# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=525 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 526 --- ## [PacketBeat timestamp](https://discuss.elastic.co/t/packetbeat-timestamp/84581)
**Author:** [@gcorgne](https://discuss.elastic.co/u/gcorgne)\ **Replies:** 7\ **Last updated:** [May 9, 2017, 1:35pm UTC](https://discuss.elastic.co/t/packetbeat-timestamp/84581 "2017-05-09T13:35:01Z")
hi, We oversee a network interface that is close to 2 gigabits per second. All our servers are interfaced at 10 Gbps. Currently, we have only one node elastic search: 4x16 core and 256 Gb of RAM. We do not understand … --- ## [Metricbeat does not start](https://discuss.elastic.co/t/metricbeat-does-not-start/84745)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 5\ **Last updated:** [May 9, 2017, 1:19pm UTC](https://discuss.elastic.co/t/metricbeat-does-not-start/84745 "2017-05-09T13:19:07Z")
Hi, long time no see, but now I have an issue again on production. (does not occur on other stages). First I noticed, that metricbeat (5.2.1) was not gathering process data any longer. Running on Windows 2012 R1 x64 … --- ## [Filebeat SSL to logstash](https://discuss.elastic.co/t/filebeat-ssl-to-logstash/84398)
**Author:** [@Mango](https://discuss.elastic.co/u/Mango)\ **Replies:** 3\ **Last updated:** [May 9, 2017, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-ssl-to-logstash/84398 "2017-05-09T12:56:11Z")
hi, I have a problem with filebeat sending logs to logstash when I use SSL(filebeat 5.3.0 logstash 5.2.2). That is my config filebeat : output.logstash: hosts: \["127.0.0.1:5044"\] ssl.enabled: true ssl.supported\_proto… --- ## [How separate the logs each device](https://discuss.elastic.co/t/how-separate-the-logs-each-device/84210)
**Author:** [@ramindia](https://discuss.elastic.co/u/ramindia)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 12:50pm UTC](https://discuss.elastic.co/t/how-separate-the-logs-each-device/84210 "2017-05-09T12:50:22Z")
Hi I have Centralized SYSLOG-NG Installed in my network. I have few hundred devices in the network, including Cisco Switch, Routers, FW and other kind of devices. All the devices send logs to centralized Logging s… --- ## [Conditions, Pipelines and GeoIP](https://discuss.elastic.co/t/conditions-pipelines-and-geoip/84092)
**Author:** [@Ghanlow](https://discuss.elastic.co/u/Ghanlow)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 12:06pm UTC](https://discuss.elastic.co/t/conditions-pipelines-and-geoip/84092 "2017-05-09T12:06:57Z")
Hello, i'm new in Elastic community, i'm actually French IT Student, i'm not native english so sorry for my mistakes. I've enjoyed installing ELK Stack. Here i am, i'm actually using Packetbeat 5.3, sending output to… --- ## [Elk Stack 5.3 Issue with Metricbeat Dashboards on Kibana:::Visualize: Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/elk-stack-5-3-issue-with-metricbeat-dashboards-on-kibana-visualize-fielddata-is-disabled-on-text-fields-by-default/82035)
**Author:** [@Ramakrishna\_K](https://discuss.elastic.co/u/Ramakrishna_K)\ **Replies:** 7\ **Last updated:** [May 9, 2017, 12:06pm UTC](https://discuss.elastic.co/t/elk-stack-5-3-issue-with-metricbeat-dashboards-on-kibana-visualize-fielddata-is-disabled-on-text-fields-by-default/82035 "2017-05-09T12:06:33Z")
Hi, I have installed elk stack 5.3 with metricbeat. After this I have loaded the metric beat dashboards. When I open the Kibana with any sample dashboard I am getting below error. I have read several posts. But I am … --- ## [Got error in ELK cluster of 3 nodes](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263)
**Author:** [@mahesh\_cs](https://discuss.elastic.co/u/mahesh_cs)\ **Replies:** 1\ **Last updated:** [May 9, 2017, 11:56am UTC](https://discuss.elastic.co/t/got-error-in-elk-cluster-of-3-nodes/84263 "2017-05-09T11:56:29Z")
Hello, I have 3 ubuntu server lets their name are A, B and C. As of now I am trying to configure for syslog. I got the following error in filebeat log of sever A as : ERR Connecting error publishing events (retryi… --- ## [Elasticsearch Can't load filebeat.template.json!](https://discuss.elastic.co/t/elasticsearch-cant-load-filebeat-template-json/84198)
