# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=531 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 532 --- ## [Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing?](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530)
**Author:** [@Niveah\_Tefillah](https://discuss.elastic.co/u/Niveah_Tefillah)\ **Replies:** 3\ **Last updated:** [April 7, 2017, 4:48pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530 "2017-04-07T16:48:39Z")
Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing? --- ## [Is there anyway collect logs from HP-UX hosts?](https://discuss.elastic.co/t/is-there-anyway-collect-logs-from-hp-ux-hosts/81505)
**Author:** [@ajeevpk](https://discuss.elastic.co/u/ajeevpk)\ **Replies:** 2\ **Last updated:** [April 7, 2017, 4:14pm UTC](https://discuss.elastic.co/t/is-there-anyway-collect-logs-from-hp-ux-hosts/81505 "2017-04-07T16:14:08Z")
As far as i know, beats not supported in HP-UX... i need to send logs from HP-UX hosts to Logstash/ES server... What is the best approach? please suggest, thanks in advance... Regards, Ajeev --- ## [Event log rate and indicators](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [April 7, 2017, 1:48pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608 "2017-04-07T13:48:12Z")
Hello, I'm about to install Winlogbeat on some of our production servers as part of testing Elastic Stack and I was wondering if Winlogbeat provides any indicator of not being able to keep up with the Windows event log m… --- ## [RelayBeat](https://discuss.elastic.co/t/relaybeat/81382)
**Author:** [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\ **Replies:** 3\ **Last updated:** [April 7, 2017, 10:49am UTC](https://discuss.elastic.co/t/relaybeat/81382 "2017-04-07T10:49:33Z")
Hello, Right now I have various Beats connecting to a Graylog Input (configured the same way you would connect it to Logstash). This works really well, but what I'd prefer to do is have another Beat on the other end o… --- ## [Filebeat: DNS lookup error for ip](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466)
**Author:** [@mw\_jko](https://discuss.elastic.co/u/mw_jko)\ **Replies:** 1\ **Last updated:** [April 6, 2017, 10:44pm UTC](https://discuss.elastic.co/t/filebeat-dns-lookup-error-for-ip/81466 "2017-04-06T22:44:12Z")
Hi there, I'm setting up filebeat on one of our servers. Config checks says everything is fine: sudo service filebeat start 2017/04/06 12:28:36.166996 beat.go:285: INFO Home path: \[/usr/share/filebeat\] Config path: \[… --- ## [Filebeat on FreeBSD / PFsense](https://discuss.elastic.co/t/filebeat-on-freebsd-pfsense/38278)
**Author:** [@Noebas](https://discuss.elastic.co/u/Noebas)\ **Replies:** 31\ **Last updated:** [April 6, 2017, 8:35pm UTC](https://discuss.elastic.co/t/filebeat-on-freebsd-pfsense/38278 "2017-04-06T20:35:31Z")
I'am trying to use filebeat on freebsd (pfsense), reading the filter.log This is working fine on filebeat startup, but after this the logging stops, If i then stop and restart filebeat it starts logging againt and stop… --- ## [.Events undefined Error while building wmibeats](https://discuss.elastic.co/t/events-undefined-error-while-building-wmibeats/54597)
**Author:** [@sunilactivity](https://discuss.elastic.co/u/sunilactivity)\ **Replies:** 8\ **Last updated:** [April 6, 2017, 3:24pm UTC](https://discuss.elastic.co/t/events-undefined-error-while-building-wmibeats/54597 "2017-04-06T15:24:11Z")
I am trying to build the wmibeats code in windows 7 with the following command E:\\Go\_Prj\\src\\github.com\\eskibars\\wmibeat\>go build and I get this error #github.com/eskibars/wmibeat/beater beater\\wmibeat.go:177: b.E… --- ## [Discover processes to get metrics from?](https://discuss.elastic.co/t/discover-processes-to-get-metrics-from/81320)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 2\ **Last updated:** [April 6, 2017, 11:35am UTC](https://discuss.elastic.co/t/discover-processes-to-get-metrics-from/81320 "2017-04-06T11:35:35Z")
Is there anything in metricbeat (or beat in general) similar to prometheus that allows for pulling metrics from services discovered via consul? If not, how do people get metrics out of their dynamic services? Or is beats… --- ## [How to get other system beats into my elastic search?](https://discuss.elastic.co/t/how-to-get-other-system-beats-into-my-elastic-search/81421)
