# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=523 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 524 --- ## [Too many fields lost after use customized index name](https://discuss.elastic.co/t/too-many-fields-lost-after-use-customized-index-name/86063)
**Author:** [@zaqweb](https://discuss.elastic.co/u/zaqweb)\ **Replies:** 3\ **Last updated:** [May 17, 2017, 10:15am UTC](https://discuss.elastic.co/t/too-many-fields-lost-after-use-customized-index-name/86063 "2017-05-17T10:15:33Z")
hello I'm using Metricbeat 5.4.0 and everything kept in default except index name in out\>elasticsearch section #-------------------------- Elasticsearch output ------------------------------ output.elasticsear… --- ## [Filebeat file modified timestamp](https://discuss.elastic.co/t/filebeat-file-modified-timestamp/85984)
**Author:** [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Replies:** 1\ **Last updated:** [May 17, 2017, 10:11am UTC](https://discuss.elastic.co/t/filebeat-file-modified-timestamp/85984 "2017-05-17T10:11:44Z")
Hi, We have an log intensive application which writes several log files (sometimes 50-100 files of \<3kB) to disk each minute. There are couple of things, which i need guidance on. a) the timestamp associated with b… --- ## [Filebeat - There are conflicts between additional prospectors and reload function](https://discuss.elastic.co/t/filebeat-there-are-conflicts-between-additional-prospectors-and-reload-function/85891)
**Author:** [@Kirax00](https://discuss.elastic.co/u/Kirax00)\ **Replies:** 6\ **Last updated:** [May 17, 2017, 9:06am UTC](https://discuss.elastic.co/t/filebeat-there-are-conflicts-between-additional-prospectors-and-reload-function/85891 "2017-05-17T09:06:19Z")
When I use the additional prospectors function and reload function, the reload function is not working. Filebeat read the additional prospector configurations in the config.FetchConfigs, which call the mergeConfigFiles… --- ## [Dockerfile for new beats](https://discuss.elastic.co/t/dockerfile-for-new-beats/86067)
**Author:** [@BeLi4L](https://discuss.elastic.co/u/BeLi4L)\ **Replies:** 1\ **Last updated:** [May 17, 2017, 8:33am UTC](https://discuss.elastic.co/t/dockerfile-for-new-beats/86067 "2017-05-17T08:33:49Z")
Hi :smiley: I'm creating a custom beat thanks to your Developer Guide, and would like to package it into a Docker image. I looked at the existing community beats, and found several ways of writing a Dockerfile to bui… --- ## [Difference between moloch and packetbeat](https://discuss.elastic.co/t/difference-between-moloch-and-packetbeat/86060)
**Author:** [@tangyong](https://discuss.elastic.co/u/tangyong)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 7:42am UTC](https://discuss.elastic.co/t/difference-between-moloch-and-packetbeat/86060 "2017-05-17T07:42:57Z")
Dear Team, I have a question about packet analysis: Difference between moloch(http://molo.ch/) and packetbeat ? Thanks! Best Regards! -- Mark. Tang --- ## [Heartbeat: "Host" field](https://discuss.elastic.co/t/heartbeat-host-field/85910)
**Author:** [@dosera](https://discuss.elastic.co/u/dosera)\ **Replies:** 2\ **Last updated:** [May 17, 2017, 7:40am UTC](https://discuss.elastic.co/t/heartbeat-host-field/85910 "2017-05-17T07:40:49Z")
Apparently, host field is filled with the value of the host the beat is running on if the urls are NOT ips. Otherwise it is filled with the ip. Example: - name: first type: http urls: - https://123.45.6.7:44… --- ## [Metricbeat 5.2.2 configtest fails to find templates](https://discuss.elastic.co/t/metricbeat-5-2-2-configtest-fails-to-find-templates/85449)
**Author:** [@csobchuk](https://discuss.elastic.co/u/csobchuk)\ **Replies:** 12\ **Last updated:** [May 16, 2017, 7:03pm UTC](https://discuss.elastic.co/t/metricbeat-5-2-2-configtest-fails-to-find-templates/85449 "2017-05-16T19:03:48Z")
I am using Metricbeat 5.2.2 on a Ubuntu 14.04.05 LTS 64 bit trying to run metricbeat configtest from the /usr/share/metricbeat/bin directory as: sudo ./metricbeat -c /etc/metricbeat/metricbeat.yml -configtest However, … --- ## [Filebeat 5.2.2 Windows x86 flagged by Antivirus](https://discuss.elastic.co/t/filebeat-5-2-2-windows-x86-flagged-by-antivirus/85981)
