# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=532 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 533 --- ## [Can I override existing tags field using filebeat?](https://discuss.elastic.co/t/can-i-override-existing-tags-field-using-filebeat/80747)
**Author:** [@BeiZero](https://discuss.elastic.co/u/BeiZero)\ **Replies:** 1\ **Last updated:** [March 31, 2017, 2:05pm UTC](https://discuss.elastic.co/t/can-i-override-existing-tags-field-using-filebeat/80747 "2017-03-31T14:05:46Z")
Hello! I have a question about filebeat. I have a jsonl logfile and log messages contains 'tags' field. Can I override or add my tags into existing tags field using filebeat? I try add tags in prospector but it isn't wor… --- ## [MSExchange Management Event Log](https://discuss.elastic.co/t/msexchange-management-event-log/80719)
**Author:** [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\ **Replies:** 3\ **Last updated:** [March 31, 2017, 1:44pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719 "2017-03-31T13:44:20Z")
I have what appears to be a very simple question. I wish to add the MSExchange Management event log to the winlogbeat configuration file. get-eventlog shows it as MSExchange Management I added it as -name MSExcha… --- ## ["Module directory not found" - filebeat looking in wrong place?](https://discuss.elastic.co/t/module-directory-not-found-filebeat-looking-in-wrong-place/80805)
**Author:** [@rozling](https://discuss.elastic.co/u/rozling)\ **Replies:** 2\ **Last updated:** [March 31, 2017, 1:02pm UTC](https://discuss.elastic.co/t/module-directory-not-found-filebeat-looking-in-wrong-place/80805 "2017-03-31T13:02:42Z")
Hi, I'm installing filebeat 5.3 from the instructions here: https://www.elastic.co/guide/en/beats/filebeat/5.3/setup-repositories.html Running the command: /usr/share/filebeat/bin/filebeat -configtest -e -c /etc/fi… --- ## [Multiple filebeat instances under different accounts on one box?](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293)
**Author:** [@rozling](https://discuss.elastic.co/u/rozling)\ **Replies:** 2\ **Last updated:** [March 31, 2017, 12:12pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293 "2017-03-31T12:12:47Z")
Hi, We have successfully configured Filebeat :arrow\_right: ELK stack using a modified version of GitHub - geerlingguy/ansible-role-filebeat: Ansible Role - Filebeat for ELK stack. However each of our node services ru… --- ## [Filebeat: problem with logstash/elasticsearch (version 5.3.0)](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659)
**Author:** [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)\ **Replies:** 3\ **Last updated:** [March 31, 2017, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659 "2017-03-31T12:10:41Z")
Hi, Filebeat service won't start if elasticsearch is not configured. Below my configuration #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: enabled: false #--… --- ## [Send Headers in HTTP post request](https://discuss.elastic.co/t/send-headers-in-http-post-request/80172)
**Author:** [@suvitt](https://discuss.elastic.co/u/suvitt)\ **Replies:** 5\ **Last updated:** [March 31, 2017, 12:02pm UTC](https://discuss.elastic.co/t/send-headers-in-http-post-request/80172 "2017-03-31T12:02:21Z")
Hi All, I am not able to send additional headers in the http POST request. yml file heartbeat.monitors: - type: http # List or urls to query #urls: urls: \["http://localhost:8724/service/XXX/YYY"\] # request… --- ## [Filebeat error in local machine](https://discuss.elastic.co/t/filebeat-error-in-local-machine/80674)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 1\ **Last updated:** [March 31, 2017, 11:55am UTC](https://discuss.elastic.co/t/filebeat-error-in-local-machine/80674 "2017-03-31T11:55:32Z")
h: \[C:\\Program Files\\Filebeat\\data\] Logs path: \[C:\\Program Files\\Filebeat\\logs\] 2017/03/30 12:25:08.435200 logp.go:219: INFO Metrics logging every 30s 2017/03/30 12:25:08.435200 beat.go:177: INFO Setup Beat: filebeat; Ve… --- ## [Error Registry File](https://discuss.elastic.co/t/error-registry-file/80681)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 4\ **Last updated:** [March 31, 2017, 7:57am UTC](https://discuss.elastic.co/t/error-registry-file/80681 "2017-03-31T07:57:39Z")
