# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=528 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 529 --- ## [Filebeat load old data](https://discuss.elastic.co/t/filebeat-load-old-data/82493)
**Author:** [@santhosh244](https://discuss.elastic.co/u/santhosh244)\ **Replies:** 5\ **Last updated:** [April 24, 2017, 7:40am UTC](https://discuss.elastic.co/t/filebeat-load-old-data/82493 "2017-04-24T07:40:15Z")
Team, We have 40 instances running filebeat and centralized logstash. Our application rotates the log files based on size and deleted after 5 files. So during high volume peak hours. Logs gets queued in our servers… --- ## [Can I use conditional logic to filter log lines with filebeat?](https://discuss.elastic.co/t/can-i-use-conditional-logic-to-filter-log-lines-with-filebeat/82791)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 3\ **Last updated:** [April 24, 2017, 7:35am UTC](https://discuss.elastic.co/t/can-i-use-conditional-logic-to-filter-log-lines-with-filebeat/82791 "2017-04-24T07:35:31Z")
I previously asked how I could send only a sample of my logs with filebeat: https://discuss.elastic.co/t/ship-only-a-percentage-of-logs-to-logstash/77393 Im filtering iis request logs and the volume is very high, i wan… --- ## [How to send CSV from Filebeat to Logstash](https://discuss.elastic.co/t/how-to-send-csv-from-filebeat-to-logstash/81745)
**Author:** [@nathan.tivaci](https://discuss.elastic.co/u/nathan.tivaci)\ **Replies:** 9\ **Last updated:** [April 24, 2017, 7:18am UTC](https://discuss.elastic.co/t/how-to-send-csv-from-filebeat-to-logstash/81745 "2017-04-24T07:18:39Z")
Hello guys, Please bear with the noobness of this thread. My objective here is to send CSV from Filebeat to Logstash-Elasticsearch-Kibana Here is my Filebeat.yml: - input\_type: log paths: - /var/log/domon… --- ## [Filebeat does not create daily indices into elasticsearch automatically](https://discuss.elastic.co/t/filebeat-does-not-create-daily-indices-into-elasticsearch-automatically/83351)
**Author:** [@XiaozhongLiu](https://discuss.elastic.co/u/XiaozhongLiu)\ **Replies:** 3\ **Last updated:** [April 24, 2017, 4:22am UTC](https://discuss.elastic.co/t/filebeat-does-not-create-daily-indices-into-elasticsearch-automatically/83351 "2017-04-24T04:22:18Z")
filebeat does not create daily indices into elasticsearch automatically. for example I have to manually create a indice like filebeat-2017.04.24, with this, filebeat can then auto harvest and dump logs. if no indice is… --- ## [Trouble running metricbeat:5.3.0 with docker module](https://discuss.elastic.co/t/trouble-running-metricbeat-5-3-0-with-docker-module/82204)
**Author:** [@bsimpson53](https://discuss.elastic.co/u/bsimpson53)\ **Replies:** 7\ **Last updated:** [April 24, 2017, 3:24am UTC](https://discuss.elastic.co/t/trouble-running-metricbeat-5-3-0-with-docker-module/82204 "2017-04-24T03:24:30Z")
Hi, I've got metricbeat:5.3.0 happily pumping host data (system module) directly to elasticsearch:5.3.0 within a docker swarm (swarm mode), but I'm having difficulty getting the metricbeat docker module to work (I have… --- ## [Filebeat multiline equivalent of logstash "what"](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264)
**Author:** [@seventy-7](https://discuss.elastic.co/u/seventy-7)\ **Replies:** 1\ **Last updated:** [April 22, 2017, 3:05am UTC](https://discuss.elastic.co/t/filebeat-multiline-equivalent-of-logstash-what/83264 "2017-04-22T03:05:37Z")
Hello. I'm looking to append a java stacktrace to the previous log line which is the application error. I was previously able to achieve this in logstash with the following: multiline { pattern =\> "(^.+Ex… --- ## [Metricbeat and availables metrics](https://discuss.elastic.co/t/metricbeat-and-availables-metrics/83092)
**Author:** [@matt-dee](https://discuss.elastic.co/u/matt-dee)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 8:46pm UTC](https://discuss.elastic.co/t/metricbeat-and-availables-metrics/83092 "2017-04-21T20:46:43Z")
HI, I just installed metricbeat and I see that there are about 326 fields available for the metricbeat indexes on the kibana dashboard. I'm only seeing 71 fields that are being populated. I'm particulary interested i… --- ## [Heartbeat is not sending anything to Elasticsearch](https://discuss.elastic.co/t/heartbeat-is-not-sending-anything-to-elasticsearch/83148)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 1:18pm UTC](https://discuss.elastic.co/t/heartbeat-is-not-sending-anything-to-elasticsearch/83148 "2017-04-21T13:18:30Z")