**Author:** [@Sean\_G](https://discuss.elastic.co/u/Sean_G)\ **Replies:** 1\ **Last updated:** [May 16, 2017, 4:35pm UTC](https://discuss.elastic.co/t/filebeat-5-2-2-windows-x86-flagged-by-antivirus/85981 "2017-05-16T16:35:20Z")
A fresh download of FileBeat 5.2.2 (and prior downloads of it) are being flagged by Kaspersky A/V as being infected. It is saying that import\_dashboards.exe is infected with Trojan.Win32.Ebowla.aqv Kaspersky's online … --- ## [Metricbeat Windows fails to start on reboot - timeout](https://discuss.elastic.co/t/metricbeat-windows-fails-to-start-on-reboot-timeout/84973)
**Author:** [@locguero](https://discuss.elastic.co/u/locguero)\ **Replies:** 7\ **Last updated:** [May 16, 2017, 4:32pm UTC](https://discuss.elastic.co/t/metricbeat-windows-fails-to-start-on-reboot-timeout/84973 "2017-05-16T16:32:38Z")
We are running Windows Server 2012 R2 running Metricbeat 5.3.1 and have even tried 5.4.0. I am able to start up the service manually via services manager (services.msc). I have the service set to automatic start but fo… --- ## [New EK install with Filebeat - 5.4 Stack](https://discuss.elastic.co/t/new-ek-install-with-filebeat-5-4-stack/85581)
**Author:** [@smulpuri](https://discuss.elastic.co/u/smulpuri)\ **Replies:** 4\ **Last updated:** [May 16, 2017, 3:34pm UTC](https://discuss.elastic.co/t/new-ek-install-with-filebeat-5-4-stack/85581 "2017-05-16T15:34:40Z")
I have installed Elasticsearch, Kibana and Filebeat along with x-Pack. This is all a 5.4 stack with basic license. At this point it is a standalone install and enabled parsing secure, messages, audit.log, apache access a… --- ## [Customizing user agent ingestion](https://discuss.elastic.co/t/customizing-user-agent-ingestion/85860)
**Author:** [@cubicme](https://discuss.elastic.co/u/cubicme)\ **Replies:** 2\ **Last updated:** [May 16, 2017, 1:29pm UTC](https://discuss.elastic.co/t/customizing-user-agent-ingestion/85860 "2017-05-16T13:29:56Z")
Hi, is there a way to use a custom regex for nginx user-agent plugin? I tried this with a different pipeline and it works, but when i do this in filebeat json file: { "user\_agent": { "field": "nginx.access.age… --- ## [Send SQL script by filebeat](https://discuss.elastic.co/t/send-sql-script-by-filebeat/85387)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 3\ **Last updated:** [May 16, 2017, 12:32pm UTC](https://discuss.elastic.co/t/send-sql-script-by-filebeat/85387 "2017-05-16T12:32:50Z")
Dear all, I need to send SQL script by filebeat to ES. How can i configure it through filebeat config? --- ## [Nginx & proxies](https://discuss.elastic.co/t/nginx-proxies/85757)
**Author:** [@sepal](https://discuss.elastic.co/u/sepal)\ **Replies:** 3\ **Last updated:** [May 16, 2017, 12:28pm UTC](https://discuss.elastic.co/t/nginx-proxies/85757 "2017-05-16T12:28:35Z")
I've just setup filebeat for an existing elastic stack primarily to analyze the the access logs from nginx. I used the setup command and it all went ok without any problems. I've encoutered one issue in the index data t… --- ## [Forwarding data from Extended log file format from using filebeat to ES](https://discuss.elastic.co/t/forwarding-data-from-extended-log-file-format-from-using-filebeat-to-es/85900)
**Author:** [@ARAVIND\_KAMATH](https://discuss.elastic.co/u/ARAVIND_KAMATH)\ **Replies:** 1\ **Last updated:** [May 16, 2017, 10:38am UTC](https://discuss.elastic.co/t/forwarding-data-from-extended-log-file-format-from-using-filebeat-to-es/85900 "2017-05-16T10:38:08Z")
I have a sample log format which looks similar the one shown below key1=value1, key2=value2, key3=value3 EOF key1=value4 key2=value5 key3=value6 EOF .... and so on how can I configure file beat to harvest such… --- ## [Metric Beat \_Fail to run Import Dashboard Script on Remote Virtual machine](https://discuss.elastic.co/t/metric-beat--fail-to-run-import-dashboard-script-on-remote-virtual-machine/85705)
**Author:** [@tanuj\_wadhawan](https://discuss.elastic.co/u/tanuj_wadhawan)\ **Replies:** 6\ **Last updated:** [May 16, 2017, 9:45am UTC](https://discuss.elastic.co/t/metric-beat--fail-to-run-import-dashboard-script-on-remote-virtual-machine/85705 "2017-05-16T09:45:04Z")
Hi Team, I am trying to run Metric beat import dashboard script on remote Virtual machine from where Windows resources needs to be extracted. Elastic Search & Kibana are running on my local machine. I am getting be… --- ## [Beats packaging for EL](https://discuss.elastic.co/t/beats-packaging-for-el/85875)