Hi everyone, I have an issue with Filebeat in Windows. Sometimes, when the computer is rebooted, Filebeat is not able to start. I see in the log the next error: 2017-03-30T11:06:31+01:00 ERR Error decoding old state: … --- ## [How to install Filebeat and Packetbeat on a Raspberry Pi 3](https://discuss.elastic.co/t/how-to-install-filebeat-and-packetbeat-on-a-raspberry-pi-3/80693)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 2\ **Last updated:** [March 31, 2017, 5:53am UTC](https://discuss.elastic.co/t/how-to-install-filebeat-and-packetbeat-on-a-raspberry-pi-3/80693 "2017-03-31T05:53:07Z")
Hello everyone, so I am trying to install Filebeat and Packetbeat on my Raspberry pi 3 model b V1.2 with Kali for ARM I am really struggling with this, I have seen this post but what that person did doesn't work for me… --- ## [Metricbeat system.memory.actual.free - is it accurate?](https://discuss.elastic.co/t/metricbeat-system-memory-actual-free-is-it-accurate/80650)
**Author:** [@simonl](https://discuss.elastic.co/u/simonl)\ **Replies:** 2\ **Last updated:** [March 30, 2017, 3:53pm UTC](https://discuss.elastic.co/t/metricbeat-system-memory-actual-free-is-it-accurate/80650 "2017-03-30T15:53:34Z")
Hello, I want to replace all my home grown & Nagios plugins with the marvelous metricbeat, but I don't trust the Linux memory figures ie. I rely on avail memory to alert on when a system is going to swap. For older ker… --- ## [File Beat Unable to Connect Logstash will affect Server Performance or Not?](https://discuss.elastic.co/t/file-beat-unable-to-connect-logstash-will-affect-server-performance-or-not/80625)
**Author:** [@Kl\_Hwang](https://discuss.elastic.co/u/Kl_Hwang)\ **Replies:** 1\ **Last updated:** [March 30, 2017, 1:19pm UTC](https://discuss.elastic.co/t/file-beat-unable-to-connect-logstash-will-affect-server-performance-or-not/80625 "2017-03-30T13:19:59Z")
I'm newbie in elasticsearch, My first question is there are any software that can test the prformance of logstash and filebeat? Second question is if filebeat unable to access logstash and the command line display "ER… --- ## [Dynatrace module for metricbeat](https://discuss.elastic.co/t/dynatrace-module-for-metricbeat/80183)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 3\ **Last updated:** [March 30, 2017, 12:40pm UTC](https://discuss.elastic.co/t/dynatrace-module-for-metricbeat/80183 "2017-03-30T12:40:33Z")
Hi there I saw recently the module prometheus for metricbeat. Is the a module for dynatrace already on the roadmap? Thanks Oli --- ## [All modules log into the same index in metricbeat - best practise?](https://discuss.elastic.co/t/all-modules-log-into-the-same-index-in-metricbeat-best-practise/80192)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 3\ **Last updated:** [March 30, 2017, 12:37pm UTC](https://discuss.elastic.co/t/all-modules-log-into-the-same-index-in-metricbeat-best-practise/80192 "2017-03-30T12:37:23Z")
Hi there I remember the following blog post about index vs type discussion: Especially one statement: Do your documents have similar mappings? If no, use different indices. IMHO, this applies to the different modu… --- ## [Filebeat focus resources on oldest file](https://discuss.elastic.co/t/filebeat-focus-resources-on-oldest-file/79974)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 5\ **Last updated:** [March 30, 2017, 11:42am UTC](https://discuss.elastic.co/t/filebeat-focus-resources-on-oldest-file/79974 "2017-03-30T11:42:08Z")
When any part of the ELK stack bottlenecks, then files begin to build up in the filebeat sector. When this happens, filebeat holds the files open even after deletion with file rotates. The problem i see here is that as… --- ## [How do we fetch just the latest records from the input file and put them in output file?](https://discuss.elastic.co/t/how-do-we-fetch-just-the-latest-records-from-the-input-file-and-put-them-in-output-file/80240)
**Author:** [@bobbysidhartha](https://discuss.elastic.co/u/bobbysidhartha)\ **Replies:** 3\ **Last updated:** [March 30, 2017, 11:36am UTC](https://discuss.elastic.co/t/how-do-we-fetch-just-the-latest-records-from-the-input-file-and-put-them-in-output-file/80240 "2017-03-30T11:36:58Z")
Hi all, Im trying to write the input data from input file to output file. I've put the below option in filebeats.yml file to copy the input to output. output.file: path: "/home/cloudera/Desktop" filename: outB … --- ## [Filebeat/module nginx ; problem with permissions](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647)