**Author:** [@laptop\_data](https://discuss.elastic.co/u/laptop_data)\ **Replies:** 1\ **Last updated:** [April 6, 2017, 8:24am UTC](https://discuss.elastic.co/t/how-to-get-other-system-beats-into-my-elastic-search/81421 "2017-04-06T08:24:37Z")
Hi, Can anyone help me here. I would like to get other system's performance data like RAM, Processor etc data into my elastic search using beats, is it possible to get the other system beats. --- ## [Track mesos run time stats with Metricbeat](https://discuss.elastic.co/t/track-mesos-run-time-stats-with-metricbeat/78776)
**Author:** [@ab-agni](https://discuss.elastic.co/u/ab-agni)\ **Replies:** 8\ **Last updated:** [April 6, 2017, 8:16am UTC](https://discuss.elastic.co/t/track-mesos-run-time-stats-with-metricbeat/78776 "2017-04-06T08:16:17Z")
Hello - I have configured metric beat to read container info from Docker containers. I want to now capture mesos cluster runtime metrics into metric beat. Is there a way to do this? I used the docker.sock file for metric… --- ## [Filebeat cannot able to index into elasticsearch](https://discuss.elastic.co/t/filebeat-cannot-able-to-index-into-elasticsearch/76927)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 26\ **Last updated:** [April 6, 2017, 7:43am UTC](https://discuss.elastic.co/t/filebeat-cannot-able-to-index-into-elasticsearch/76927 "2017-04-06T07:43:26Z")
Filebeat cannot able to index into elasticsearch please find the error below, ES ping not happening. Please suggest 2017-03-01T13:14:44+05:30 DBG ES Ping(url=http://10.209.68.81:9201, timeout=1m30s) 2017-03-01T13:1… --- ## [Filebeat 5.2.2 'pipelining' option causes (?) event duplication when sending to logstash](https://discuss.elastic.co/t/filebeat-5-2-2-pipelining-option-causes-event-duplication-when-sending-to-logstash/80820)
**Author:** [@msoltyspl](https://discuss.elastic.co/u/msoltyspl)\ **Replies:** 3\ **Last updated:** [April 6, 2017, 5:59am UTC](https://discuss.elastic.co/t/filebeat-5-2-2-pipelining-option-causes-event-duplication-when-sending-to-logstash/80820 "2017-04-06T05:59:06Z")
With the following config file: name: "filebeat log harvester" logging.level: debug filebeat.prospectors: - input\_type: log paths: - /var/log/nginx/access\_log.json encoding: utf-8 document\_type: acc… --- ## [Metricbeat new index creation](https://discuss.elastic.co/t/metricbeat-new-index-creation/80204)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 15\ **Last updated:** [April 5, 2017, 8:20pm UTC](https://discuss.elastic.co/t/metricbeat-new-index-creation/80204 "2017-04-05T20:20:33Z")
Hello if i have multiple systems using metricbeat and all sending to the same Elasticsearch cluster is there a way to use the already made graphs for each different index of metricbeat. Each cluster i am shipping with a … --- ## [Filebeat to AWS SQS](https://discuss.elastic.co/t/filebeat-to-aws-sqs/48271)
**Author:** [@gcherneski](https://discuss.elastic.co/u/gcherneski)\ **Replies:** 5\ **Last updated:** [April 5, 2017, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-sqs/48271 "2017-04-05T14:22:03Z")
I am configuring an AWS-based ELK stack where I want to send my Filebeat output to AWS SQS and then from AWS SQS to an AWS ELB facing multiple Logstash instances. I cannot find any blog or doc on this subject. Has someon… --- ## [Is packetbeat parsing pcap data per packets or per flow/stream?](https://discuss.elastic.co/t/is-packetbeat-parsing-pcap-data-per-packets-or-per-flow-stream/81234)
**Author:** [@Niveah\_Tefillah](https://discuss.elastic.co/u/Niveah_Tefillah)\ **Replies:** 2\ **Last updated:** [April 5, 2017, 2:21pm UTC](https://discuss.elastic.co/t/is-packetbeat-parsing-pcap-data-per-packets-or-per-flow-stream/81234 "2017-04-05T14:21:32Z")
Hi! This might be a dumb question! But iam unable to figure out if the pcap data is being parsed per packet or per flow/stream! Please help me understand this. Thank you! Niveah --- ## [Partial line reading when restarting Filebeat](https://discuss.elastic.co/t/partial-line-reading-when-restarting-filebeat/81016)
