heartbeat - started automatically without p… --- ## [Packetbeat CPU high](https://discuss.elastic.co/t/packetbeat-cpu-high/47760)
**Author:** [@Guy\_Wicks](https://discuss.elastic.co/u/Guy_Wicks)\ **Replies:** 9\ **Last updated:** [May 18, 2017, 5:49pm UTC](https://discuss.elastic.co/t/packetbeat-cpu-high/47760 "2017-05-18T17:49:47Z")
Hi, we've just installed Packetbeat (and topbeat) on a fairly busy (5 to 10 million requests a day) Red Hat webserver (Apache) Since installing, the CPU / load average has increased quite dramatically, previously the CP… --- ## [Allow Filebeat to add folder names as fields](https://discuss.elastic.co/t/allow-filebeat-to-add-folder-names-as-fields/86144)
**Author:** [@AO-StreetArt](https://discuss.elastic.co/u/AO-StreetArt)\ **Replies:** 3\ **Last updated:** [May 18, 2017, 3:15pm UTC](https://discuss.elastic.co/t/allow-filebeat-to-add-folder-names-as-fields/86144 "2017-05-18T15:15:33Z")
One of the pieces of software we hoped to use Filebeat to collect logs for actually stores data in the file path to the log file. As executions are triggered via RESTful API, it builds a tree structure of folders based … --- ## [Filebeat 5.4 module system and audit not work](https://discuss.elastic.co/t/filebeat-5-4-module-system-and-audit-not-work/84648)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 7\ **Last updated:** [May 18, 2017, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-5-4-module-system-and-audit-not-work/84648 "2017-05-18T14:13:03Z")
im trying to install newest version of filebeat and i enabled module system + auditd. (New template installed with ""template": "fb-\*",") ES : 5.3.2, Kibana 5.3.2 , LS 5.3.2 ingest node enabled by default! This is my… --- ## [How does filebeat (or logstash) converts single line of log to json data?](https://discuss.elastic.co/t/how-does-filebeat-or-logstash-converts-single-line-of-log-to-json-data/86243)
**Author:** [@Mohan\_Mahajan](https://discuss.elastic.co/u/Mohan_Mahajan)\ **Replies:** 2\ **Last updated:** [May 18, 2017, 12:43pm UTC](https://discuss.elastic.co/t/how-does-filebeat-or-logstash-converts-single-line-of-log-to-json-data/86243 "2017-05-18T12:43:29Z")
We already have a ELK cluster running. I wanted to understand how the single log (line) gets converted into json data in elasticsearch. Looking for pointers or explanation. Thanks! Mohan --- ## [Confusion setting up Filebeats for NGINX, Logstash, and ElasticSearch](https://discuss.elastic.co/t/confusion-setting-up-filebeats-for-nginx-logstash-and-elasticsearch/86178)
**Author:** [@stuartweir](https://discuss.elastic.co/u/stuartweir)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 1:41pm UTC](https://discuss.elastic.co/t/confusion-setting-up-filebeats-for-nginx-logstash-and-elasticsearch/86178 "2017-05-18T13:41:57Z")
Following the documentation for Setting up Filebeats for NGINX, I got to this page here: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html However it is unclear how I actually install … --- ## [Heartbeat: http check.response](https://discuss.elastic.co/t/heartbeat-http-check-response/86219)
**Author:** [@N31LR](https://discuss.elastic.co/u/N31LR)\ **Replies:** 3\ **Last updated:** [May 18, 2017, 1:37pm UTC](https://discuss.elastic.co/t/heartbeat-http-check-response/86219 "2017-05-18T13:37:55Z")
Hi, I am having an issue using heartbeat, specifically check.response.body I have the following heartbeat.yml heartbeat.monitors: - type: http # List or urls to query urls: \["http://localhost:8090/base/status.json"… --- ## [Filebeat error using ingest pipeline: Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-error-using-ingest-pipeline-provided-grok-expressions-do-not-match-field-value/85989)
