# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=526 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 527 --- ## [How do I Monitor Mysql & apache webserver traffic using packetbeat?](https://discuss.elastic.co/t/how-do-i-monitor-mysql-apache-webserver-traffic-using-packetbeat/84484)
**Author:** [@JayArthur](https://discuss.elastic.co/u/JayArthur)\ **Replies:** 1\ **Last updated:** [May 4, 2017, 8:55am UTC](https://discuss.elastic.co/t/how-do-i-monitor-mysql-apache-webserver-traffic-using-packetbeat/84484 "2017-05-04T08:55:46Z")
Hey guys, what configurations do I need to add to my packetbeat.yml file to collect logs from my apache webserver and MySQL database? --- ## [Filebeat reading remote log file](https://discuss.elastic.co/t/filebeat-reading-remote-log-file/84360)
**Author:** [@rabbit](https://discuss.elastic.co/u/rabbit)\ **Replies:** 3\ **Last updated:** [May 3, 2017, 8:45pm UTC](https://discuss.elastic.co/t/filebeat-reading-remote-log-file/84360 "2017-05-03T20:45:29Z")
Hi guys ! I have some constraints in the servers that my applications servers are running. I'm not allowed to install Filebeat in the nodes. The solution was to copy the logs to the machine where filebeat is runnin… --- ## [Winlogbeat does not resolve SIDs of forwarded Event-Logs](https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752)
**Author:** [@wuppi](https://discuss.elastic.co/u/wuppi)\ **Replies:** 6\ **Last updated:** [May 3, 2017, 7:37pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-resolve-sids-of-forwarded-event-logs/83752 "2017-05-03T19:37:18Z")
We use winlogbeat on one Windows-Host which collects evet-logs from several Domain-Controllers and several domains. Winlogbeat only resolves the common SIDs and the SIDs of local users of the collector-system. The log on… --- ## [Metric Beat No PostgreSQL Dashboard Found](https://discuss.elastic.co/t/metric-beat-no-postgresql-dashboard-found/84324)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 4\ **Last updated:** [May 3, 2017, 4:58pm UTC](https://discuss.elastic.co/t/metric-beat-no-postgresql-dashboard-found/84324 "2017-05-03T16:58:32Z")
Hi there guys I configured metricbeat to monitor a postgresql database, but I noticed that there is no metricbeat dashboard by default, only for MongoDB, is that correct? is there any template out there that I missed t… --- ## [Filebeat - 127.0.0.1:5044: write: connection reset by peer](https://discuss.elastic.co/t/filebeat-127-0-0-1-5044-write-connection-reset-by-peer/84321)
**Author:** [@wb303](https://discuss.elastic.co/u/wb303)\ **Replies:** 2\ **Last updated:** [May 3, 2017, 4:27pm UTC](https://discuss.elastic.co/t/filebeat-127-0-0-1-5044-write-connection-reset-by-peer/84321 "2017-05-03T16:27:34Z")
For some reason, when I have logstash running locally on the same server as the beat service I get constant connection resets. There is no SSL configured and the only input. There is no firewall running. This is the c… --- ## [Filebeat harvester detect the file's changes, but prospector don't deal with it](https://discuss.elastic.co/t/filebeat-harvester-detect-the-files-changes-but-prospector-dont-deal-with-it/84340)
**Author:** [@Zijian\_Wang](https://discuss.elastic.co/u/Zijian_Wang)\ **Replies:** 1\ **Last updated:** [May 3, 2017, 3:20pm UTC](https://discuss.elastic.co/t/filebeat-harvester-detect-the-files-changes-but-prospector-dont-deal-with-it/84340 "2017-05-03T15:20:53Z")
I am using the filebeat 5.3.2 and I want to run filebeat as a non-root user. Before I change the filebeat's directory privileges, filebeat works good. the /etc/filebeat/filebeat.yml : filebeat.prospectors: - i… --- ## [Metricbeat CPU usage total](https://discuss.elastic.co/t/metricbeat-cpu-usage-total/84260)
**Author:** [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)\ **Replies:** 1\ **Last updated:** [May 3, 2017, 2:41pm UTC](https://discuss.elastic.co/t/metricbeat-cpu-usage-total/84260 "2017-05-03T14:41:25Z")
Hiya, Metricbeat is working nicely for me but what I want to see for my servers are how busy they are. I get the CPU usage in parts (user, system, steal etc) and the idle %, what I want is the total usage as a percenta… --- ## [Filebeat 5.3.1 config\_dir files needs 644 permissions?](https://discuss.elastic.co/t/filebeat-5-3-1-config-dir-files-needs-644-permissions/84108)