Hi, I think I am missing something. I have started heartbeat. I see that dashboards are created in Kibana but there is no data from heartbeat. What is missing? heartbeat.monitors: type: http urls: \["http://consul… --- ## [Define Index Pattern for Metricbeat in Kibana](https://discuss.elastic.co/t/define-index-pattern-for-metricbeat-in-kibana/82793)
**Author:** [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 11:28am UTC](https://discuss.elastic.co/t/define-index-pattern-for-metricbeat-in-kibana/82793 "2017-04-21T11:28:05Z")
Currently I have only one server from which I collect metrics by Metricbeat. In Kibana I created index pattern metricbeat-\* to be able create some charts. But how can I create index patterns for several servers? Should I… --- ## [Panic error, "panic: name bytes\_read already used"](https://discuss.elastic.co/t/panic-error-panic-name-bytes-read-already-used/82840)
**Author:** [@QC\_Wong](https://discuss.elastic.co/u/QC_Wong)\ **Replies:** 4\ **Last updated:** [April 21, 2017, 11:24am UTC](https://discuss.elastic.co/t/panic-error-panic-name-bytes-read-already-used/82840 "2017-04-21T11:24:00Z")
Hi, I receive the following panic error: panic: name bytes\_read already used goroutine 41 \[running\]: panic(0x9250a0, 0xc4203279a0) /usr/local/go/src/runtime/panic.go:500 +0x1a1 github.com/elastic/beats/libbeat/m… --- ## [Howto retry from begining the today log file into es](https://discuss.elastic.co/t/howto-retry-from-begining-the-today-log-file-into-es/82842)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 9\ **Last updated:** [April 21, 2017, 11:21am UTC](https://discuss.elastic.co/t/howto-retry-from-begining-the-today-log-file-into-es/82842 "2017-04-21T11:21:23Z")
howto retry from begining the today log file into es when i run follow command rm -rf filebeat/data/registry restart filebeat service the result: ES display curent time not today log file begining line --- ## [DBG Try to publish 2048 events to logstash with window size 1024](https://discuss.elastic.co/t/dbg-try-to-publish-2048-events-to-logstash-with-window-size-1024/83119)
**Author:** [@messageinabottle](https://discuss.elastic.co/u/messageinabottle)\ **Replies:** 1\ **Last updated:** [April 21, 2017, 9:16am UTC](https://discuss.elastic.co/t/dbg-try-to-publish-2048-events-to-logstash-with-window-size-1024/83119 "2017-04-21T09:16:15Z")
filebeat version 1.1.1 (amd64) sending to logstash 2.2.4 - no, I cannot upgrade to newer versions at this time. When running filebeat in debug mode I'm getting a LOT of the following messages: DBG Try to publish 2048… --- ## [Filebeat slowing to a halt within 20-30 minutes of starting](https://discuss.elastic.co/t/filebeat-slowing-to-a-halt-within-20-30-minutes-of-starting/83004)
**Author:** [@thedongen](https://discuss.elastic.co/u/thedongen)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 9:02am UTC](https://discuss.elastic.co/t/filebeat-slowing-to-a-halt-within-20-30-minutes-of-starting/83004 "2017-04-21T09:02:41Z")
I'm using the ELK stack to receive and parse logfiles from an Apache server. My Elasticsearch cluster consists of 3 nodes, with Logstash running on one of these nodes. I've set up Filebeat on the machine that stores the… --- ## [Does filebeat handles .gz zipped log files?](https://discuss.elastic.co/t/does-filebeat-handles-gz-zipped-log-files/83031)
**Author:** [@Sharath\_Vutpala](https://discuss.elastic.co/u/Sharath_Vutpala)\ **Replies:** 1\ **Last updated:** [April 21, 2017, 8:58am UTC](https://discuss.elastic.co/t/does-filebeat-handles-gz-zipped-log-files/83031 "2017-04-21T08:58:45Z")
I am interested in sending logs of an Elastic Map Reduce instance to Elasticsearch. But these are logged as .gz extension files. When i see the logs in Kibana, i am getting non-readable characters. Can we send .gz forma… --- ## [FB 5.x -\> Logstash 2.4 -\> ES 1.7... Cool or no?](https://discuss.elastic.co/t/fb-5-x-logstash-2-4-es-1-7-cool-or-no/81198)