**Author:** [@jmd](https://discuss.elastic.co/u/jmd)\ **Replies:** 3\ **Last updated:** [May 18, 2017, 8:13am UTC](https://discuss.elastic.co/t/filebeat-error-using-ingest-pipeline-provided-grok-expressions-do-not-match-field-value/85989 "2017-05-18T08:13:40Z")
Hi there, I'm having an issue with Filebeat when sending to Elasticsearch. Firstly, apologies please let me know if this should be in the Elasticsearch section rather than Filebeat. I've setup an ingest pipline: { … --- ## [Filtering Windows Events -](https://discuss.elastic.co/t/filtering-windows-events/85481)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 5\ **Last updated:** [May 18, 2017, 12:56am UTC](https://discuss.elastic.co/t/filtering-windows-events/85481 "2017-05-18T00:56:50Z")
I guess I have 2 questions... 1) We want to start going through all the windows command line and powershell logs, where is the best place to start filtering out the standard traffic on our network? I.E. this is norma… --- ## [Recovery mechanism in filebeat](https://discuss.elastic.co/t/recovery-mechanism-in-filebeat/47539)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 10\ **Last updated:** [May 17, 2017, 11:34pm UTC](https://discuss.elastic.co/t/recovery-mechanism-in-filebeat/47539 "2017-05-17T23:34:07Z")
I am seeing a disturbing behavior with filebeat and hope it is not true: When the output destination is not reachable or is down, filebeat tries for some time and then gives up, flushes the events to log file if debug … --- ## [Not able to see some Packetbeat fields?](https://discuss.elastic.co/t/not-able-to-see-some-packetbeat-fields/86148)
**Author:** [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 4:54pm UTC](https://discuss.elastic.co/t/not-able-to-see-some-packetbeat-fields/86148 "2017-05-17T16:54:15Z")
Can anyone explain why I am not able to see NFS fields in Kibana? Here is packetbeat.yml packetbeat.flows: period: 10s packetbeat.interfaces.device: any packetbeat.protocols.icmp: enabled: true packetbeat.protoc… --- ## [FIlebeat Dynamic Configuration](https://discuss.elastic.co/t/filebeat-dynamic-configuration/85978)
**Author:** [@ogba](https://discuss.elastic.co/u/ogba)\ **Replies:** 2\ **Last updated:** [May 17, 2017, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-dynamic-configuration/85978 "2017-05-17T14:50:21Z")
Hello i am a new user, I currently have Filebeat installed on a VM. I have several config files corresponding to all the applications that can be installed on the VM. I know where all the application files would be if th… --- ## [Bpf\_filter not working?](https://discuss.elastic.co/t/bpf-filter-not-working/84999)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 7\ **Last updated:** [May 17, 2017, 12:35pm UTC](https://discuss.elastic.co/t/bpf-filter-not-working/84999 "2017-05-17T12:35:31Z")
hello , Lately I upgrade to use packetbeat version 5.x, I found bpf\_filter option not working as previously in packetbeat version 2.x, basically if I set this option in configuration file, I can still see packetbeat wh… --- ## [How to remove some unnecessary parts if filebeat's output is file](https://discuss.elastic.co/t/how-to-remove-some-unnecessary-parts-if-filebeats-output-is-file/85905)
**Author:** [@tang](https://discuss.elastic.co/u/tang)\ **Replies:** 4\ **Last updated:** [May 17, 2017, 12:32pm UTC](https://discuss.elastic.co/t/how-to-remove-some-unnecessary-parts-if-filebeats-output-is-file/85905 "2017-05-17T12:32:34Z")
use filebeat to send stderr or stdout to file. but file has some unnecessary parts, such as "@timestamp", "beat", "fields" and so on. All I need just is message part. How can I remove unnecessary parts in file? use fil… --- ## [Field for System Type](https://discuss.elastic.co/t/field-for-system-type/86064)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 8:19am UTC](https://discuss.elastic.co/t/field-for-system-type/86064 "2017-05-17T08:19:09Z")
Hi- Is there any field which have the details of the System Type(either 32-bit or 64-bit machine) of a Windows server? And also please let me know if Metricbeats compatible with the Windows-XP machine? If yes, which v… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=521) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=523)