**Author:** [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)\ **Replies:** 5\ **Last updated:** [March 30, 2017, 10:44am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647 "2017-03-30T10:44:40Z")
Hi, I updated filebeat to version 5.3.0 on a linux server (Ubuntu 16.04 LTS). I wanted to enable the module nginx; but I got an this error (when executing filebeat as a service). 2017-03-30T11:41:38+02:00 INFO Metric… --- ## [Filebeat reading json file](https://discuss.elastic.co/t/filebeat-reading-json-file/79257)
**Author:** [@garywoodfine](https://discuss.elastic.co/u/garywoodfine)\ **Replies:** 6\ **Last updated:** [March 30, 2017, 9:09am UTC](https://discuss.elastic.co/t/filebeat-reading-json-file/79257 "2017-03-30T09:09:33Z")
Hi Guys I am a total noob to ElasticStack and Filebeats. I have a custom log file in a JSON format, the app we are using will output an 1 entry per file as follows {"cuid":1,"Machine":"001","cuSize":0,"starttime":"20… --- ## [Sending a record to multiple host. IE Teeing the data](https://discuss.elastic.co/t/sending-a-record-to-multiple-host-ie-teeing-the-data/80532)
**Author:** [@Jeremy\_Foran](https://discuss.elastic.co/u/Jeremy_Foran)\ **Replies:** 2\ **Last updated:** [March 30, 2017, 8:30am UTC](https://discuss.elastic.co/t/sending-a-record-to-multiple-host-ie-teeing-the-data/80532 "2017-03-30T08:30:27Z")
I would like to configure my filebeats to deliver each record to two different hosts. In other words, a have multiple clusters and I would like to have log data delivered to both. What is the appropriate approach? Th… --- ## [Does not capture ICMP traffic](https://discuss.elastic.co/t/does-not-capture-icmp-traffic/80036)
**Author:** [@korsdecaying](https://discuss.elastic.co/u/korsdecaying)\ **Replies:** 9\ **Last updated:** [March 30, 2017, 8:24am UTC](https://discuss.elastic.co/t/does-not-capture-icmp-traffic/80036 "2017-03-30T08:24:46Z")
DNS traffic is displayed in Kiban, and ICMP is not present # /etc/packetbeat/packetbeat.yml packetbeat.interfaces.device: 1 packetbeat.protocols.dns: ports: \[53\] include\_authorities: true include\_additio… --- ## [How to add value to the output file using FileBeats?](https://discuss.elastic.co/t/how-to-add-value-to-the-output-file-using-filebeats/80602)
**Author:** [@bobbysidhartha](https://discuss.elastic.co/u/bobbysidhartha)\ **Replies:** 1\ **Last updated:** [March 30, 2017, 7:05am UTC](https://discuss.elastic.co/t/how-to-add-value-to-the-output-file-using-filebeats/80602 "2017-03-30T07:05:08Z")
Im learning filebeats where I am try to copy the data from input file to output file. I am able to do it like below by giving options in filebeats.yml file as. - input\_type: log # Paths that should be crawled and fe… --- ## [Publish.go:276: DBG No output is defined to store the topology. The server fields might not be filled](https://discuss.elastic.co/t/publish-go-276-dbg-no-output-is-defined-to-store-the-topology-the-server-fields-might-not-be-filled/79802)
**Author:** [@Balaram](https://discuss.elastic.co/u/Balaram)\ **Replies:** 2\ **Last updated:** [March 29, 2017, 9:20pm UTC](https://discuss.elastic.co/t/publish-go-276-dbg-no-output-is-defined-to-store-the-topology-the-server-fields-might-not-be-filled/79802 "2017-03-29T21:20:50Z")
Hi I am seeing this below lines while starting the metricbeat on Redhat Linux. did any one faced similar issue?? ========================================== 2017/03/23 19:22:22.755848 outputs.go:106: INFO Activated red… --- ## [Filebeat: Basic HTTP request output plugin](https://discuss.elastic.co/t/filebeat-basic-http-request-output-plugin/80384)
**Author:** [@mcandre](https://discuss.elastic.co/u/mcandre)\ **Replies:** 1\ **Last updated:** [March 29, 2017, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-basic-http-request-output-plugin/80384 "2017-03-29T20:42:51Z")
Could filebeat get a plugin for outputing to REST calls? Instead of trying to retrofit the es output plugin --- ## [Multiple ingest pipelines - docs going to the wrong pipeline](https://discuss.elastic.co/t/multiple-ingest-pipelines-docs-going-to-the-wrong-pipeline/80339)
