# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=530 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 531 --- ## [BELK and Sensu](https://discuss.elastic.co/t/belk-and-sensu/82027)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [April 13, 2017, 1:16pm UTC](https://discuss.elastic.co/t/belk-and-sensu/82027 "2017-04-13T13:16:00Z")
Whether BELK can have all the features supported by Sensu? Is there any comparison/study related blog to understand the Sensu features supported by BELK stack? --- ## [Question about config for changing CSV](https://discuss.elastic.co/t/question-about-config-for-changing-csv/82024)
**Author:** [@brandono](https://discuss.elastic.co/u/brandono)\ **Replies:** 1\ **Last updated:** [April 13, 2017, 1:15pm UTC](https://discuss.elastic.co/t/question-about-config-for-changing-csv/82024 "2017-04-13T13:15:19Z")
I'm new to filebeat, and looking for some guidance for a use-case. I'm looking to use filebeat on a remote computer in order to forward a CSV to logstash. The CSV is updated daily. New data is appended throughout the … --- ## [How to restart Filebeat after adding a new prospector to filebeat.yml?](https://discuss.elastic.co/t/how-to-restart-filebeat-after-adding-a-new-prospector-to-filebeat-yml/79742)
**Author:** [@rohitC](https://discuss.elastic.co/u/rohitC)\ **Replies:** 7\ **Last updated:** [April 13, 2017, 1:11pm UTC](https://discuss.elastic.co/t/how-to-restart-filebeat-after-adding-a-new-prospector-to-filebeat-yml/79742 "2017-04-13T13:11:02Z")
I downloaded Filebeat from (https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.2-linux-x86\_64.tar.gz) and extracted the tar on my Ubuntu 14.04 machine. I run Filebeat on my Ubuntu terminal with the follow… --- ## [Metricbeat with Apache Virtual Host](https://discuss.elastic.co/t/metricbeat-with-apache-virtual-host/81861)
**Author:** [@NepaliNightmare](https://discuss.elastic.co/u/NepaliNightmare)\ **Replies:** 4\ **Last updated:** [April 13, 2017, 12:40pm UTC](https://discuss.elastic.co/t/metricbeat-with-apache-virtual-host/81861 "2017-04-13T12:40:13Z")
HI, I am attempting to monitor 2 web servers that run apache with a virtual host. When I open the Kibana Apache HTTPD server status dashboard, I get the familiar error of Saved" field" parameters is now invalid.… --- ## [Topbeat for JVM metrics monitoring](https://discuss.elastic.co/t/topbeat-for-jvm-metrics-monitoring/38444)
**Author:** [@kushan85](https://discuss.elastic.co/u/kushan85)\ **Replies:** 10\ **Last updated:** [April 13, 2017, 11:04am UTC](https://discuss.elastic.co/t/topbeat-for-jvm-metrics-monitoring/38444 "2017-04-13T11:04:07Z")
Can we use topbeat for monitoring JVM metrics like heap memory, active threads, garbage collection etc. ? --- ## [How to monitor the JVM stats](https://discuss.elastic.co/t/how-to-monitor-the-jvm-stats/81921)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 10:51am UTC](https://discuss.elastic.co/t/how-to-monitor-the-jvm-stats/81921 "2017-04-13T10:51:02Z")
How to monitor the JVM statistics using metric Beat? Have gone through https://www.elastic.co/blog/brewing-in-beats-add-support-for-jolokia-lmx. Would like to know is there any other options using the standard Beats. --- ## [API End-point Monitoring](https://discuss.elastic.co/t/api-end-point-monitoring/81972)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 10:45am UTC](https://discuss.elastic.co/t/api-end-point-monitoring/81972 "2017-04-13T10:45:29Z")
How to monitor the API end-points. Have checked the Heartbeat link: https://www.elastic.co/guide/en/beats/heartbeat/current/index.html. Looks to be it is still in Beta. So wanted to know what is the standard way of mon… --- ## [Filebeat stop writing files(via file output) when the output file gets removed](https://discuss.elastic.co/t/filebeat-stop-writing-files-via-file-output-when-the-output-file-gets-removed/82114)
**Author:** [@sunwl](https://discuss.elastic.co/u/sunwl)\ **Replies:** 5\ **Last updated:** [April 13, 2017, 9:38am UTC](https://discuss.elastic.co/t/filebeat-stop-writing-files-via-file-output-when-the-output-file-gets-removed/82114 "2017-04-13T09:38:41Z")
The scenario is that I need to read files, make some changes and write the content to another file (say output\_file) via filebeat. Also I had another application(say app2) to do the process-and-remove thing to the output… --- ## [Winlogbeat and kafka output](https://discuss.elastic.co/t/winlogbeat-and-kafka-output/82205)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 6:47am UTC](https://discuss.elastic.co/t/winlogbeat-and-kafka-output/82205 "2017-04-13T06:47:54Z")