**Author:** [@JimFromMarin](https://discuss.elastic.co/u/JimFromMarin)\ **Replies:** 3\ **Last updated:** [April 20, 2017, 6:36pm UTC](https://discuss.elastic.co/t/fb-5-x-logstash-2-4-es-1-7-cool-or-no/81198 "2017-04-20T18:36:03Z")
Howdy folks, I'm in the process of moving to a 5.x stack from my ancient Filebeat-1.3 -\> Logstash-2.4 -\> ES-1.7 stack. The plan is to build a 5.x stack, run both stacks in parallel to the end of the retention window… --- ## [Simplification of filebeat.yml?](https://discuss.elastic.co/t/simplification-of-filebeat-yml/82946)
**Author:** [@\_Ian](https://discuss.elastic.co/u/_Ian)\ **Replies:** 2\ **Last updated:** [April 20, 2017, 1:43pm UTC](https://discuss.elastic.co/t/simplification-of-filebeat-yml/82946 "2017-04-20T13:43:23Z")
What would be the best way to configure Filebeat to ship multiple rolling log types while simplifying the configuration? I have ~30 of these files to monitor and was hoping to use reference variables to streamline the … --- ## [Filebeat Memory Leakage Investigation](https://discuss.elastic.co/t/filebeat-memory-leakage-investigation/83012)
**Author:** [@ademmers](https://discuss.elastic.co/u/ademmers)\ **Replies:** 5\ **Last updated:** [April 20, 2017, 11:28am UTC](https://discuss.elastic.co/t/filebeat-memory-leakage-investigation/83012 "2017-04-20T11:28:28Z")
Hi, Filebeat version 5.2.0 OS: Centos 6.6 and 7.2 Configuration (cfr second post) On our production environment I'm investigating memory leaking in the filebeat process. I've gotten so far to deduce (using go tool p… --- ## [Mongodb\_parser.go:42: ERR Unknown operation code:](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939)
**Author:** [@PravinDwiwedi](https://discuss.elastic.co/u/PravinDwiwedi)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 10:22am UTC](https://discuss.elastic.co/t/mongodb-parser-go-42-err-unknown-operation-code/82939 "2017-04-20T10:22:51Z")
Getting below error when started packetbeat for MongoDB-- " mongodb\_parser.go:42: ERR Unknown operation code:" Platform Details-- \* Packetbeat- 5.3 \* OS- LINUX 6.6 64bits \* MongoDB- 3.2 \* Output- Elasticsearch 5.2.2 N… --- ## [Urgent help needed : Filebeat xml question](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774)
**Author:** [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 9:48am UTC](https://discuss.elastic.co/t/urgent-help-needed-filebeat-xml-question/82774 "2017-04-20T09:48:39Z")
Hi, I am trying to read IO logs files using file beat and having issues with the getting all the lines of xml into the logstash. here is sample of what i am trying to read https://play.golang.org/p/wZL0Vd3tx\_ The p… --- ## [Where is the location of spool of filebeat in memory ? RAM?](https://discuss.elastic.co/t/where-is-the-location-of-spool-of-filebeat-in-memory-ram/82772)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 9:46am UTC](https://discuss.elastic.co/t/where-is-the-location-of-spool-of-filebeat-in-memory-ram/82772 "2017-04-20T09:46:29Z")
I want to know that where is the location of the spooler which is used in filebeat ? Is it stored in RAM ? The registry files are stored on the disk, but I want to know the location of this spooler. --- ## [Filebeat stops sending logs, but with no errors, service is running](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765)
**Author:** [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 9:45am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765 "2017-04-20T09:45:34Z")
Ran into a weird issue. I have Filebeat picking up logs on a centos7 vm and sending them over to instances of Graylog using the Logstash output. I having Metricbeat and Packetbeat saving to disk, so Filebeat would pic… --- ## [A big trouble about from filebeat to logstash use SSL to transition](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 5\ **Last updated:** [April 20, 2017, 9:38am UTC](https://discuss.elastic.co/t/a-big-trouble-about-from-filebeat-to-logstash-use-ssl-to-transition/82537 "2017-04-20T09:38:22Z")
dear all: i have a big trouble about two weeks when i install the plugin x-pack kibana & elasticsearch & logstash between kibana and elasticsearch linked to use username/password between logstash and elas… --- ## [Filebeat ERR Connecting error publishing events (retrying) read tcp i/o timeout](https://discuss.elastic.co/t/filebeat-err-connecting-error-publishing-events-retrying-read-tcp-i-o-timeout/82368)