**Author:** [@jbarlow](https://discuss.elastic.co/u/jbarlow)\ **Replies:** 4\ **Last updated:** [March 29, 2017, 5:06pm UTC](https://discuss.elastic.co/t/multiple-ingest-pipelines-docs-going-to-the-wrong-pipeline/80339 "2017-03-29T17:06:37Z")
Hello, I've got three ES master/data nodes, and one ingest node running kibana. All servers in the environment are running filebeat for log shipping. I'm seeing a lot of pipeline errors in the elasticsearch logs abou… --- ## [Metricbeat windows service does not startup](https://discuss.elastic.co/t/metricbeat-windows-service-does-not-startup/76043)
**Author:** [@Hussain\_Kothari](https://discuss.elastic.co/u/Hussain_Kothari)\ **Replies:** 10\ **Last updated:** [March 29, 2017, 4:48pm UTC](https://discuss.elastic.co/t/metricbeat-windows-service-does-not-startup/76043 "2017-03-29T16:48:38Z")
Hi, I'm trying to install metrics beat agent using PS-DSC script on our servers. But the service does not start up. It gives this error. And when i try to manually start the service from the server too, i get this e… --- ## [Logs seem to be flowing OK but constant "connection reset by peer" errors in the filebeat log](https://discuss.elastic.co/t/logs-seem-to-be-flowing-ok-but-constant-connection-reset-by-peer-errors-in-the-filebeat-log/79518)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 7\ **Last updated:** [March 29, 2017, 3:59pm UTC](https://discuss.elastic.co/t/logs-seem-to-be-flowing-ok-but-constant-connection-reset-by-peer-errors-in-the-filebeat-log/79518 "2017-03-29T15:59:52Z")
filebeat 5.2.2 pertinent part of the config: ... output.logstash: hosts: \["ps-dev-elk.domain.com:5044"\] ssl.certificate\_authorities: \["/etc/pki/tls/certs/filebeat.crt"\] timeout: 30 ... logs seem to be flowing fine f… --- ## [Proxying beats outputs](https://discuss.elastic.co/t/proxying-beats-outputs/80283)
**Author:** [@Mihai-CMM](https://discuss.elastic.co/u/Mihai-CMM)\ **Replies:** 2\ **Last updated:** [March 29, 2017, 9:02am UTC](https://discuss.elastic.co/t/proxying-beats-outputs/80283 "2017-03-29T09:02:45Z")
Hi community I want to send elasticsearch.output through an nginx proxy. If i set that nginx IP i get: 2017-03-28T10:50:51-04:00 ERR Connecting error publishing events (retrying): Failed to parse JSON response: inva… --- ## [Exported Fields: Name](https://discuss.elastic.co/t/exported-fields-name/80074)
**Author:** [@dosera](https://discuss.elastic.co/u/dosera)\ **Replies:** 4\ **Last updated:** [March 28, 2017, 9:46am UTC](https://discuss.elastic.co/t/exported-fields-name/80074 "2017-03-28T09:46:51Z")
Hello, I noticed that the field 'name' is exported as 'type' if set. E.g. - name: some-name type: http urls: - www.myurl.com:123 results in a document like { ... "up": true, "type": "some-name" ... } Howe… --- ## [Compiling WLB with hardcoded ElasticSearch Host URL](https://discuss.elastic.co/t/compiling-wlb-with-hardcoded-elasticsearch-host-url/79807)
**Author:** [@bcable](https://discuss.elastic.co/u/bcable)\ **Replies:** 3\ **Last updated:** [March 28, 2017, 4:29pm UTC](https://discuss.elastic.co/t/compiling-wlb-with-hardcoded-elasticsearch-host-url/79807 "2017-03-28T16:29:22Z")
So I have my GO env up and running great. Compiling winlogbeat.exe flawlessly. I found that you can bake in ElasticSearch credentials into /libbeat/outputs/elasticsearch/config.go My Question: How can I bake in Elastic… --- ## [Multiline.pattern in filebeat](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/80082)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 3\ **Last updated:** [March 28, 2017, 2:35pm UTC](https://discuss.elastic.co/t/multiline-pattern-in-filebeat/80082 "2017-03-28T14:35:11Z")
Dear all, What is the correct multiline.pattern in filebeat to transfer Java stack trace as one event? There are different cases of it. Currently i have such pattern: multiline.pattern: '\<\*' --- ## [I get this error when i restart my filebeat in ELK](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 5\ **Last updated:** [March 28, 2017, 12:22pm UTC](https://discuss.elastic.co/t/i-get-this-error-when-i-restart-my-filebeat-in-elk/80109 "2017-03-28T12:22:05Z")
sudo service filebeat restart \* Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat Loading config file error: YA… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=531) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=533)