**Author:** [@stefanrinderle](https://discuss.elastic.co/u/stefanrinderle)\ **Replies:** 4\ **Last updated:** [May 3, 2017, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-5-3-1-config-dir-files-needs-644-permissions/84108 "2017-05-03T13:06:50Z")
Hi, i just spend a few ours on this topic. As far as i can see now, filebeat ignores files placed in the config\_dir folder with 664 permission without any comment in the log file. Changing the permissions to 644 and re… --- ## [ODD DNS issue with packages.elastic.co](https://discuss.elastic.co/t/odd-dns-issue-with-packages-elastic-co/84318)
**Author:** [@eric51893](https://discuss.elastic.co/u/eric51893)\ **Replies:** 3\ **Last updated:** [May 3, 2017, 12:37pm UTC](https://discuss.elastic.co/t/odd-dns-issue-with-packages-elastic-co/84318 "2017-05-03T12:37:46Z")
We had a very odd issue recently and it turned out to be caused by the long DNS record for packages.elastic.co. The beats.repo uses that URL. During yum installs the DNS lookup would hang. Turns out there is a limit … --- ## [Extract information from Prospectors Path](https://discuss.elastic.co/t/extract-information-from-prospectors-path/84192)
**Author:** [@rake](https://discuss.elastic.co/u/rake)\ **Replies:** 1\ **Last updated:** [May 3, 2017, 11:27am UTC](https://discuss.elastic.co/t/extract-information-from-prospectors-path/84192 "2017-05-03T11:27:34Z")
Is it possible to extract information from Filebeat prospectors path? Here is an example: filebeat.prospectors: - input\_type: log paths: - /log/\*/test/\*/\*/\*.log I wanted to extract the values of \* from the path… --- ## [Topbeat report mismatched hostname when it been changed](https://discuss.elastic.co/t/topbeat-report-mismatched-hostname-when-it-been-changed/84312)
**Author:** [@DravenJohnson](https://discuss.elastic.co/u/DravenJohnson)\ **Replies:** 1\ **Last updated:** [May 3, 2017, 11:27am UTC](https://discuss.elastic.co/t/topbeat-report-mismatched-hostname-when-it-been-changed/84312 "2017-05-03T11:27:32Z")
Have to restart topbeat in order to get correct hostname? --- ## [Use Winlogbeat on UDP protocol](https://discuss.elastic.co/t/use-winlogbeat-on-udp-protocol/84297)
**Author:** [@ThierryMat](https://discuss.elastic.co/u/ThierryMat)\ **Replies:** 2\ **Last updated:** [May 3, 2017, 8:27am UTC](https://discuss.elastic.co/t/use-winlogbeat-on-udp-protocol/84297 "2017-05-03T08:27:34Z")
Hi, In advance, sorry for my bad english. In order to forward windows event logs to a logstash Server, i use WinlogBeat to do that. I would like to know how can i configure winlogbeat agent to push logs on UDP protocol f… --- ## [Topbeat does not report per-core statistics](https://discuss.elastic.co/t/topbeat-does-not-report-per-core-statistics/83130)
**Author:** [@alexander.bensch](https://discuss.elastic.co/u/alexander.bensch)\ **Replies:** 2\ **Last updated:** [May 2, 2017, 5:35pm UTC](https://discuss.elastic.co/t/topbeat-does-not-report-per-core-statistics/83130 "2017-05-02T17:35:04Z")
Howdy! I'm trying to analyze an OpenStack cloud's performance for different services using topbeat and packetbeat. I chose topbeat specifically because it supported per-core reporting for processes' CPU usage. However… --- ## [\[Filebeat 5.2.1\]Registry.new: too many open files](https://discuss.elastic.co/t/filebeat-5-2-1-registry-new-too-many-open-files/84072)
**Author:** [@Kareny](https://discuss.elastic.co/u/Kareny)\ **Replies:** 1\ **Last updated:** [May 2, 2017, 8:25am UTC](https://discuss.elastic.co/t/filebeat-5-2-1-registry-new-too-many-open-files/84072 "2017-05-02T08:25:48Z")
Getting errors in the filebeat log: \[filebeat\] registrar.go:151: Failed to create tempfile (/var/lib/filebeat/registry.new) for writing: open /var/lib/filebeat/registry.new: too many open files. The ulimit on my serve… --- ## [Get file's last modification date](https://discuss.elastic.co/t/get-files-last-modification-date/83234)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 7\ **Last updated:** [May 2, 2017, 7:18am UTC](https://discuss.elastic.co/t/get-files-last-modification-date/83234 "2017-05-02T07:18:07Z")
Hi all, Is there anyway to retrieve and output file's last modification date with filebeat ? Thank you. --- ## [Broken config in Filebeat documentation](https://discuss.elastic.co/t/broken-config-in-filebeat-documentation/83793)
