# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=527 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 528 --- ## [Postfix logs not forwarding to ELK](https://discuss.elastic.co/t/postfix-logs-not-forwarding-to-elk/83125)
**Author:** [@seag33k](https://discuss.elastic.co/u/seag33k)\ **Replies:** 6\ **Last updated:** [April 27, 2017, 6:24pm UTC](https://discuss.elastic.co/t/postfix-logs-not-forwarding-to-elk/83125 "2017-04-27T18:24:50Z")
I thought I had this fixed, but had my "exclude\_files" line commented out. I moved the input up to the top and it still does not work. I am getting data from the other two inputs so I am thinking it has to do with this… --- ## [Parsing a non pure Json](https://discuss.elastic.co/t/parsing-a-non-pure-json/83699)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 1\ **Last updated:** [April 27, 2017, 3:14pm UTC](https://discuss.elastic.co/t/parsing-a-non-pure-json/83699 "2017-04-27T15:14:56Z")
Hi, I am trying to parse a string that contains a json. The format of the string is {a:1,b:2 ... }. Until now I read only strings that are built like a Json with no strings attached to the start or end of it. Many Th… --- ## [Filebeat not harvesting after startup](https://discuss.elastic.co/t/filebeat-not-harvesting-after-startup/83277)
**Author:** [@jasperla](https://discuss.elastic.co/u/jasperla)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 2:52pm UTC](https://discuss.elastic.co/t/filebeat-not-harvesting-after-startup/83277 "2017-04-27T14:52:21Z")
After updating filebeat to 5.3.1 I noticed that it no was harvesting new logdata. Upon startup it harvests the existing files and then it fails to process any new events. For example I create a new and empty file and hoo… --- ## [@timestamp format string error](https://discuss.elastic.co/t/timestamp-format-string-error/83562)
**Author:** [@xuhaibo](https://discuss.elastic.co/u/xuhaibo)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 3:49am UTC](https://discuss.elastic.co/t/timestamp-format-string-error/83562 "2017-04-27T03:49:27Z")
my kafka config is output.kafka: # Boolean flag to enable or disable the output module. enabled: true codec.format: string: ' %{\[@timestamp\]} ' When start reading the nginx log. It will appear this error … --- ## [Logstash output elasticsearch a day index but curent day index contain two days data (curent day and next day\_)](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 5\ **Last updated:** [April 27, 2017, 3:20am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-a-day-index-but-curent-day-index-contain-two-days-data-curent-day-and-next-day-/83781 "2017-04-27T03:20:40Z")
below info is my logstash conf can i define index name timezone ?? filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:datatime} %{LOGLEVEL:loglevel} - %{IP:client} %{NUMBER:duration} %{WORD:qtype} %… --- ## [Installation of filebeat 5.3.1 in windows 10?](https://discuss.elastic.co/t/installation-of-filebeat-5-3-1-in-windows-10/83594)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 9\ **Last updated:** [April 27, 2017, 2:57am UTC](https://discuss.elastic.co/t/installation-of-filebeat-5-3-1-in-windows-10/83594 "2017-04-27T02:57:38Z")
Hi, I installed filebeat in F:\\filebeat-5.3.1-windows-x86\_64\\Filebeat when i executed the install-service-filebeat.ps1 in powershell it opened and closed immediately i dont know why this is happening ? Even i changed… --- ## [Beats vs logstash](https://discuss.elastic.co/t/beats-vs-logstash/42246)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 5\ **Last updated:** [April 26, 2017, 10:10pm UTC](https://discuss.elastic.co/t/beats-vs-logstash/42246 "2017-04-26T22:10:33Z")
Whats the difference between beats and logstash please? --- ## [Filebeat stops tracing file](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761)
