# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=529 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 530 --- ## [Filebeat / logstash truncating json log lines](https://discuss.elastic.co/t/filebeat-logstash-truncating-json-log-lines/80463)
**Author:** [@robinallen](https://discuss.elastic.co/u/robinallen)\ **Replies:** 7\ **Last updated:** [April 19, 2017, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-logstash-truncating-json-log-lines/80463 "2017-04-19T13:41:53Z")
I'm using Logstash 5.2.2, Filebeat 5.2.2, Logstash-logback-encoder 4.7 I'm using net.logstash.logback.encoder.LogstashEncoder to write our application logs in JSON format. The logs themselves look fine. Then I'm using… --- ## [Filebeat system module parse messages](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849)
**Author:** [@nbrys](https://discuss.elastic.co/u/nbrys)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849 "2017-04-19T13:23:30Z")
I've just started using filebeat and the apache2 and system module. The apache2 module parses all messages and exporting a nice number of fields. Is there any news if the system module will do the same? I'm mostly intere… --- ## [Filebeat - Windows 10 x64](https://discuss.elastic.co/t/filebeat-windows-10-x64/82445)
**Author:** [@Martin\_Carlson](https://discuss.elastic.co/u/Martin_Carlson)\ **Replies:** 15\ **Last updated:** [April 19, 2017, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-windows-10-x64/82445 "2017-04-19T13:10:01Z")
I have a bit of a unique set up, I'm trying to create a proof of concept environment to test some of the functionality. I have the following set up: Filebeat 5.3 on my host OS. This is running Windows 10 64-bit. Logsta… --- ## [Filebeat apache2 module](https://discuss.elastic.co/t/filebeat-apache2-module/82406)
**Author:** [@nbrys](https://discuss.elastic.co/u/nbrys)\ **Replies:** 3\ **Last updated:** [April 19, 2017, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-apache2-module/82406 "2017-04-19T13:03:23Z")
I'm currently trying to send apache2 logs using filebeat to elasticsearch. I've got the following at the end of my filebeat.yml file: filebeat.modules: - module: apache2 access: var.paths = \["/var/log/a… --- ## [Unable to forward logs from windows(filebeat) to linux logstash](https://discuss.elastic.co/t/unable-to-forward-logs-from-windows-filebeat-to-linux-logstash/82855)
**Author:** [@aruna123](https://discuss.elastic.co/u/aruna123)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 12:07pm UTC](https://discuss.elastic.co/t/unable-to-forward-logs-from-windows-filebeat-to-linux-logstash/82855 "2017-04-19T12:07:18Z")
Hello Everyone, I am newbie to ELK. I started moving some log files(\*.txt) files from windows( via Filebeat) to Linux(Logstash) server. Installed Filebeat in windows 2012. Updated log path and added logstash ip a… --- ## [Filebeat missed one complete log file in log rotation](https://discuss.elastic.co/t/filebeat-missed-one-complete-log-file-in-log-rotation/79733)
**Author:** [@siddharthgoel88](https://discuss.elastic.co/u/siddharthgoel88)\ **Replies:** 9\ **Last updated:** [April 19, 2017, 11:53am UTC](https://discuss.elastic.co/t/filebeat-missed-one-complete-log-file-in-log-rotation/79733 "2017-04-19T11:53:50Z")
We are using Filebeat version 1.3.1 for our system and following is it's config : filebeat: prospectors: paths: - "/path/to/file.log\*" fields\_under\_root: true document\_type: "event-type" fields: host: "host-xyz" … --- ## [Develop a console to manage several Filebeats client](https://discuss.elastic.co/t/develop-a-console-to-manage-several-filebeats-client/82424)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [April 19, 2017, 10:01am UTC](https://discuss.elastic.co/t/develop-a-console-to-manage-several-filebeats-client/82424 "2017-04-19T10:01:22Z")
Hi, in my thoughts there is the idea to create a console, or something similar, to manage the start & stop of every Filebeat clients in my environment. Leaving out the network necessary configurations, did you faces anyt… --- ## [Metricbeat CPU percentage between 0 and 1](https://discuss.elastic.co/t/metricbeat-cpu-percentage-between-0-and-1/82712)