**Author:** [@Peter\_Becker](https://discuss.elastic.co/u/Peter_Becker)\ **Replies:** 5\ **Last updated:** [May 2, 2017, 1:25am UTC](https://discuss.elastic.co/t/broken-config-in-filebeat-documentation/83793 "2017-05-02T01:25:11Z")
On the page documenting the use of Filebeat modules this bit of config is shown: var.paths = \["/var/log/nginx/access.log\*"\] That should be a colon instead of the equals, shouldn't it? --- ## [Missing nginx.access.geoip.location](https://discuss.elastic.co/t/missing-nginx-access-geoip-location/84085)
**Author:** [@ribellusmt](https://discuss.elastic.co/u/ribellusmt)\ **Replies:** 2\ **Last updated:** [April 30, 2017, 1:50pm UTC](https://discuss.elastic.co/t/missing-nginx-access-geoip-location/84085 "2017-04-30T13:50:49Z")
Hello the Elastic familly I deployed a new server with nginx and I use Filebeat to send nginx logs the the elasticsearch cluster. I added the pluggin nginx and imported the dashboard. The probvlem I have is that there … --- ## [Throttling processing of log backfill using Filebeat](https://discuss.elastic.co/t/throttling-processing-of-log-backfill-using-filebeat/83740)
**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\ **Replies:** 10\ **Last updated:** [April 28, 2017, 5:39pm UTC](https://discuss.elastic.co/t/throttling-processing-of-log-backfill-using-filebeat/83740 "2017-04-28T17:39:39Z")
\[Originally posted this on the Elasticsearch forum (https://discuss.elastic.co/t/throttling-processing-of-log-backfill/83734), but it was suggested that it was more of a Filebeat or Logstash question. Sorry for the cross… --- ## [Filebeat 2 hours latency](https://discuss.elastic.co/t/filebeat-2-hours-latency/81741)
**Author:** [@aqiao](https://discuss.elastic.co/u/aqiao)\ **Replies:** 16\ **Last updated:** [April 28, 2017, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-2-hours-latency/81741 "2017-04-28T14:45:09Z")
{"@timestamp":"2017-04-07T18:22:59.075Z","beat":{"hostname":"localhost","name":"localhost","version":"5.2.1"},"input\_type":"log","message":"2017-04-07T15:19:29.670Z,RACI,EURAB6E15Y=QQ,BRKR,CheckFID=22;Rate=1.083;FID2=25;… --- ## [Filebeat prospector to be server location](https://discuss.elastic.co/t/filebeat-prospector-to-be-server-location/83936)
**Author:** [@filebeatfa](https://discuss.elastic.co/u/filebeatfa)\ **Replies:** 1\ **Last updated:** [April 28, 2017, 2:36pm UTC](https://discuss.elastic.co/t/filebeat-prospector-to-be-server-location/83936 "2017-04-28T14:36:02Z")
Hi, i have the ELK stack running on my machine (Filebeat/ElasticSearch/Logstash/Kibana), i want to point the filebeat.prospectors in the filebeat.yml file path to be a network location. I have access to the path through … --- ## [Processor -\> split -\> set array.element?](https://discuss.elastic.co/t/processor-split-set-array-element/83941)
**Author:** [@Zachary\_Buckholz](https://discuss.elastic.co/u/Zachary_Buckholz)\ **Replies:** 2\ **Last updated:** [April 28, 2017, 1:53pm UTC](https://discuss.elastic.co/t/processor-split-set-array-element/83941 "2017-04-28T13:53:14Z")
I posted a similar question to the elasticsearch forum since it appeared to be more of an intrinsic ES problem. But I am not sure. I have the following filebeat yaml. Basically I am attempting to split based on \\t (t… --- ## [Intercepting filebeat logs](https://discuss.elastic.co/t/intercepting-filebeat-logs/83604)
**Author:** [@tdelacour](https://discuss.elastic.co/u/tdelacour)\ **Replies:** 7\ **Last updated:** [April 28, 2017, 12:18pm UTC](https://discuss.elastic.co/t/intercepting-filebeat-logs/83604 "2017-04-28T12:18:26Z")
Hi all, I'm interested in using filebeat as a library in another application. I would like to be able to intercept its log messages and include them in the parent application. Is there any recommended way to do this? … --- ## [Httpprof debug/metrics not working anymore for kafka](https://discuss.elastic.co/t/httpprof-debug-metrics-not-working-anymore-for-kafka/83800)
**Author:** [@ariel.s](https://discuss.elastic.co/u/ariel.s)\ **Replies:** 3\ **Last updated:** [April 28, 2017, 10:41am UTC](https://discuss.elastic.co/t/httpprof-debug-metrics-not-working-anymore-for-kafka/83800 "2017-04-28T10:41:48Z")
Recently I upgraded filebeat version, and got a problem for monitoring. v5.0.2 I was using httpprof /debug/metrics to check kafka output rate in one minute for monitoring. (it is supplied from Sarama kafka lib. ) v5.… --- ## [Start filebeat using a java code?](https://discuss.elastic.co/t/start-filebeat-using-a-java-code/83963)