**Author:** [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 11:48am UTC](https://discuss.elastic.co/t/elasticsearch-cant-load-filebeat-template-json/84198 "2017-05-09T11:48:36Z")
Elasticsearch Can't load filebeat.template.json! I follow this guide:https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html use the command load filebeat.template.json: curl -XPUT -u elastic:chan… --- ## [Maximum number of prospectors?](https://discuss.elastic.co/t/maximum-number-of-prospectors/85044)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 3\ **Last updated:** [May 9, 2017, 9:54am UTC](https://discuss.elastic.co/t/maximum-number-of-prospectors/85044 "2017-05-09T09:54:54Z")
Hello. I am in a situation where I need to define over 60 prospectors . According to the document maximum number of prospectors is not mentioned. Is this number realistic ? Also, is there any os resource I will need… --- ## [Logstash - Detect Filebeat EOF](https://discuss.elastic.co/t/logstash-detect-filebeat-eof/84975)
**Author:** [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Replies:** 1\ **Last updated:** [May 9, 2017, 9:51am UTC](https://discuss.elastic.co/t/logstash-detect-filebeat-eof/84975 "2017-05-09T09:51:55Z")
Hi, Is it possible for logstash to detect an EOF in one of the Filebeat files. So for my application I store some information in a custom plugin and I want it to be flushed when filebeat reaches EOF. Can filebeat sen… --- ## [Filebeat adds escape character to message field. How to disable that?](https://discuss.elastic.co/t/filebeat-adds-escape-character-to-message-field-how-to-disable-that/84908)
**Author:** [@tskeng](https://discuss.elastic.co/u/tskeng)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 9:51am UTC](https://discuss.elastic.co/t/filebeat-adds-escape-character-to-message-field-how-to-disable-that/84908 "2017-05-09T09:51:13Z")
Hi, I'm using filebeat 5.3.0 and reading logs and send to a Kafka cluster. The original message is something like this: \`"{"timestamp":"2017-05-04T17:03:45.020159+0800","flow\_id":1692358547391513,"event\_type":"flow… --- ## [Filebeat config for nginx access & error logs](https://discuss.elastic.co/t/filebeat-config-for-nginx-access-error-logs/84933)
**Author:** [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 9:45am UTC](https://discuss.elastic.co/t/filebeat-config-for-nginx-access-error-logs/84933 "2017-05-09T09:45:29Z")
I am configuring filebeat in nginx to send access & error logs to logstash for which I am defining two separate prospectors like below filebeat.prospectors: # Each - is a prospector. Most options can be set at the pro… --- ## [Beat for oracle database](https://discuss.elastic.co/t/beat-for-oracle-database/84258)
**Author:** [@Daniel\_DNP](https://discuss.elastic.co/u/Daniel_DNP)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 8:46am UTC](https://discuss.elastic.co/t/beat-for-oracle-database/84258 "2017-05-09T08:46:59Z")
I don't want to span the issue "1935" on github (Metricbeat: Oracle Module · Issue #1935 · elastic/beats · GitHub) therefor I opened this topic. @andrewkroh and @ruflin recommended me to write a module for metricbeat. I… --- ## [Event fields missing if renderinginfo is empty](https://discuss.elastic.co/t/event-fields-missing-if-renderinginfo-is-empty/84709)
**Author:** [@ssiws](https://discuss.elastic.co/u/ssiws)\ **Replies:** 5\ **Last updated:** [May 9, 2017, 7:58am UTC](https://discuss.elastic.co/t/event-fields-missing-if-renderinginfo-is-empty/84709 "2017-05-09T07:58:50Z")
Hello, I'm using Winlogbeat to push Forwarded Event to logstash but I have the following problem: It seems that Windows 7 clients can't reliably fill the "RenderingInfo" section of the events: some of them contain on… --- ## [Mysql-slow query parsing error](https://discuss.elastic.co/t/mysql-slow-query-parsing-error/83726)