**Author:** [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)\ **Replies:** 5\ **Last updated:** [April 19, 2017, 9:27am UTC](https://discuss.elastic.co/t/metricbeat-cpu-percentage-between-0-and-1/82712 "2017-04-19T09:27:35Z")
Hi there, Posting data to ElasticSearch via LogStash I get CPU values that range from 0 to 1. In the default template this is a scaled\_float, I haven't changed the template. When I look at discover or I visualise the d… --- ## [FileBeat misses lines at the beginning of a new file](https://discuss.elastic.co/t/filebeat-misses-lines-at-the-beginning-of-a-new-file/82420)
**Author:** [@BertrandC4](https://discuss.elastic.co/u/BertrandC4)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 8:29am UTC](https://discuss.elastic.co/t/filebeat-misses-lines-at-the-beginning-of-a-new-file/82420 "2017-04-19T08:29:46Z")
Sometimes Filebeat (5.3) misses some lines at the beginning of a new file. From debug filebeat logs, it looks like filebeat detects an Update existing file for harvesting but it is not an upated/renamed/moved file, just… --- ## [How to start filebeat in windows](https://discuss.elastic.co/t/how-to-start-filebeat-in-windows/82821)
**Author:** [@shravan\_kumar](https://discuss.elastic.co/u/shravan_kumar)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 7:57am UTC](https://discuss.elastic.co/t/how-to-start-filebeat-in-windows/82821 "2017-04-19T07:57:43Z")
Hi, I've installed logstash and filebeat in windows. I started the filebeat service from poweshell using following command, But getting an error . PS C:\\filebeat-5.3.0-windows-x86\> Start-Service filebeat Error: S… --- ## [Connection Reset By Peer](https://discuss.elastic.co/t/connection-reset-by-peer/82477)
**Author:** [@RAY2017](https://discuss.elastic.co/u/RAY2017)\ **Replies:** 2\ **Last updated:** [April 19, 2017, 6:01am UTC](https://discuss.elastic.co/t/connection-reset-by-peer/82477 "2017-04-19T06:01:00Z")
Getting connection reset by Peer when filebeat process is restarted. 2017-04-14T15:08:34-05:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published\_and\_acked\_events=30563 filebeat.harvester.running=9 fileb… --- ## [Filebeat not sending NAS path logs](https://discuss.elastic.co/t/filebeat-not-sending-nas-path-logs/81410)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 7\ **Last updated:** [April 19, 2017, 3:56am UTC](https://discuss.elastic.co/t/filebeat-not-sending-nas-path-logs/81410 "2017-04-19T03:56:20Z")
I have given below lines in filebeat yml. filebeat.prospectors: - input\_type: log paths: - /var/log/\*.log - \\\\BNGWIDFL001.aonnet.aon.net\\ECMLogs\\NavigatorLogs\\EDSService\\\*.log - D:\\logs\\\*.log document\_type:… --- ## [ERR Connecting error publishing events (retrying)](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625)
**Author:** [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\ **Replies:** 4\ **Last updated:** [April 19, 2017, 12:13am UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying/82625 "2017-04-19T00:13:41Z")
Hi. I have a problem when Beats connecting to Logstash: 2017-04-17T14:53:22-05:00 INFO Harvester started for file: /var/elk/logFile.log 2017-04-17T14:53:22-05:00 ERR Connecting error publishing events (retrying): dial … --- ## [How to get the logs from Cloud windows server to vmware ubuntu 14 ELK server](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707)
**Author:** [@onlybalu](https://discuss.elastic.co/u/onlybalu)\ **Replies:** 6\ **Last updated:** [April 18, 2017, 3:17pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707 "2017-04-18T15:17:49Z")
Hi Team, How to get the logs from Cloud windows server to vmware ubuntu 14 ELK server..... Its very urgent basis.... --- ## [On demand training - Elastic Stack: Logging](https://discuss.elastic.co/t/on-demand-training-elastic-stack-logging/82295)
**Author:** [@jdezego](https://discuss.elastic.co/u/jdezego)\ **Replies:** 2\ **Last updated:** [April 18, 2017, 2:51pm UTC](https://discuss.elastic.co/t/on-demand-training-elastic-stack-logging/82295 "2017-04-18T14:51:47Z")
I'm following the video training, at a point where I'm supposed to run a Windows Powershell script to load the TopBeats dashboards into the .kibana index. Getting the following error, then if I open Kibana in a web brows… --- ## [Problem to define multiples propsector with filebeat](https://discuss.elastic.co/t/problem-to-define-multiples-propsector-with-filebeat/36918)