**Author:** [@Samuel\_Lima1](https://discuss.elastic.co/u/Samuel_Lima1)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 8:30pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761 "2017-04-26T20:30:39Z")
Hi, I'm new to filebeat. I've read similar topics like this but none seems to solve my case. I'm starting filebeat in the command line to debug it before running it as a service. As it happens in the other topics li… --- ## [Winlogbeat event\_data.param17 format change with MapperParsingException](https://discuss.elastic.co/t/winlogbeat-event-data-param17-format-change-with-mapperparsingexception/83742)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 7:05pm UTC](https://discuss.elastic.co/t/winlogbeat-event-data-param17-format-change-with-mapperparsingexception/83742 "2017-04-26T19:05:31Z")
Hi I am using Winlogbeat 5.x to collect Windows Logs. Lately I have been having an issue with a particular field in the event\_data. Specically event\_data.param17. This field is used by various event sources to contain … --- ## [Exclude archive files from filebeat processing](https://discuss.elastic.co/t/exclude-archive-files-from-filebeat-processing/83147)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 3\ **Last updated:** [April 26, 2017, 11:52am UTC](https://discuss.elastic.co/t/exclude-archive-files-from-filebeat-processing/83147 "2017-04-26T11:52:58Z")
Dear all, I need exclude archive files from filebeat processing. My archive exstensions: \*.gz, \*.bz2 Currently i have configured exclusion of such type of files, but it is not working. exclude\_files: \[".gz$",".ou… --- ## [Need to parse alert logs](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581)
**Author:** [@Debashis\_Adak](https://discuss.elastic.co/u/Debashis_Adak)\ **Replies:** 1\ **Last updated:** [April 26, 2017, 10:31am UTC](https://discuss.elastic.co/t/need-to-parse-alert-logs/83581 "2017-04-26T10:31:03Z")
Hi All, I am new in ELK. I am trying to parse the below log file: Logfile Body: Tue Oct 18 18:04:01 2016 MMNL started with pid=20, OS id=5484 Tue Oct 18 18:04:01 2016 starting up 1 dispatcher(s) for network addres… --- ## [Speed limitations of filebeat?](https://discuss.elastic.co/t/speed-limitations-of-filebeat/46818)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 13\ **Last updated:** [April 26, 2017, 10:12am UTC](https://discuss.elastic.co/t/speed-limitations-of-filebeat/46818 "2017-04-26T10:12:44Z")
We are trying to use Filebeat in front of our ELK stack, feeding it logs from network sensors. We have some particularly 'talky' logs coming out of a system. One of the logs can generate 15k lines per second (eps), and… --- ## [Can't see consulbeat import any data](https://discuss.elastic.co/t/cant-see-consulbeat-import-any-data/83365)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 3\ **Last updated:** [April 26, 2017, 10:02am UTC](https://discuss.elastic.co/t/cant-see-consulbeat-import-any-data/83365 "2017-04-26T10:02:36Z")
Hi, I use consul in my project so I was happy when I found the consulbeat. I tried to us it together with ES 5.3.1. Unfortunately i can't see that it is doing anything. No index is created and no error in the log. … --- ## [Filebeat keeps sending same lines](https://discuss.elastic.co/t/filebeat-keeps-sending-same-lines/83579)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 4\ **Last updated:** [April 26, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-keeps-sending-same-lines/83579 "2017-04-26T09:54:45Z")
It is written that filebeat keeps the state of the file it reads in the registry file. So, it should not send the same logs again and again, if the log file has not changed. I have added a cronjob which restarts filebe… --- ## [How to connect beats to AWS elasticsearch with authentication](https://discuss.elastic.co/t/how-to-connect-beats-to-aws-elasticsearch-with-authentication/83465)