**Author:** [@gnujeremie](https://discuss.elastic.co/u/gnujeremie)\ **Replies:** 11\ **Last updated:** [May 9, 2017, 7:00am UTC](https://discuss.elastic.co/t/mysql-slow-query-parsing-error/83726 "2017-05-09T07:00:20Z")
Hi, I am using filebeat and the mysql module to send mysql error logs and mysql slow logs to elastic. Here's an extract from my configuration : #========================== Modules configuration ===================… --- ## [Number\_of\_replicas changes for new indexes of filebeat and metricbeat](https://discuss.elastic.co/t/number-of-replicas-changes-for-new-indexes-of-filebeat-and-metricbeat/84483)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 3\ **Last updated:** [May 9, 2017, 6:27am UTC](https://discuss.elastic.co/t/number-of-replicas-changes-for-new-indexes-of-filebeat-and-metricbeat/84483 "2017-05-09T06:27:13Z")
Hi, I set number of replicas to 0 to make all my indexes green ( I only have one machine in my cluster). curl -XPUT 'elasticsearch:9200/\_settings' -d '{ "index" : { "number\_of\_replicas" : 0 } }' The next day I have n… --- ## [Windows Module](https://discuss.elastic.co/t/windows-module/81122)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 12\ **Last updated:** [May 9, 2017, 6:25am UTC](https://discuss.elastic.co/t/windows-module/81122 "2017-05-09T06:25:11Z")
Hi Nicolas @ruflin Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module (https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-… --- ## [Journalbeat - ship from journald to ELK](https://discuss.elastic.co/t/journalbeat-ship-from-journald-to-elk/40104)
**Author:** [@mheese](https://discuss.elastic.co/u/mheese)\ **Replies:** 11\ **Last updated:** [May 9, 2017, 6:24am UTC](https://discuss.elastic.co/t/journalbeat-ship-from-journald-to-elk/40104 "2017-05-09T06:24:03Z")
Hey guys, I just wanted to drop a note that I'm in the making of writing a community beat that I call journalbeat. I'm interested in getting some feedback on the idea of this project, and also - of course - to gathe… --- ## [Unexpected file opening error: File info is not identical with opened file](https://discuss.elastic.co/t/unexpected-file-opening-error-file-info-is-not-identical-with-opened-file/84026)
**Author:** [@jenciso](https://discuss.elastic.co/u/jenciso)\ **Replies:** 20\ **Last updated:** [May 9, 2017, 6:20am UTC](https://discuss.elastic.co/t/unexpected-file-opening-error-file-info-is-not-identical-with-opened-file/84026 "2017-05-09T06:20:05Z")
I'm trying to collect smtp logs of a windows system environment using filbeat, but I don't get any data because the logfile change very quickly This is the error in filbeat log: 2017-04-28T11:47:02-03:00 ERR Harvest… --- ## [Incorrect logs format in Kibana](https://discuss.elastic.co/t/incorrect-logs-format-in-kibana/83486)
**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\ **Replies:** 8\ **Last updated:** [May 9, 2017, 6:12am UTC](https://discuss.elastic.co/t/incorrect-logs-format-in-kibana/83486 "2017-05-09T06:12:16Z")
Hi. I use Filebeat, Kafka and Logstash to forward logs to Elasticsearch. I receive logs in Kibana in the following format: April 24th 2017, 20:20:04.218 2017-01-16 19:11:28.114 STDIO \[INFO\] SystemOut: read April 24th 2… --- ## [How to monitor all agent beat in all server](https://discuss.elastic.co/t/how-to-monitor-all-agent-beat-in-all-server/84436)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [May 9, 2017, 6:11am UTC](https://discuss.elastic.co/t/how-to-monitor-all-agent-beat-in-all-server/84436 "2017-05-09T06:11:09Z")
My company have \> 200 server. Sometime agent beat (ex: filebeat, topbeat ... ) stopped. I dont know that. So how to monitor all agent beat? when they stop ... Or do u have plan for manager agent beat in all server, start… --- ## [Journalbeat usage for starters](https://discuss.elastic.co/t/journalbeat-usage-for-starters/84623)
**Author:** [@anon71472145](https://discuss.elastic.co/u/anon71472145)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 9:01pm UTC](https://discuss.elastic.co/t/journalbeat-usage-for-starters/84623 "2017-05-08T21:01:00Z")
Hi! As I have been working with ELK, I have felt the need to track my journalctl logs. So my quest brought me here and I see that something like journalbeat exists which does exactly the thing I wanted. Although, it is … --- ## [Filebeat - disabling shipping default fields](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921)
