# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=524 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 525 --- ## [Why do not you have the .ps1 extension when decompressing the filebeat package](https://discuss.elastic.co/t/why-do-not-you-have-the-ps1-extension-when-decompressing-the-filebeat-package/85636)
**Author:** [@Fly](https://discuss.elastic.co/u/Fly)\ **Replies:** 4\ **Last updated:** [May 15, 2017, 1:11am UTC](https://discuss.elastic.co/t/why-do-not-you-have-the-ps1-extension-when-decompressing-the-filebeat-package/85636 "2017-05-15T01:11:27Z")
Hi everybody I want to install filebeat on Windows server 2012 R2 va windows 10 . But when I extracted the package, I did not have the .ps1 extension so the installation was not successful. I have tried many times. T… --- ## [Permission Errors](https://discuss.elastic.co/t/permission-errors/85479)
**Author:** [@Scott\_Robinson](https://discuss.elastic.co/u/Scott_Robinson)\ **Replies:** 4\ **Last updated:** [May 14, 2017, 12:15pm UTC](https://discuss.elastic.co/t/permission-errors/85479 "2017-05-14T12:15:00Z")
Howdy, Can I get filebeat to ignore permission errors and carry on reading other files? 2017-05-11T20:41:19Z ERR Failed opening /var/log/mediator/sysman.log: open /var/log/mediator/sysman.log: permission denied 2017-… --- ## [Status Server Down](https://discuss.elastic.co/t/status-server-down/85654)
**Author:** [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Replies:** 4\ **Last updated:** [May 14, 2017, 10:02am UTC](https://discuss.elastic.co/t/status-server-down/85654 "2017-05-14T10:02:53Z")
Hello, i have a question can elk stack cek status from server down? like nagios doing --- ## [Weird Filebeat init script issue](https://discuss.elastic.co/t/weird-filebeat-init-script-issue/35486)
**Author:** [@jderieg](https://discuss.elastic.co/u/jderieg)\ **Replies:** 38\ **Last updated:** [May 13, 2017, 6:39am UTC](https://discuss.elastic.co/t/weird-filebeat-init-script-issue/35486 "2017-05-13T06:39:09Z")
I'm trying to get filebeat to install via Saltstack, or even just a remote bash script over ssh, which seems to work great, up until I need to restart the filebeat service. With either method, the script just hangs exec… --- ## [Drop "final" flow events](https://discuss.elastic.co/t/drop-final-flow-events/85596)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [May 12, 2017, 6:44pm UTC](https://discuss.elastic.co/t/drop-final-flow-events/85596 "2017-05-12T18:44:42Z")
Hi, I'm trying to use a processor to drop events when "final" = false (I have flows enabled). I've tried these processors: - drop\_event.when.equals.final: \["false"\] - drop\_event.when.equals.final: false - drop\_event.w… --- ## [Filebeat subdirectories scan doubt](https://discuss.elastic.co/t/filebeat-subdirectories-scan-doubt/85609)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 2\ **Last updated:** [May 12, 2017, 6:37pm UTC](https://discuss.elastic.co/t/filebeat-subdirectories-scan-doubt/85609 "2017-05-12T18:37:05Z")
Hi everyone I've got a doubt about how subdirectories are handled, suppose I have the following directory structure; /var/log/ /var/log/dir1 /var/log/dir2 The if I say in filebeat.yml that the path is - /var/log/… --- ## [Docs: Creating a New Beat](https://discuss.elastic.co/t/docs-creating-a-new-beat/85561)
**Author:** [@BeLi4L](https://discuss.elastic.co/u/BeLi4L)\ **Replies:** 2\ **Last updated:** [May 12, 2017, 2:09pm UTC](https://discuss.elastic.co/t/docs-creating-a-new-beat/85561 "2017-05-12T14:09:30Z")
Not sure I should post this issue here ^^' I'm creating a new custom Beat following this documentation: https://www.elastic.co/guide/en/beats/libbeat/5.4/beater-interface.html and also https://www.elastic.co/blog/build… --- ## [Filebeat not connecting to logstach (getting started config)](https://discuss.elastic.co/t/filebeat-not-connecting-to-logstach-getting-started-config/85015)