Hi, I'm messing with a new dev elk cluster: Winlogbeat 5.3 Kafka\_2.10-0.10.2.0 Logstash 5.3 Our old one is a pre BEAT cluster, and now we are trying to use the beat packages as much as possible.. One thing I enc… --- ## [Filebeat kept reporting "read: connection reset by peer" error](https://discuss.elastic.co/t/filebeat-kept-reporting-read-connection-reset-by-peer-error/82157)
**Author:** [@Daniel\_Chen](https://discuss.elastic.co/u/Daniel_Chen)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 3:04am UTC](https://discuss.elastic.co/t/filebeat-kept-reporting-read-connection-reset-by-peer-error/82157 "2017-04-13T03:04:13Z")
I am new to ELK, and I have: Elasticsearch 5.3.0 Kibana 5.3.0 Logstash 1:5.3.0 Filebeat 5.3.0 filebeat.yml filebeat: prospectors: - paths: - /${BASEPATH}/nginx-logs/\*.log input\_type: lo… --- ## [Filebeat Multiline log messages - Behaving differently with version 5.1 and 5.3](https://discuss.elastic.co/t/filebeat-multiline-log-messages-behaving-differently-with-version-5-1-and-5-3/82100)
**Author:** [@venugopal.doddi](https://discuss.elastic.co/u/venugopal.doddi)\ **Replies:** 3\ **Last updated:** [April 12, 2017, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-multiline-log-messages-behaving-differently-with-version-5-1-and-5-3/82100 "2017-04-12T14:44:41Z")
I am working on a requirement where, I have to capture the multi line log messages, sending them via logstach and view them on Kibana. I am trying with version 5.1 and 5.3 versions of filebeat. In 5.1, with the pattern… --- ## [Unable to connect to Beats input on Logstash](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020)
**Author:** [@Vinay\_Binny](https://discuss.elastic.co/u/Vinay_Binny)\ **Replies:** 6\ **Last updated:** [April 12, 2017, 2:38pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-beats-input-on-logstash/82020 "2017-04-12T14:38:47Z")
Hi, I am running logstash service on a Ubuntu image in Virtual Box. When I try to connect to the beats service using curl http://localhost:5044 I get the below error. curl: (56) Recv failure: Connection reset by pee… --- ## [Storage Estimate for Metricbeat](https://discuss.elastic.co/t/storage-estimate-for-metricbeat/81878)
**Author:** [@baxter19](https://discuss.elastic.co/u/baxter19)\ **Replies:** 1\ **Last updated:** [April 11, 2017, 11:31am UTC](https://discuss.elastic.co/t/storage-estimate-for-metricbeat/81878 "2017-04-11T11:31:52Z")
We are evaluating meticbeat as a possible replacement for our internal performance and availability monitoring tool which collects basic metrics around CPU, memory, disk, network once a minute. During a PoC we collected … --- ## [Get pprof from filebeat,and "publish.events" is not equals to "libbeat.publisher.published\_events"](https://discuss.elastic.co/t/get-pprof-from-filebeat-and-publish-events-is-not-equals-to-libbeat-publisher-published-events/82094)
**Author:** [@yingqin678](https://discuss.elastic.co/u/yingqin678)\ **Replies:** 1\ **Last updated:** [April 12, 2017, 10:19am UTC](https://discuss.elastic.co/t/get-pprof-from-filebeat-and-publish-events-is-not-equals-to-libbeat-publisher-published-events/82094 "2017-04-12T10:19:28Z")
i got somet metrics from filebeat by httpprof,and some of them are confusing me. filebeat version:5.3.0 I got three times of metrics: i want to know:what\`s the meaning of publish.event? Why publish.event is smaller than … --- ## [How to monitor the Oracle Database](https://discuss.elastic.co/t/how-to-monitor-the-oracle-database/81970)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [April 12, 2017, 10:00am UTC](https://discuss.elastic.co/t/how-to-monitor-the-oracle-database/81970 "2017-04-12T10:00:14Z")
Have seen the demo relates to Metricbeat which shows the statitics related to opensource NOSQL database - Cassandra, Mongodb..etc and also MySQL and PostgreSQL. http://demo.elastic.co/beats/app/kibana#/dashboard/Pack… --- ## [Install filebeat on windows](https://discuss.elastic.co/t/install-filebeat-on-windows/81946)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 19\ **Last updated:** [April 12, 2017, 8:33am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946 "2017-04-12T08:33:18Z")