**Author:** [@rs\_ela](https://discuss.elastic.co/u/rs_ela)\ **Replies:** 1\ **Last updated:** [May 8, 2017, 11:35am UTC](https://discuss.elastic.co/t/filebeat-disabling-shipping-default-fields/84921 "2017-05-08T11:35:24Z")
Hi all, I need to disable Filebeat shipping for some default fields, such as beat.hostname, host, source etc. How do I do that? Is that even possible? Using the following does not seem to work: #==================… --- ## [Incorrect "system.memory.actual.free" metrics](https://discuss.elastic.co/t/incorrect-system-memory-actual-free-metrics/83783)
**Author:** [@tim\_wong](https://discuss.elastic.co/u/tim_wong)\ **Replies:** 4\ **Last updated:** [May 6, 2017, 8:12am UTC](https://discuss.elastic.co/t/incorrect-system-memory-actual-free-metrics/83783 "2017-05-06T08:12:58Z")
It seems that the system.memory.actual.free metric collected from Metricbeat is incorrect. According to the document: system.memory.actual.free Actual free memory in bytes. It is calculated based on the OS. On Linux i… --- ## [Filebeat can't work with a dot in field name](https://discuss.elastic.co/t/filebeat-cant-work-with-a-dot-in-field-name/84758)
**Author:** [@Francisco\_Perea\_Rodr](https://discuss.elastic.co/u/Francisco_Perea_Rodr)\ **Replies:** 2\ **Last updated:** [May 6, 2017, 7:52am UTC](https://discuss.elastic.co/t/filebeat-cant-work-with-a-dot-in-field-name/84758 "2017-05-06T07:52:31Z")
Hi all, I am trying to insert a log in ElasticSearch whose structure is JSON. Some fields have a dot in their name, and because of this Filebeat can't insert the data into Elasticsearch. The fail is: WARN Can not ind… --- ## [SSL options for Metricbeat when connecting to Mongo?](https://discuss.elastic.co/t/ssl-options-for-metricbeat-when-connecting-to-mongo/84497)
**Author:** [@lisadeng](https://discuss.elastic.co/u/lisadeng)\ **Replies:** 1\ **Last updated:** [May 5, 2017, 10:23am UTC](https://discuss.elastic.co/t/ssl-options-for-metricbeat-when-connecting-to-mongo/84497 "2017-05-05T10:23:07Z")
My company has MongoDB and they use SSL certification. As a result, metricbeat is not able to connect. I know there is an SSL option when connecting from Metricbeat to Logstash, but is there one when Metricbeat is attemp… --- ## [Can metricbeat System module process metricset add io info?](https://discuss.elastic.co/t/can-metricbeat-system-module-process-metricset-add-io-info/84512)
**Author:** [@HeChuanXUPT](https://discuss.elastic.co/u/HeChuanXUPT)\ **Replies:** 1\ **Last updated:** [May 5, 2017, 10:02am UTC](https://discuss.elastic.co/t/can-metricbeat-system-module-process-metricset-add-io-info/84512 "2017-05-05T10:02:36Z")
hi, the process metricset has collected process cpu and mem, but not io info. the process io will add into process metricset ? on linux, io can get from /proc//io --- ## [Code differs from goimports' style](https://discuss.elastic.co/t/code-differs-from-goimports-style/84671)
**Author:** [@sudhindrasajjal](https://discuss.elastic.co/u/sudhindrasajjal)\ **Replies:** 1\ **Last updated:** [May 5, 2017, 8:25am UTC](https://discuss.elastic.co/t/code-differs-from-goimports-style/84671 "2017-05-05T08:25:23Z")
I try to submit a PR on the beats repo, but everytime I get the same error during travis-ci build. go vet github.com/elastic/beats/packetbeat github.com/elastic/beats/packetbeat/beater github.com/elastic/beats/packet… --- ## [Processors drop\_event not correct (AND/OR)](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [May 4, 2017, 5:09pm UTC](https://discuss.elastic.co/t/processors-drop-event-not-correct-and-or/84580 "2017-05-04T17:09:16Z")
Hi, I was trying to use this configuration but it's not dropping events: processors: - drop\_event: when: and: - not: equals: dest.ip: "1.2.3.4.5" - not: … --- ## [Drop events to monitoring FTP](https://discuss.elastic.co/t/drop-events-to-monitoring-ftp/84443)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [May 4, 2017, 3:02pm UTC](https://discuss.elastic.co/t/drop-events-to-monitoring-ftp/84443 "2017-05-04T15:02:23Z")
Hi, I was trying to use Packetbeat to monitor network traffic of a FTP server. in a specific way, I was trying to log all the attempted connections on local port 21 and 22. Just to start I've enabled http protocol on po… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=524) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=526)