**Author:** [@mninoruiz](https://discuss.elastic.co/u/mninoruiz)\ **Replies:** 7\ **Last updated:** [May 12, 2017, 11:21am UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-logstach-getting-started-config/85015 "2017-05-12T11:21:16Z")
Hi forum, following the getting started guide got the issue: 2017/05/09 03:36:24.059273 single.go:140: ERR Connecting error publishing events (retrying): Get http://localhost:5043: read tcp \[::1\]:34784-\>\[::1\]:5043: … --- ## [Multiline configuration, several prospectors](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511)
**Author:** [@Vedran\_Maricevic](https://discuss.elastic.co/u/Vedran_Maricevic)\ **Replies:** 1\ **Last updated:** [May 12, 2017, 9:52am UTC](https://discuss.elastic.co/t/multiline-configuration-several-prospectors/85511 "2017-05-12T09:52:38Z")
I have one filebeat that reads severals different log formats. I have this settings. One format that works just fine is a single liner, which is sent to Logstash as a single event. Now, I have another format that is a mu… --- ## [Filebeat with multiline vs. multiline logstash codec](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 7\ **Last updated:** [May 12, 2017, 7:28am UTC](https://discuss.elastic.co/t/filebeat-with-multiline-vs-multiline-logstash-codec/39808 "2017-05-12T07:28:42Z")
I've seen some talk of a multiline option in filebeat but I'm in the process of setting up filebeat sending to logstash via beats input and need to parse multiline logs. Can I use the multiline codec in the input section… --- ## [Why install Metricbeat as a Windows Service?](https://discuss.elastic.co/t/why-install-metricbeat-as-a-windows-service/85486)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 11:10pm UTC](https://discuss.elastic.co/t/why-install-metricbeat-as-a-windows-service/85486 "2017-05-11T23:10:43Z")
The installation instructions on the main Metricbeat download page are straight forward: Download and unzip Metricbeat Edit the metricbeat.yml configuration file Start the daemon by running ./metricbeat -e -c metricbe… --- ## [Filebeat store under different index per host?](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270)
**Author:** [@xon](https://discuss.elastic.co/u/xon)\ **Replies:** 5\ **Last updated:** [May 11, 2017, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-store-under-different-index-per-host/85270 "2017-05-11T22:07:23Z")
Hi, I am having different instances of filebeat running sending different logs and i want to output to elasticsearch and index per host. Is this a nested if statement and which field should I cross reference? Is it po… --- ## [Powershell and param3 keywords missing](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 2\ **Last updated:** [May 11, 2017, 8:46pm UTC](https://discuss.elastic.co/t/powershell-and-param3-keywords-missing/84988 "2017-05-11T20:46:07Z")
Elastic Stack 5.4, running a lab, forwarding 400, 500, and 501 events -- but I can't see event\_data.param3.keyword as a dashboard option -- On Discovery I can see event\_data.param3 but not event\_data.param3 keyword..… --- ## [Rotation and Retention on FileBeat](https://discuss.elastic.co/t/rotation-and-retention-on-filebeat/85475)
**Author:** [@FidelSanchezJr](https://discuss.elastic.co/u/FidelSanchezJr)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 8:42pm UTC](https://discuss.elastic.co/t/rotation-and-retention-on-filebeat/85475 "2017-05-11T20:42:39Z")
Hi, Does filebeat have a built in capability for file retention and rotation? --- ## [Filebeat input paths don't read environment variables](https://discuss.elastic.co/t/filebeat-input-paths-dont-read-environment-variables/85314)
**Author:** [@mtCarto](https://discuss.elastic.co/u/mtCarto)\ **Replies:** 4\ **Last updated:** [May 11, 2017, 7:46pm UTC](https://discuss.elastic.co/t/filebeat-input-paths-dont-read-environment-variables/85314 "2017-05-11T19:46:50Z")
I've got a simple prospector setup: filebeat.prospectors: - input\_type: log paths: - '${REGISTRY\_LOG\_FILE\_PATH:/tmp/fake.log}' # - /var/tmp/registry/registry.log type: ${FILEBEAT\_TYPE} Th… --- ## [Metric Beat Mongo](https://discuss.elastic.co/t/metric-beat-mongo/84801)
**Author:** [@karunakarkotha](https://discuss.elastic.co/u/karunakarkotha)\ **Replies:** 7\ **Last updated:** [May 11, 2017, 7:41pm UTC](https://discuss.elastic.co/t/metric-beat-mongo/84801 "2017-05-11T19:41:30Z")
Hello All, I am interested to capture ,load and visualize MongoDB performance metrics using MetricBeat with ElasticSearch with the below sample dashboard. Here's the below sample linnk which I am interested to setup… --- ## [New Beats Dashbords](https://discuss.elastic.co/t/new-beats-dashbords/85467)