**Author:** [@wb303](https://discuss.elastic.co/u/wb303)\ **Replies:** 3\ **Last updated:** [April 25, 2017, 7:02pm UTC](https://discuss.elastic.co/t/how-to-connect-beats-to-aws-elasticsearch-with-authentication/83465 "2017-04-25T19:02:11Z")
I am trying to send data from remote filebeats and metricbeats to AWS elasticsearch service. I have authentication enabled but I cannot figure out how I would put AWS credentials in the config. In the metricbeat.yml fi… --- ## [Can i send the json format data to ES 2.4.1 using Filebeat 5.3.1?](https://discuss.elastic.co/t/can-i-send-the-json-format-data-to-es-2-4-1-using-filebeat-5-3-1/83550)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 1\ **Last updated:** [April 25, 2017, 12:04pm UTC](https://discuss.elastic.co/t/can-i-send-the-json-format-data-to-es-2-4-1-using-filebeat-5-3-1/83550 "2017-04-25T12:04:18Z")
Hi, I want to send the json format data in the following format to ES using Filebeat; {"@timestamp": "2017-04-24T11:45:59.936Z", "function": "cli", "linenum": 204, "loglevel": "INFO", "message": "Job completed.", "na… --- ## [Dynamic loading of filebeat.yaml?](https://discuss.elastic.co/t/dynamic-loading-of-filebeat-yaml/83503)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [April 25, 2017, 12:02pm UTC](https://discuss.elastic.co/t/dynamic-loading-of-filebeat-yaml/83503 "2017-04-25T12:02:05Z")
Hi, If I add new prospector to running FB configuration, is it required to restart always? Is there some way it will load the latest configuration? br, Sunil --- ## [Contribute Visualizations to Beats](https://discuss.elastic.co/t/contribute-visualizations-to-beats/83482)
**Author:** [@jeffspahr](https://discuss.elastic.co/u/jeffspahr)\ **Replies:** 1\ **Last updated:** [April 25, 2017, 12:00pm UTC](https://discuss.elastic.co/t/contribute-visualizations-to-beats/83482 "2017-04-25T12:00:08Z")
Hello, I'd like to contribute some DNS visualizations for packetbeats. What's the best way to export those from Kibana in the preferred format that will match what's in https://github.com/elastic/beats/tree/master/pac… --- ## [Why WinlogBeat cannot render EventID 1111 message?](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400)
**Author:** [@tianlin](https://discuss.elastic.co/u/tianlin)\ **Replies:** 3\ **Last updated:** [April 25, 2017, 11:51am UTC](https://discuss.elastic.co/t/why-winlogbeat-cannot-render-eventid-1111-message/83400 "2017-04-25T11:51:45Z")
Version: v5.3.0 Operating System: Windows 2003 64bit Steps to Reproduce: When collector EventID 1111 record, it produce“The system cannot find message text for message number 1111 in the message file for C:\\WINDOWS\\Syst… --- ## [Filebeats getsockopt: connection refused](https://discuss.elastic.co/t/filebeats-getsockopt-connection-refused/83032)
**Author:** [@mkorayem](https://discuss.elastic.co/u/mkorayem)\ **Replies:** 8\ **Last updated:** [April 25, 2017, 11:25am UTC](https://discuss.elastic.co/t/filebeats-getsockopt-connection-refused/83032 "2017-04-25T11:25:06Z")
Hi, I have an ELK setup which is working find for all filebeats, winlogbeats and other inputs But on one server Linux SERVERNAME 2.6.18-164.11.1.el5 #1 SMP Wed Jan 20 07:39:04 EST 2010 i686 i686 i386 GNU/Linux I do… --- ## [Filebeats not able to publish events to Logstash](https://discuss.elastic.co/t/filebeats-not-able-to-publish-events-to-logstash/83381)
**Author:** [@virendra\_oswal](https://discuss.elastic.co/u/virendra_oswal)\ **Replies:** 5\ **Last updated:** [April 25, 2017, 7:08am UTC](https://discuss.elastic.co/t/filebeats-not-able-to-publish-events-to-logstash/83381 "2017-04-25T07:08:38Z")
I have logstash on one linux server and have filebeats running on another server where my application is hosted. I am getting following error when i run filebeats, logstash is successfully started. Error: \> 2017/04/24… --- ## [Filebeat Ignoring Messages](https://discuss.elastic.co/t/filebeat-ignoring-messages/83348)
**Author:** [@Laker99](https://discuss.elastic.co/u/Laker99)\ **Replies:** 2\ **Last updated:** [April 24, 2017, 7:36pm UTC](https://discuss.elastic.co/t/filebeat-ignoring-messages/83348 "2017-04-24T19:36:13Z")
Respected Folks, Good day :slight\_smile: May I please request your help w/ Filebeat conf.? I'm a newbie, so apologies in advance if I'm missing something. My log file contains messages like, \<=- 20170414 12:58:39.768 … --- ## [Regarding Filebeat Offset Value](https://discuss.elastic.co/t/regarding-filebeat-offset-value/44139)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 8\ **Last updated:** [April 24, 2017, 7:21pm UTC](https://discuss.elastic.co/t/regarding-filebeat-offset-value/44139 "2017-04-24T19:21:39Z")