Hello everybody, I'm trying to install filebeat on a windows server. But when I run it from the command prompt it shows me this : Can anyone help me ? Thannnks ! --- ## [Winlogbeat and drop\_event filter](https://discuss.elastic.co/t/winlogbeat-and-drop-event-filter/81990)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 4\ **Last updated:** [April 11, 2017, 2:59pm UTC](https://discuss.elastic.co/t/winlogbeat-and-drop-event-filter/81990 "2017-04-11T14:59:02Z")
Hello all, I've configured winlogbeat to collect events from one of our domain controllers, there is a particular service account that generates thousands of successful authentication events each day and we're not intere… --- ## [Cannot index event avg\_obj\_size](https://discuss.elastic.co/t/cannot-index-event-avg-obj-size/81941)
**Author:** [@cukal](https://discuss.elastic.co/u/cukal)\ **Replies:** 1\ **Last updated:** [April 11, 2017, 11:25am UTC](https://discuss.elastic.co/t/cannot-index-event-avg-obj-size/81941 "2017-04-11T11:25:10Z")
I get this warning in metricbeat 5.3.0 log output: WARN Can not index event (status=400): {"type":"mapper\_parsing\_exception","reason":"object mapping for \[mongodb.dbstats.avg\_obj\_size\] tried to parse field \[avg\_obj\_si… --- ## [Transport.go:125: ERR SSL client failed to connect with: dial tcp \*.\*.\*.\*:5044: i/o timeout](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-dial-tcp-5044-i-o-timeout/81813)
**Author:** [@raghuvarma](https://discuss.elastic.co/u/raghuvarma)\ **Replies:** 3\ **Last updated:** [April 11, 2017, 11:03am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-dial-tcp-5044-i-o-timeout/81813 "2017-04-11T11:03:56Z")
I am trying to learn and work on ELK stuff. Configured ELK server and it's good so far. Configured file beat in elk client server. To send log files to ELK server, i restarted filebeat service. It restarted with foll… --- ## [\[Metricbeat\] system.process.cmdline often missing](https://discuss.elastic.co/t/metricbeat-system-process-cmdline-often-missing/81101)
**Author:** [@abraxxa](https://discuss.elastic.co/u/abraxxa)\ **Replies:** 2\ **Last updated:** [April 11, 2017, 10:51am UTC](https://discuss.elastic.co/t/metricbeat-system-process-cmdline-often-missing/81101 "2017-04-11T10:51:42Z")
This is a follow-up of https://github.com/elastic/beats/issues/428 for process name limitation of 15 characters which led to the addition of system.process.cmdline. When reviewing the issue I noticed that the process nam… --- ## [Packetbeat Error on running the compiled binary on different systems](https://discuss.elastic.co/t/packetbeat-error-on-running-the-compiled-binary-on-different-systems/81933)
**Author:** [@sudhindrasajjal](https://discuss.elastic.co/u/sudhindrasajjal)\ **Replies:** 3\ **Last updated:** [April 11, 2017, 9:35am UTC](https://discuss.elastic.co/t/packetbeat-error-on-running-the-compiled-binary-on-different-systems/81933 "2017-04-11T09:35:33Z")
2017-04-07T08:19:32Z INFO packet decode failed with: TCP data offset greater than packet length 2017-04-07T08:19:33Z INFO packet decode failed with: Invalid (too small) IP header length (0 \< 5) 2017-04-07T08:19:53Z INFO … --- ## [Does filebeat work with logrotation using compress mode?](https://discuss.elastic.co/t/does-filebeat-work-with-logrotation-using-compress-mode/81692)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [April 11, 2017, 2:23am UTC](https://discuss.elastic.co/t/does-filebeat-work-with-logrotation-using-compress-mode/81692 "2017-04-11T02:23:25Z")
Hello. I am planning to use the filebeat to collect logs. All the logs will be rotated using logrotate command for linux Reading the posts I understood that filebeat keeps track of data by inode. However, if the lo… --- ## [Sending Beat data from AWS to a server with a private IP](https://discuss.elastic.co/t/sending-beat-data-from-aws-to-a-server-with-a-private-ip/81750)
**Author:** [@onlybalu](https://discuss.elastic.co/u/onlybalu)\ **Replies:** 5\ **Last updated:** [April 10, 2017, 10:07am UTC](https://discuss.elastic.co/t/sending-beat-data-from-aws-to-a-server-with-a-private-ip/81750 "2017-04-10T10:07:30Z")
Hi Team, I am new to this, Need to get the Windows Event Logs from AWS cloud to my VMware Ubuntu Logstash server. I am not able to connect to my Ubuntu Logstash server (private ip) from an AWS Windows cloud instance … --- ## [Trouble understanding how to create a new metricset](https://discuss.elastic.co/t/trouble-understanding-how-to-create-a-new-metricset/81710)