**Author:** [@louis-gounot](https://discuss.elastic.co/u/louis-gounot)\ **Replies:** 1\ **Last updated:** [May 16, 2017, 9:22am UTC](https://discuss.elastic.co/t/beats-packaging-for-el/85875 "2017-05-16T09:22:38Z")
Hello, Would it be possible to split beats packaging for EL (Amazon Linux, CentOS, RHEL, etc...) per major version ? The single package currently provided embeds both init.d (EL6) and systemd (EL7) daemon management sc… --- ## [Filebeat 5.3.3 import dashboard 404's](https://discuss.elastic.co/t/filebeat-5-3-3-import-dashboard-404s/85702)
**Author:** [@Nilithus](https://discuss.elastic.co/u/Nilithus)\ **Replies:** 3\ **Last updated:** [May 16, 2017, 7:59am UTC](https://discuss.elastic.co/t/filebeat-5-3-3-import-dashboard-404s/85702 "2017-05-16T07:59:13Z")
Hello, I've been following the installation guides for installing filebeat 5.3. I got it running but I've been trying to import the dashboard to kibana and ran into what I think is a bug. I pulled down the beat sour… --- ## [Can beats monitor file age?](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593)
**Author:** [@PandKing](https://discuss.elastic.co/u/PandKing)\ **Replies:** 2\ **Last updated:** [May 16, 2017, 1:04am UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593 "2017-05-16T01:04:36Z")
Is there a method to monitor file age? We have a windoz app we need to monitor and one of the health checks is that it stops updating a status file. --- ## [Heartbeat to monitor beats services](https://discuss.elastic.co/t/heartbeat-to-monitor-beats-services/85826)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 2\ **Last updated:** [May 15, 2017, 11:43pm UTC](https://discuss.elastic.co/t/heartbeat-to-monitor-beats-services/85826 "2017-05-15T23:43:46Z")
Hi, Is there a plan to use Heartbeat to monitor filebeat and metricbeat? I currently have 1,000+ servers running filebeat and metricbeat now and then the service stops. Currently I have powershell checking these servic… --- ## [Metricbeat ERR Failed to publish events caused by: read tcp 127.0.0.1:56820-\>127.0.0.1:5044: i/o timeout](https://discuss.elastic.co/t/metricbeat-err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-56820-127-0-0-1-5044-i-o-timeout/85318)
**Author:** [@ritchierich](https://discuss.elastic.co/u/ritchierich)\ **Replies:** 5\ **Last updated:** [May 13, 2017, 4:49am UTC](https://discuss.elastic.co/t/metricbeat-err-failed-to-publish-events-caused-by-read-tcp-127-0-0-1-56820-127-0-0-1-5044-i-o-timeout/85318 "2017-05-13T04:49:34Z")
Getting the errors below from metricbeat to logstash. Versions: logstash 5.4.0 metricbeat version 5.4.0 (amd64), libbeat 5.4.0 Metricbeat Log: 2017-05-11T00:57:41Z ERR Failed to publish events caused by: read tcp… --- ## [Filebeat 1.1.0 exclude lines with only CRLF or LF](https://discuss.elastic.co/t/filebeat-1-1-0-exclude-lines-with-only-crlf-or-lf/41587)
**Author:** [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Replies:** 15\ **Last updated:** [May 15, 2017, 5:13pm UTC](https://discuss.elastic.co/t/filebeat-1-1-0-exclude-lines-with-only-crlf-or-lf/41587 "2017-05-15T17:13:56Z")
Hello, I have been trying to exclude lines which ONLY contains CRLF or LF i.e. empty lines. However, I have not found a solution yet I have tried with exclude\_lines: \["^\\r?\\n$"\] And all the variations I can think of,… --- ## [Filebeat config for nginx logs](https://discuss.elastic.co/t/filebeat-config-for-nginx-logs/84540)
**Author:** [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)\ **Replies:** 5\ **Last updated:** [May 15, 2017, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-config-for-nginx-logs/84540 "2017-05-15T15:15:35Z")
I am trying to forward nginx access & error logs from nginx as different indices to logstash. Below is the filebeat.yml config filebeat.prospectors: # Each - is a prospector. Most options can be set at the prospector … --- ## [Filebeat and apache2 module](https://discuss.elastic.co/t/filebeat-and-apache2-module/85585)