Regarding filebeat offset , The value of offset for the lines in the same log file is not shown in sequential order based on order of line numbers in the file. I've some queries on the filebeat offset . Is the offs… --- ## [Beat protocol](https://discuss.elastic.co/t/beat-protocol/83295)
**Author:** [@Mister\_X](https://discuss.elastic.co/u/Mister_X)\ **Replies:** 2\ **Last updated:** [April 24, 2017, 7:00pm UTC](https://discuss.elastic.co/t/beat-protocol/83295 "2017-04-24T19:00:05Z")
I've been looking for the beat protocol definition. I'd like to implement it in another language than just golang (C++ and maybe C#) and I found at least one post in this forum that someone would like to have it in anoth… --- ## [Filebeat, Logback can not create new file](https://discuss.elastic.co/t/filebeat-logback-can-not-create-new-file/83181)
**Author:** [@silb78](https://discuss.elastic.co/u/silb78)\ **Replies:** 3\ **Last updated:** [April 24, 2017, 6:55pm UTC](https://discuss.elastic.co/t/filebeat-logback-can-not-create-new-file/83181 "2017-04-24T18:55:07Z")
I have a logback logger who writes in 10 MB files: \tmp/logs/test.log\ \ \tmp/logs/testlogger.%i.log.zip\ **Author:** [@lightkz](https://discuss.elastic.co/u/lightkz)\ **Replies:** 3\ **Last updated:** [April 24, 2017, 3:44pm UTC](https://discuss.elastic.co/t/kafka-client-from-confluent/83301 "2017-04-24T15:44:06Z") Is there any plans in roadmap to switch to official Kafka client supported by confluent? It seems to setup Kafka connect the agent suppose to support “ interceptor.classes”. That is essential feature to setup Kafka… --- ## [JSON Input showing up line by line](https://discuss.elastic.co/t/json-input-showing-up-line-by-line/83404)
**Author:** [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Replies:** 1\ **Last updated:** [April 24, 2017, 1:16pm UTC](https://discuss.elastic.co/t/json-input-showing-up-line-by-line/83404 "2017-04-24T13:16:16Z")
Hi, I have a JSON file that I want to read and send to logstash. Each json entry is "pretty printed" (with lines). When this is fed to logstash, each line is a new event. ie. There are events with the following: { … --- ## [Beats / Kibana custom format isn't supported](https://discuss.elastic.co/t/beats-kibana-custom-format-isnt-supported/83314)
**Author:** [@bouke](https://discuss.elastic.co/u/bouke)\ **Replies:** 1\ **Last updated:** [April 24, 2017, 9:53am UTC](https://discuss.elastic.co/t/beats-kibana-custom-format-isnt-supported/83314 "2017-04-24T09:53:42Z")
I'm experimenting with metricbeats on a raspberry pi. Set up using the nightly build seems to work fine, and data is being indexed correctly. However, loading the default dashboards and index pattern does not seem to w… --- ## [Multiple multiline](https://discuss.elastic.co/t/multiple-multiline/83263)
**Author:** [@seventy-7](https://discuss.elastic.co/u/seventy-7)\ **Replies:** 1\ **Last updated:** [April 24, 2017, 8:55am UTC](https://discuss.elastic.co/t/multiple-multiline/83263 "2017-04-24T08:55:38Z")
Hello. Is multiple multiline patterns supported yet? I am running 5.2.2. Cheers! --- ## [Send multiple log files to elastic via filebeat](https://discuss.elastic.co/t/send-multiple-log-files-to-elastic-via-filebeat/83202)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 1\ **Last updated:** [April 24, 2017, 8:31am UTC](https://discuss.elastic.co/t/send-multiple-log-files-to-elastic-via-filebeat/83202 "2017-04-24T08:31:01Z")
I want to send multiple log files from filebeat to elastic. Like this, filebeat.prospectors: - input\_type: log paths: - /var/log/postgresql/postgresql-2017-04-21\_120121.log document\_type: postgres… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=526) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=528)