**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\ **Replies:** 4\ **Last updated:** [April 28, 2017, 9:44am UTC](https://discuss.elastic.co/t/start-filebeat-using-a-java-code/83963 "2017-04-28T09:44:58Z")
I'm using filebeat to read some log files and I need to start filebeat using a java program. And the filebeat commands are executed using the windows powerShell. I used the following code but it didn't work. try { … --- ## [Migration from Filebeat-\>LS to Filebeat-Redis](https://discuss.elastic.co/t/migration-from-filebeat-ls-to-filebeat-redis/83865)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [April 28, 2017, 9:16am UTC](https://discuss.elastic.co/t/migration-from-filebeat-ls-to-filebeat-redis/83865 "2017-04-28T09:16:41Z")
Hi, I was using LSF, so I had Logstash in my processing pipeline and it was as below 1) LSF--\>LS--\>Redis--\>LS--\>Indexer--\>nGinx--\>ES Then I got FB and because of limited knowledge of FB, I didnt use redis output plug… --- ## [Where are the logs of beats- Filebeat, Metricbeat & packetbeat located in an elk server?](https://discuss.elastic.co/t/where-are-the-logs-of-beats-filebeat-metricbeat-packetbeat-located-in-an-elk-server/83851)
**Author:** [@JayArthur](https://discuss.elastic.co/u/JayArthur)\ **Replies:** 5\ **Last updated:** [April 28, 2017, 4:57am UTC](https://discuss.elastic.co/t/where-are-the-logs-of-beats-filebeat-metricbeat-packetbeat-located-in-an-elk-server/83851 "2017-04-28T04:57:58Z")
10:46am Hey Elastic... I got a little problem I'd like you to help me fix.. I have an ELK server hosted on Centos 7 and I'm pulling logs from 2 Debian machines. From the server, where would I retrieve logs for filebeat, … --- ## [Error when reloading prospectors for filebeat](https://discuss.elastic.co/t/error-when-reloading-prospectors-for-filebeat/83082)
**Author:** [@grantwu](https://discuss.elastic.co/u/grantwu)\ **Replies:** 8\ **Last updated:** [April 27, 2017, 9:50pm UTC](https://discuss.elastic.co/t/error-when-reloading-prospectors-for-filebeat/83082 "2017-04-27T21:50:11Z")
The re-creation of a prospector as a condition for checking whether or not to stop or start a processor in the live reloading path causes prospectors to shut down due to error thrown when trying to load file state. Thi… --- ## [Filebeat not honoring multiline configuration](https://discuss.elastic.co/t/filebeat-not-honoring-multiline-configuration/83470)
**Author:** [@barbarello](https://discuss.elastic.co/u/barbarello)\ **Replies:** 2\ **Last updated:** [April 27, 2017, 8:27pm UTC](https://discuss.elastic.co/t/filebeat-not-honoring-multiline-configuration/83470 "2017-04-27T20:27:27Z")
Hi , i'm using filebeat version 5.3.1 with the following configuration: filebeat.prospectors: - paths: \["/logs/\*.stdout.0"\] output.elasticsearch: hosts: \["${es\_url}"\] multiline.pattern: '^(?:Jan?|Feb?|Mar?|Apr?|… --- ## [Unable to get winlogbeat to send to logstash](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636)
**Author:** [@Greenie](https://discuss.elastic.co/u/Greenie)\ **Replies:** 28\ **Last updated:** [April 27, 2017, 6:33pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636 "2017-04-27T18:33:27Z")
I'm new to ELK stack. running version 5.3 for all components of ELK. Able to telnet successfully from winlogbeat client to ELK server on ports 5044 and 9200. Cannot get winlogbeat data to show up in logstash. Any help wo… --- ## [About segmentation fault](https://discuss.elastic.co/t/about-segmentation-fault/49146)
**Author:** [@Young\_Heon\_Kim](https://discuss.elastic.co/u/Young_Heon_Kim)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 6:28pm UTC](https://discuss.elastic.co/t/about-segmentation-fault/49146 "2017-04-27T18:28:31Z")
My environment is like this: os : cent os 5.6 I installed filebeat 1.2.2 and I started filebeat. But segmentation fault occurred. /etc/init.d/filebeat start Starting filebeat: /etc/init.d/filebeat: line 43: 19077… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=525) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=527)