**Author:** [@Daniel\_Chen](https://discuss.elastic.co/u/Daniel_Chen)\ **Replies:** 4\ **Last updated:** [April 20, 2017, 9:33am UTC](https://discuss.elastic.co/t/filebeat-err-connecting-error-publishing-events-retrying-read-tcp-i-o-timeout/82368 "2017-04-20T09:33:03Z")
I have Filebeat 5.3.0 installed on one of my server filebeat.yml: filebeat: prospectors: - paths: - /home/jarvis/data/nginx-logs/\*.log input\_type: log document\_type: nginx-access … --- ## [Monitor HTTPS(SSL) url's](https://discuss.elastic.co/t/monitor-https-ssl-urls/82301)
**Author:** [@suvitt](https://discuss.elastic.co/u/suvitt)\ **Replies:** 3\ **Last updated:** [April 20, 2017, 9:24am UTC](https://discuss.elastic.co/t/monitor-https-ssl-urls/82301 "2017-04-20T09:24:14Z")
Hi, I am trying to monitor the ssl urls and for some reason I seem to have issues getting it to work. heartbeat.monitors: - type: http ##Sample rest api urls: \["http://localhost:8725/api/XXX/YYY"\] check.request.… --- ## [How to reduce beat memory usage?](https://discuss.elastic.co/t/how-to-reduce-beat-memory-usage/82825)
**Author:** [@krhubert](https://discuss.elastic.co/u/krhubert)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 8:07am UTC](https://discuss.elastic.co/t/how-to-reduce-beat-memory-usage/82825 "2017-04-20T08:07:33Z")
Hi, I have 3 beats on instances: metricbeat countbeat (the one from developer guide) filebeat I checked memory usage and the result was surprising: 590.27 Mb /usr/share/metricbeat/bin/metricbeat 115.02 Mb /… --- ## ["Design" considerations about indices from different beats?](https://discuss.elastic.co/t/design-considerations-about-indices-from-different-beats/82891)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 8:04am UTC](https://discuss.elastic.co/t/design-considerations-about-indices-from-different-beats/82891 "2017-04-20T08:04:52Z")
Hi, We do now have a working win/file - beats -\> kafka -\> logstash -\> ES dev setup. And with help from forum users everything is running as it should :slight\_smile: A new thing that was introduced is the thought wit… --- ## [Filebeat unable to send logs from windows 2008 R2 server](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-from-windows-2008-r2-server/81755)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 4\ **Last updated:** [April 20, 2017, 6:37am UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-logs-from-windows-2008-r2-server/81755 "2017-04-20T06:37:25Z")
i am using Elasticsearch, logstash and kibana version 5.2.0 and to monitor logs from remote servers, i have installed filebeat in respective servers (windows server 2012) and able to get logs from remote servers. Since… --- ## [Fail to run metricbeat container without internet connection](https://discuss.elastic.co/t/fail-to-run-metricbeat-container-without-internet-connection/82857)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 7:28pm UTC](https://discuss.elastic.co/t/fail-to-run-metricbeat-container-without-internet-connection/82857 "2017-04-19T19:28:46Z")
Hi, It looks like metricbeat is trying to download dashboards every time the docker container start. This fails when there is no internet connection. docker logs metricbeat curl: (3) \[globbing\] nested brace in colum… --- ## [Filebeat.yml must be owned by the beat user (uid=0) or root](https://discuss.elastic.co/t/filebeat-yml-must-be-owned-by-the-beat-user-uid-0-or-root/82899)
**Author:** [@dulman](https://discuss.elastic.co/u/dulman)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 3:08pm UTC](https://discuss.elastic.co/t/filebeat-yml-must-be-owned-by-the-beat-user-uid-0-or-root/82899 "2017-04-19T15:08:18Z")
Hello, why as of filebeat 5.3.0 filebeat.yml must be owned by the beat user (uid=0) or root? filebeat2017/04/19 13:51:05.725413 beat.go:339: CRIT Exiting: error loading config file: config file ("/home/elastic/filebea… --- ## [Provided Grok expressions do not match field value when apache2 response\_code is 304](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-when-apache2-response-code-is-304/81512)
**Author:** [@dulman](https://discuss.elastic.co/u/dulman)\ **Replies:** 2\ **Last updated:** [April 19, 2017, 2:01pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-when-apache2-response-code-is-304/81512 "2017-04-19T14:01:43Z")
Hello, I'm using Filebeat 5.3.0 with the apache2 module. I'm getting grok expression errors. Example: When the following line appears in the access.log: 127.0.0.1 - ironman \[06/Apr/2017:18:55:56 +0200\] "GET /bundles/… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=527) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=529)