**Author:** [@madhu1512](https://discuss.elastic.co/u/madhu1512)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 7:30pm UTC](https://discuss.elastic.co/t/new-beats-dashbords/85467 "2017-05-11T19:30:53Z")
How do we get new beats dashboards with new Timeseries visualization installed on 5.4 environment. Beats import script, still getting the non Timeseries visualization dashboards. --- ## [Need Direction on how to proceed forward with Filebeat, Logstash and Kibana](https://discuss.elastic.co/t/need-direction-on-how-to-proceed-forward-with-filebeat-logstash-and-kibana/85464)
**Author:** [@Delly](https://discuss.elastic.co/u/Delly)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 7:03pm UTC](https://discuss.elastic.co/t/need-direction-on-how-to-proceed-forward-with-filebeat-logstash-and-kibana/85464 "2017-05-11T19:03:14Z")
Hi, I am a newbie on ELK. I am trying to get all my logs in formatted form in Kibana. For this, I had stored some sample logs in Local Directory (C:\\logs). I had setup Elasticsearch, Logstash and Kibana on the same machi… --- ## [Remove event received from Metricbeat to Logstash](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336)
**Author:** [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\ **Replies:** 2\ **Last updated:** [May 11, 2017, 10:28am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336 "2017-05-11T10:28:03Z")
Hi, I am using a setup where Metricbeat running in remote server sends data to Logstash. Metricbeat sends tons of data to Logstash and I don't want everything to be stored by Elasticsearch. At each interval, Logstash … --- ## [Metricbeat kafka module - consumergroup metric set does not report metrics](https://discuss.elastic.co/t/metricbeat-kafka-module-consumergroup-metric-set-does-not-report-metrics/83623)
**Author:** [@Rahul\_Joshi](https://discuss.elastic.co/u/Rahul_Joshi)\ **Replies:** 24\ **Last updated:** [May 11, 2017, 10:24am UTC](https://discuss.elastic.co/t/metricbeat-kafka-module-consumergroup-metric-set-does-not-report-metrics/83623 "2017-05-11T10:24:32Z")
We are are using metricbeats with the kafka module turned on. The kafka module is configured to send both partition and consumergroup metric sets to elastic search. We see that metricbeats is sending the partition metric… --- ## [So slow in loading the log files via stdin plugin](https://discuss.elastic.co/t/so-slow-in-loading-the-log-files-via-stdin-plugin/84963)
**Author:** [@andypark](https://discuss.elastic.co/u/andypark)\ **Replies:** 4\ **Last updated:** [May 11, 2017, 10:20am UTC](https://discuss.elastic.co/t/so-slow-in-loading-the-log-files-via-stdin-plugin/84963 "2017-05-11T10:20:32Z")
Hi guys, Currently I need to load some logfiles contained in tar (archive) files. To load them into filebeat, I am using gzcat tool to echo the log files inside the archive files using stdin input for filebeat. For a 2… --- ## [Filebeat module exclude\_files](https://discuss.elastic.co/t/filebeat-module-exclude-files/84862)
**Author:** [@cmodijk](https://discuss.elastic.co/u/cmodijk)\ **Replies:** 2\ **Last updated:** [May 11, 2017, 6:21am UTC](https://discuss.elastic.co/t/filebeat-module-exclude-files/84862 "2017-05-11T06:21:30Z")
When using filebeat I can use exclude\_files on a prospector but i'm not sure if this can also be done for a a module like the apache2 logs. I added my config but i want to exclude 1 domain from the apache2 logs. http… --- ## [Logstash doesn't receive Metricbeat data](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196)
**Author:** [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\ **Replies:** 3\ **Last updated:** [May 11, 2017, 5:48am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196 "2017-05-11T05:48:49Z")
Hi, I am trying to make Metricbeat (running in remote server) to send data to Logstash and from there to Elasticsearch. I already have Filebeat (running in same remote server) to send data to same Logstash and then to … --- ## [Filebeat does not re-send logs if they're rejected because of strict mapping](https://discuss.elastic.co/t/filebeat-does-not-re-send-logs-if-theyre-rejected-because-of-strict-mapping/84711)