**Author:** [@aaroy428](https://discuss.elastic.co/u/aaroy428)\ **Replies:** 6\ **Last updated:** [April 18, 2017, 2:20pm UTC](https://discuss.elastic.co/t/problem-to-define-multiples-propsector-with-filebeat/36918 "2017-04-18T14:20:25Z")
Hi everybody, I am new to filebeat. I do have some issues to properly format filebeat to use multiples prospector. My goal is to separate my file type with a separate prospector to add selector fields used after … --- ## [Panic error](https://discuss.elastic.co/t/panic-error/81600)
**Author:** [@AndreAga](https://discuss.elastic.co/u/AndreAga)\ **Replies:** 7\ **Last updated:** [April 18, 2017, 2:03pm UTC](https://discuss.elastic.co/t/panic-error/81600 "2017-04-18T14:03:16Z")
Hi, I receive the following panic error: 2017/04/07 11:35:58.534945 outputs.go:108: INFO Activated elasticsearch as output plugin. 2017/04/07 11:35:58.535113 publish.go:295: INFO Publisher name: weblogic 2017/04/07 11:… --- ## [Metricbeat Disk Usage Stopped Reporting Disk Usage over 94.96%](https://discuss.elastic.co/t/metricbeat-disk-usage-stopped-reporting-disk-usage-over-94-96/82221)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [April 18, 2017, 1:46pm UTC](https://discuss.elastic.co/t/metricbeat-disk-usage-stopped-reporting-disk-usage-over-94-96/82221 "2017-04-18T13:46:40Z")
We use metricbeat to track disk usage on all of our machines. We have disk usage alerts configured which fire off when a disk is at 95% usage. We ended up having a crash because a machine ran out of disk space, and when … --- ## [Package beat with proper RPM naming](https://discuss.elastic.co/t/package-beat-with-proper-rpm-naming/82542)
**Author:** [@yuanlinios](https://discuss.elastic.co/u/yuanlinios)\ **Replies:** 2\ **Last updated:** [April 18, 2017, 1:32am UTC](https://discuss.elastic.co/t/package-beat-with-proper-rpm-naming/82542 "2017-04-18T01:32:53Z")
Hello experts I developed a customized community beat, and want to build RPMs, and then deploy to my environment. I can use "make package" to build RPMs successfully, but I want to make the package name and its rpm … --- ## [Filebeat -\> Logstash connection reset by peer, send fail](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589)
**Author:** [@reedflinch](https://discuss.elastic.co/u/reedflinch)\ **Replies:** 2\ **Last updated:** [April 17, 2017, 4:28pm UTC](https://discuss.elastic.co/t/filebeat-logstash-connection-reset-by-peer-send-fail/82589 "2017-04-17T16:28:46Z")
I recently started noticing in my Filebeat logs the following: DBG connect ERR Connecting error publishing events (retrying): read tcp \:43318-\>\:5044: read: connection reset by peer DBG … --- ## [How do I pass stdin logs from docker containers?](https://discuss.elastic.co/t/how-do-i-pass-stdin-logs-from-docker-containers/44018)
**Author:** [@panda87](https://discuss.elastic.co/u/panda87)\ **Replies:** 5\ **Last updated:** [April 17, 2017, 2:44pm UTC](https://discuss.elastic.co/t/how-do-i-pass-stdin-logs-from-docker-containers/44018 "2017-04-17T14:44:05Z")
I have machine with many docker containers and I want to find a way to how centralised the containers logs into one beats app which will be installed on each machine (with multiple containers). So my question is how can … --- ## [Topbeat - unreachable redis blocks logstash output](https://discuss.elastic.co/t/topbeat-unreachable-redis-blocks-logstash-output/82549)
**Author:** [@rajamadhavan](https://discuss.elastic.co/u/rajamadhavan)\ **Replies:** 1\ **Last updated:** [April 17, 2017, 1:59pm UTC](https://discuss.elastic.co/t/topbeat-unreachable-redis-blocks-logstash-output/82549 "2017-04-17T13:59:07Z")
Hi, For a specific requirement, I have to send topbeat data to 2 different outputs simultaneously Redis logstash Under normal cases when both are reachable, data reaches both outputs without any issue. If l… --- ## [Filebeat collects different formats in the same log file](https://discuss.elastic.co/t/filebeat-collects-different-formats-in-the-same-log-file/82390)