**Author:** [@Globule](https://discuss.elastic.co/u/Globule)\ **Replies:** 2\ **Last updated:** [May 15, 2017, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-and-apache2-module/85585 "2017-05-15T15:08:06Z")
Hi, I have 3 servers, one with wazuh and filebeat config on and working. I have a other server with a full elk solution. And a last with apache and filebeat install. I want the apache2 log from this server in cabana … --- ## [Multiline pattern works on The Go Playground but not filebeat](https://discuss.elastic.co/t/multiline-pattern-works-on-the-go-playground-but-not-filebeat/85604)
**Author:** [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Replies:** 2\ **Last updated:** [May 15, 2017, 1:36pm UTC](https://discuss.elastic.co/t/multiline-pattern-works-on-the-go-playground-but-not-filebeat/85604 "2017-05-15T13:36:01Z")
I am trying to parse xml logs which are in multiline format. The pattern works fine when I checked on The Go Playground , but not working when I actually start filebeat. Filebeat version (5.3.1) running on RHEL7 Input … --- ## [Connection Refused on localhost](https://discuss.elastic.co/t/connection-refused-on-localhost/85624)
**Author:** [@dodegaard](https://discuss.elastic.co/u/dodegaard)\ **Replies:** 2\ **Last updated:** [May 15, 2017, 11:08am UTC](https://discuss.elastic.co/t/connection-refused-on-localhost/85624 "2017-05-15T11:08:57Z")
I have setup latest bits of Elastic, Logstash, Kibana and Filebeat all on my local machine (OSX 10.12.3) and am getting a "Connection Refused" when filebeat tries to publish them. I have done a successful telnet when lo… --- ## [Filebeat stop reading file after a while](https://discuss.elastic.co/t/filebeat-stop-reading-file-after-a-while/85450)
**Author:** [@jonathanaxel](https://discuss.elastic.co/u/jonathanaxel)\ **Replies:** 1\ **Last updated:** [May 15, 2017, 8:41am UTC](https://discuss.elastic.co/t/filebeat-stop-reading-file-after-a-while/85450 "2017-05-15T08:41:02Z")
Hi, I am testing the filebeat app and I have encounter that after a while reading a syslog file it stops reading, I suspect is something related to the type of log, it is configured to rotate once a day at 10 AM, but wh… --- ## [Heartbeat : log http response](https://discuss.elastic.co/t/heartbeat-log-http-response/85515)
**Author:** [@demethyl](https://discuss.elastic.co/u/demethyl)\ **Replies:** 4\ **Last updated:** [May 15, 2017, 8:02am UTC](https://discuss.elastic.co/t/heartbeat-log-http-response/85515 "2017-05-15T08:02:14Z")
Hi, i made a very fancy /ping uri on my servers, to have jvm infos & more stuff I wanted to use heartbeat to check status avaibility and stock the whole json response into ES documents i cant find how to do this : an… --- ## [ERR SSL client failed to connect with: read tcp](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-read-tcp/50156)
**Author:** [@evmiguel](https://discuss.elastic.co/u/evmiguel)\ **Replies:** 10\ **Last updated:** [May 12, 2017, 11:27am UTC](https://discuss.elastic.co/t/err-ssl-client-failed-to-connect-with-read-tcp/50156 "2017-05-12T11:27:32Z")
Hello, I'm running into SSL issues when trying to connect to logstash: 2016/05/16 20:44:56.611376 log.go:113: INFO Harvester started for file: /var/log/messages 2016/05/16 20:44:56.612388 spooler.go:77: INFO Starting… --- ## [System.diskio.io.time == 0 on Windows](https://discuss.elastic.co/t/system-diskio-io-time-0-on-windows/85508)
**Author:** [@jarko.piironen](https://discuss.elastic.co/u/jarko.piironen)\ **Replies:** 3\ **Last updated:** [May 15, 2017, 6:12am UTC](https://discuss.elastic.co/t/system-diskio-io-time-0-on-windows/85508 "2017-05-15T06:12:19Z")
Using Metricbeat and metricset.name = diskio on a Windows Server 2012R2. On system.diskio.io.time i only get value 0 but the other values is working fine. What could be wrong? #------------------------------- Sys… --- ## [Metric Beat and Jolokia Module](https://discuss.elastic.co/t/metric-beat-and-jolokia-module/85232)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 2\ **Last updated:** [May 15, 2017, 5:31am UTC](https://discuss.elastic.co/t/metric-beat-and-jolokia-module/85232 "2017-05-15T05:31:30Z")
Hi There, I was trying out the new Jolokia module in Metric beat 5.4. The configuration is given at the end. The values are coming for the attributes that don't have space. For others say related to MemoryPool (PS Ede… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=522) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=524)