**Author:** [@vladimir-kazakov](https://discuss.elastic.co/u/vladimir-kazakov)\ **Replies:** 6\ **Last updated:** [May 10, 2017, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-does-not-re-send-logs-if-theyre-rejected-because-of-strict-mapping/84711 "2017-05-10T12:20:46Z")
Filebeat: 5.3.2 (64-bit). OS: Ubuntu 16.04.2 (64-bit). I have an index template with dynamic set to strict. According to the documentation, Filebeat must not be able to send logs to Elasticsearch if there's a field tha… --- ## [RHEL6 ICMP ipv6 error at startup](https://discuss.elastic.co/t/rhel6-icmp-ipv6-error-at-startup/84384)
**Author:** [@lnm](https://discuss.elastic.co/u/lnm)\ **Replies:** 6\ **Last updated:** [May 10, 2017, 12:02pm UTC](https://discuss.elastic.co/t/rhel6-icmp-ipv6-error-at-startup/84384 "2017-05-10T12:02:13Z")
Hi, I'm running into issues when trying to do an ICMP ping with heartbeat to a different server. I'm getting some error messages on startup: 2017-05-03T10:27:26+02:00 INFO Select (active) monitor icmp 2017-05-03T1… --- ## [How to send logs to filebeat with python logging](https://discuss.elastic.co/t/how-to-send-logs-to-filebeat-with-python-logging/85187)
**Author:** [@Tony\_Wang](https://discuss.elastic.co/u/Tony_Wang)\ **Replies:** 1\ **Last updated:** [May 10, 2017, 11:32am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-filebeat-with-python-logging/85187 "2017-05-10T11:32:00Z")
The code I used shows below. I want to send logs with python. But What I got from Kibana is : elk\_1 | {"type":"log","@timestamp":"2017-05-10T04:23:51Z","tags":\["connection","client","error"\],"pid":194,"level":"er… --- ## [Filebeat and ingest node error](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 7:33am UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108 "2017-05-10T07:33:35Z")
Hi All, I installed the latest filebeat 5.4.0 on a CentOS 7 server and i tried to parse the auditd file with the specific module and i redirect the output to an elasticsearch 5.4.0 instance. I noticed an error fro filebe… --- ## [ERR Kafka (topic=stack): dropping too large message of size 1262765](https://discuss.elastic.co/t/err-kafka-topic-stack-dropping-too-large-message-of-size-1262765/85122)
**Author:** [@mw-0](https://discuss.elastic.co/u/mw-0)\ **Replies:** 1\ **Last updated:** [May 9, 2017, 10:44pm UTC](https://discuss.elastic.co/t/err-kafka-topic-stack-dropping-too-large-message-of-size-1262765/85122 "2017-05-09T22:44:04Z")
Hi, I have been testing out filebeat 5.3 and now 5.4 but keep getting these errors and cannot find which config entry will solve it. I have configured 2 log files which produce about 16 lines per second combined and i … --- ## [Accessing "period" module config from inside a module](https://discuss.elastic.co/t/accessing-period-module-config-from-inside-a-module/85146)
**Author:** [@themanwithanrx7](https://discuss.elastic.co/u/themanwithanrx7)\ **Replies:** 3\ **Last updated:** [May 9, 2017, 8:22pm UTC](https://discuss.elastic.co/t/accessing-period-module-config-from-inside-a-module/85146 "2017-05-09T20:22:02Z")
Hello, I've been working on writing a few company-specific modules for metricbeat and have a question about the best way to access the config. I know that inside of the New func of a metricset module I can define a s… --- ## [Filebeat multiline codec not working in my case](https://discuss.elastic.co/t/filebeat-multiline-codec-not-working-in-my-case/85040)
**Author:** [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 2:11pm UTC](https://discuss.elastic.co/t/filebeat-multiline-codec-not-working-in-my-case/85040 "2017-05-09T14:11:22Z")
I have defined multiline codec in filebeat.yml like below multiline.pattern: '^%{TIMESTAMP\_ISO8601} ' multiline.negate: true multiline.match: after But it does not seem to be working as multiple lines of log get ap… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=523) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=525)