**Author:** [@eclionast](https://discuss.elastic.co/u/eclionast)\ **Replies:** 3\ **Last updated:** [April 5, 2017, 1:58pm UTC](https://discuss.elastic.co/t/partial-line-reading-when-restarting-filebeat/81016 "2017-04-05T13:58:57Z")
Hello, Currently we have the following setup: Filebeat reads log files and sends the content to Kafka. One log-line results in one Kafka event. At the other side a Logstash reads the events from Kafka, parses them and … --- ## [Benchmarking Filebeats](https://discuss.elastic.co/t/benchmarking-filebeats/79746)
**Author:** [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Replies:** 11\ **Last updated:** [April 5, 2017, 1:46pm UTC](https://discuss.elastic.co/t/benchmarking-filebeats/79746 "2017-04-05T13:46:28Z")
As explained in this post I enabled my filebeat with very simple configurations as startup. filebeat.prospectors: - input\_type: log paths: - /root/\*.log ignore\_older: 5m scan\_frequency: 10s close\_inactive:… --- ## [Winlogbeats indices created but docs appear as deleted](https://discuss.elastic.co/t/winlogbeats-indices-created-but-docs-appear-as-deleted/81230)
**Author:** [@mkorayem](https://discuss.elastic.co/u/mkorayem)\ **Replies:** 2\ **Last updated:** [April 5, 2017, 7:09am UTC](https://discuss.elastic.co/t/winlogbeats-indices-created-but-docs-appear-as-deleted/81230 "2017-04-05T07:09:51Z")
Hi Problem: Indices are created, and I see traffic on port 5044 but all docs are created as deleted Configuration I configured the system as follows: Winlogbeats --\> Logstash --\> Elasticsearch --\> Kibana Installe… --- ## [Filebeat use insane memory](https://discuss.elastic.co/t/filebeat-use-insane-memory/79209)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 20\ **Last updated:** [April 5, 2017, 1:01am UTC](https://discuss.elastic.co/t/filebeat-use-insane-memory/79209 "2017-04-05T01:01:53Z")
I've noticed the same problem as follows: Filebeat Version: 5.0.0 My data flow is: filebeat(5 machines) -\> ES(2 machines and cpu becomes bottleneck) My steps to repro: Kill filebeat first Remove index DELETE /index… --- ## [Error in Multiline Parsing](https://discuss.elastic.co/t/error-in-multiline-parsing/81211)
**Author:** [@howardkr](https://discuss.elastic.co/u/howardkr)\ **Replies:** 1\ **Last updated:** [April 4, 2017, 10:44pm UTC](https://discuss.elastic.co/t/error-in-multiline-parsing/81211 "2017-04-04T22:44:24Z")
All, I'm having a slight issue having multiline apply to my stack trace logs. I have tried with the pattern of: multiline.pattern: '^\[\[:space:\]\]' multiline.negate: false multiline.match: after and:… --- ## [FIlebeat Mutliline issue](https://discuss.elastic.co/t/filebeat-mutliline-issue/81215)
**Author:** [@howardkr](https://discuss.elastic.co/u/howardkr)\ **Replies:** 0\ **Last updated:** [April 4, 2017, 7:47pm UTC](https://discuss.elastic.co/t/filebeat-mutliline-issue/81215 "2017-04-04T19:47:27Z")
deleteeeeeee --- ## [How to use filebeat fields name value in logstash config](https://discuss.elastic.co/t/how-to-use-filebeat-fields-name-value-in-logstash-config/79791)
**Author:** [@Jayanna\_Hallur](https://discuss.elastic.co/u/Jayanna_Hallur)\ **Replies:** 4\ **Last updated:** [April 4, 2017, 6:37pm UTC](https://discuss.elastic.co/t/how-to-use-filebeat-fields-name-value-in-logstash-config/79791 "2017-04-04T18:37:36Z")
Hi All Below are my config files for 2 filebeats & logstash.. I set the fields index=my\_data\_1 in filebeat config. & send to logstash.. in the logstash i want use the value passed in fields.index from filebeat to use… --- ## [Winlogbeat 5.3.0 sends the whole content of ForwardedEvents at startup](https://discuss.elastic.co/t/winlogbeat-5-3-0-sends-the-whole-content-of-forwardedevents-at-startup/80596)
**Author:** [@ssiws](https://discuss.elastic.co/u/ssiws)\ **Replies:** 6\ **Last updated:** [April 4, 2017, 3:06pm UTC](https://discuss.elastic.co/t/winlogbeat-5-3-0-sends-the-whole-content-of-forwardedevents-at-startup/80596 "2017-04-04T15:06:42Z")
Hello, I have a problem with Winlogbeat 5.3.0: I configured it to push the content of the ForwardedEvents' log in elasticsearch, but each time the service is restarted, Winlogbeat sends the whole content of the Forwa… --- ## [Not able to see the geo\_point type fields in Kibana](https://discuss.elastic.co/t/not-able-to-see-the-geo-point-type-fields-in-kibana/80970)