**Author:** [@lisadeng](https://discuss.elastic.co/u/lisadeng)\ **Replies:** 1\ **Last updated:** [April 10, 2017, 8:32am UTC](https://discuss.elastic.co/t/trouble-understanding-how-to-create-a-new-metricset/81710 "2017-04-10T08:32:40Z")
I'm mostly looking at the 'fetch' section of creating my own metricset. The problem is that we have a custom service and we want to write a custom metricset to collect metrics from it. I took a look at the docker ima… --- ## [Filebeat to Logstash TLS handshake failure](https://discuss.elastic.co/t/filebeat-to-logstash-tls-handshake-failure/81345)
**Author:** [@tleif](https://discuss.elastic.co/u/tleif)\ **Replies:** 10\ **Last updated:** [April 10, 2017, 8:18am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-tls-handshake-failure/81345 "2017-04-10T08:18:40Z")
EDIT: I'm running version 5.3 of everything. I'm currently trying to get my filebeat to logstash connections using SSL, but I keep running into the error: 2017/04/05 16:42:16.045679 sync.go:53: DBG connect 2017/04/0… --- ## [Filebeat 5.0 - Logstash 5.0 communication issue on Windows Server 2012 R2](https://discuss.elastic.co/t/filebeat-5-0-logstash-5-0-communication-issue-on-windows-server-2012-r2/81490)
**Author:** [@cyberwhiz](https://discuss.elastic.co/u/cyberwhiz)\ **Replies:** 2\ **Last updated:** [April 8, 2017, 11:23pm UTC](https://discuss.elastic.co/t/filebeat-5-0-logstash-5-0-communication-issue-on-windows-server-2012-r2/81490 "2017-04-08T23:23:26Z")
Hi there, I think I've tried every combination I can think of over the past days and am at my wits end. So any hints / tips will be greatly appreciated. Environment: \* The whole stack is installed on a single machin… --- ## [Metricbeat having issue with auto create mapping](https://discuss.elastic.co/t/metricbeat-having-issue-with-auto-create-mapping/81494)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 2\ **Last updated:** [April 8, 2017, 11:21pm UTC](https://discuss.elastic.co/t/metricbeat-having-issue-with-auto-create-mapping/81494 "2017-04-08T23:21:22Z")
I have tried to get metricbeat started on one of our boxes, and I am getting the following error (continuously): 2017-04-06T10:24:44-05:00 WARN Can not index event (status=404): {"type":"type\_missing\_exception","reason"… --- ## [How to compile filebeat for solaris](https://discuss.elastic.co/t/how-to-compile-filebeat-for-solaris/81642)
**Author:** [@akshat\_kashyap](https://discuss.elastic.co/u/akshat_kashyap)\ **Replies:** 1\ **Last updated:** [April 8, 2017, 11:05pm UTC](https://discuss.elastic.co/t/how-to-compile-filebeat-for-solaris/81642 "2017-04-08T23:05:10Z")
hi, we are using solaris11.3/sparc T5 in our environment. we want to use filebeat to ship the logs to logstash. is there a way we can use filebeat on solaris? --- ## [Metricbeat output hosts (solved)](https://discuss.elastic.co/t/metricbeat-output-hosts-solved/81592)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 2\ **Last updated:** [April 8, 2017, 7:43am UTC](https://discuss.elastic.co/t/metricbeat-output-hosts-solved/81592 "2017-04-08T07:43:46Z")
Hi All, Just a quick question. For logstash it is better to use your elasticsearch client nodes as output. But how is this for metricbeat? OUtput to ALL of my nodes or also only to the client nodes? (For the record, my… --- ## [Getting a Filebeat server certificate verification fail](https://discuss.elastic.co/t/getting-a-filebeat-server-certificate-verification-fail/81527)
**Author:** [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Replies:** 2\ **Last updated:** [April 7, 2017, 8:29pm UTC](https://discuss.elastic.co/t/getting-a-filebeat-server-certificate-verification-fail/81527 "2017-04-07T20:29:19Z")
I have filebeat working on a production server successfully and am now putting on a second production server using the exact same process. I copied over the same Logstash crt file and added it to the filebeat.yml file. … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=529) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=531)