**Author:** [@fiz](https://discuss.elastic.co/u/fiz)\ **Replies:** 2\ **Last updated:** [April 17, 2017, 2:17am UTC](https://discuss.elastic.co/t/filebeat-collects-different-formats-in-the-same-log-file/82390 "2017-04-17T02:17:46Z")
Filebeat collects different formats in the same log file , the logs record all in one file ,line by line , but the formath is different ,anyone know how to solve this? 13:04:57.607 \[send\]{"servicetype":"verify","erro… --- ## [Drop\_event equals condition does not work on floats](https://discuss.elastic.co/t/drop-event-equals-condition-does-not-work-on-floats/82433)
**Author:** [@Darien\_Rrushi](https://discuss.elastic.co/u/Darien_Rrushi)\ **Replies:** 2\ **Last updated:** [April 14, 2017, 7:11pm UTC](https://discuss.elastic.co/t/drop-event-equals-condition-does-not-work-on-floats/82433 "2017-04-14T19:11:32Z")
In using the metricbeat with the system module, I'm trying to drop process events where certain conditions are true. I have configured my yml file with the below processor and the configuration tests ok. However the even… --- ## [Heartbeat 5.1.2 download](https://discuss.elastic.co/t/heartbeat-5-1-2-download/82417)
**Author:** [@open\_door8](https://discuss.elastic.co/u/open_door8)\ **Replies:** 4\ **Last updated:** [April 14, 2017, 3:47pm UTC](https://discuss.elastic.co/t/heartbeat-5-1-2-download/82417 "2017-04-14T15:47:30Z")
Where can I download Heartbeat v.5.1.2 --- ## [Filebeat fails to start in ubuntu 16.04](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418)
**Author:** [@praveen133t](https://discuss.elastic.co/u/praveen133t)\ **Replies:** 3\ **Last updated:** [April 14, 2017, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418 "2017-04-14T15:03:21Z")
When I try to start filebeat using sudo service filebeat start it does not throw any error. But when I do sudo service filebeat status I see the following error ● filebeat.service - filebeat Loaded: loaded (/lib/sys… --- ## [Specifying and defining fields](https://discuss.elastic.co/t/specifying-and-defining-fields/82334)
**Author:** [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\ **Replies:** 1\ **Last updated:** [April 13, 2017, 5:50pm UTC](https://discuss.elastic.co/t/specifying-and-defining-fields/82334 "2017-04-13T17:50:03Z")
Looking through the documentation and I can see how to add static fields, and set those fields into the root level of the json, but I'm having trouble figuring out if there is a way for me to specify which fields I want … --- ## [Is it possible to get individual IP address count from different sources to my server(packetbeat installed)](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316)
**Author:** [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 3:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316 "2017-04-13T15:22:18Z")
I am using "packet beats" for my project which is related to DoS(Denial of service) attacks. Is it possible to make "packetbeat" to store unique ip addresses(from different sources) along with some parameters --\> count o… --- ## [Filebeat reads 1 event log multiple times](https://discuss.elastic.co/t/filebeat-reads-1-event-log-multiple-times/81822)
**Author:** [@vishalkin](https://discuss.elastic.co/u/vishalkin)\ **Replies:** 4\ **Last updated:** [April 13, 2017, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-reads-1-event-log-multiple-times/81822 "2017-04-13T14:37:56Z")
I have a Elasticsearch, Logstash, Kibana, Filebeat (5.1.1) running on same server. When I load a json file in the file beat and try and see the output in Kibana, I see same event\_log is added 4 times in Elastic index. … --- ## [About the winlogbeats output](https://discuss.elastic.co/t/about-the-winlogbeats-output/82098)
**Author:** [@qiuyuanshun](https://discuss.elastic.co/u/qiuyuanshun)\ **Replies:** 3\ **Last updated:** [April 13, 2017, 1:21pm UTC](https://discuss.elastic.co/t/about-the-winlogbeats-output/82098 "2017-04-13T13:21:20Z")
If I want to output through the network port to another server on the file, how should I set up my output, I can not find the relevant settings. [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=528) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=530)