**Author:** [@ankit\_rawat](https://discuss.elastic.co/u/ankit_rawat)\ **Replies:** 11\ **Last updated:** [April 4, 2017, 12:52pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-geo-point-type-fields-in-kibana/80970 "2017-04-04T12:52:56Z")
Hi I am using packetbeats to get the client location, But in kibana i see that all the geo\_point type fields are missing.Please find the screenshot below I did not find any much information in logs also, Thanks Ank… --- ## [Filebeat Configuration for Apache Logs](https://discuss.elastic.co/t/filebeat-configuration-for-apache-logs/81085)
**Author:** [@vortex](https://discuss.elastic.co/u/vortex)\ **Replies:** 2\ **Last updated:** [April 4, 2017, 11:53am UTC](https://discuss.elastic.co/t/filebeat-configuration-for-apache-logs/81085 "2017-04-04T11:53:33Z")
Hi all, I'am trying to configure filebeat to send apache logs to ELK ,but something goes wrong. My set up is the following : Server : Centos7 Elasticsearch : 2.4.4 Logstash : 2.3.4 Kibana : 4.5.4 … --- ## [Deploy & Monitor Filebeat](https://discuss.elastic.co/t/deploy-monitor-filebeat/80791)
**Author:** [@AndreAga](https://discuss.elastic.co/u/AndreAga)\ **Replies:** 6\ **Last updated:** [April 3, 2017, 8:46pm UTC](https://discuss.elastic.co/t/deploy-monitor-filebeat/80791 "2017-04-03T20:46:26Z")
Hi all, the question is very simple, is there a way to deploy/install Filebeat in thousand (25.000/50.000) of machines? Solutions like puppet, ansible, chef or Docker are very expensive. Maybe with few machines the cost … --- ## [Filebeat assumes UTC?](https://discuss.elastic.co/t/filebeat-assumes-utc/80896)
**Author:** [@beatsme](https://discuss.elastic.co/u/beatsme)\ **Replies:** 7\ **Last updated:** [April 3, 2017, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-assumes-utc/80896 "2017-04-03T12:56:59Z")
I'm using filebeat to import syslog messages. When looking at the ES document it appears filebeat incorrectly assumes UTC: ES document: "@timestamp": "2017-04-01T15:26:51.000Z" Syslog message "timestamp": "Apr 1 … --- ## [Packetbeat to analysi offline packet captures](https://discuss.elastic.co/t/packetbeat-to-analysi-offline-packet-captures/80068)
**Author:** [@anilkumar911](https://discuss.elastic.co/u/anilkumar911)\ **Replies:** 2\ **Last updated:** [April 3, 2017, 10:18am UTC](https://discuss.elastic.co/t/packetbeat-to-analysi-offline-packet-captures/80068 "2017-04-03T10:18:27Z")
Hi, I plan to use/modify packetbeat as an alternative to wireshark, to analyse huge trace files ( \> 10GB) . I have 2 requirements below: export data from a pcap capture file capture all fields of different protocol … --- ## [Filebeat 5.3.0 regex parsing regression](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887)
**Author:** [@Karl\_Grose](https://discuss.elastic.co/u/Karl_Grose)\ **Replies:** 5\ **Last updated:** [April 3, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-5-3-0-regex-parsing-regression/80887 "2017-04-03T09:49:50Z")
The following regex pattern: multiline.pattern: '^\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{2} ' worked for 5.2.2 but causes a panic with 5.3.0 \[1\]. Using this instead: multiline.pattern: '^\[0-9\]\[0-9\]\[0-9\]\[0-9\]-\[0-9\]\[0-9\]-\[0-9\]\[… --- ## [Filebeat publishing the whole log again](https://discuss.elastic.co/t/filebeat-publishing-the-whole-log-again/79205)
**Author:** [@raamee](https://discuss.elastic.co/u/raamee)\ **Replies:** 5\ **Last updated:** [April 3, 2017, 7:00am UTC](https://discuss.elastic.co/t/filebeat-publishing-the-whole-log-again/79205 "2017-04-03T07:00:53Z")
Hi, I am using filebeat to send logs to logstash. Recently I encountered an issue that filebeat publishes the whole log file again to logstash which creates duplicate entries in elasticsearch/kibana. Please see this … [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=530) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=532)