# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=533 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 534 --- ## [Multiline codec applied (without multiline in logs)](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868)
**Author:** [@rosselg](https://discuss.elastic.co/u/rosselg)\ **Replies:** 4\ **Last updated:** [March 28, 2017, 10:34am UTC](https://discuss.elastic.co/t/multiline-codec-applied-without-multiline-in-logs/79868 "2017-03-28T10:34:17Z")
Hi folks, Filebeat applies the "multiline coded", even if the log file doesn't contains any multiline logs. I guess this is related to Drupal log mechanism, as the log file is written every 10sec. with all the logs t… --- ## [Error starting filebeat](https://discuss.elastic.co/t/error-starting-filebeat/80085)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 6\ **Last updated:** [March 28, 2017, 8:22am UTC](https://discuss.elastic.co/t/error-starting-filebeat/80085 "2017-03-28T08:22:29Z")
Dear all, I have such errors trying start filebeat \[loguser@container5 filebeat\]$ /etc/init.d/filebeat start Starting filebeat: 2017/03/27 07:55:39.649381 beat.go:267: INFO Home path: \[/usr/share/filebeat\] Config pat… --- ## [Filebeat output.kafka load balancer vip](https://discuss.elastic.co/t/filebeat-output-kafka-load-balancer-vip/79641)
**Author:** [@sdiver78](https://discuss.elastic.co/u/sdiver78)\ **Replies:** 2\ **Last updated:** [March 28, 2017, 8:04am UTC](https://discuss.elastic.co/t/filebeat-output-kafka-load-balancer-vip/79641 "2017-03-28T08:04:57Z")
Looking at using the latest filebeat-5.2.2-1 (as of post) and using the output.kafka option. The Kafka "hosts" - brokers for reading cluster metadata - pointed to a VIP on a hardware load balancer which is the front-end … --- ## [Sending files in chronological order](https://discuss.elastic.co/t/sending-files-in-chronological-order/79873)
**Author:** [@mario.schaefer](https://discuss.elastic.co/u/mario.schaefer)\ **Replies:** 5\ **Last updated:** [March 28, 2017, 7:41am UTC](https://discuss.elastic.co/t/sending-files-in-chronological-order/79873 "2017-03-28T07:41:56Z")
Hi, we have a running ELK stack, actually: 16 Mailappliances -\> syslogserver -\> to file -\> filebeat -\> logstash -\> redis -\> some magic script -\> ES Syslogserver + Filebeat is one machine. Logstash, Redis and the magic … --- ## [Not able to see the apache status using metricbeat](https://discuss.elastic.co/t/not-able-to-see-the-apache-status-using-metricbeat/79416)
**Author:** [@ankit\_rawat](https://discuss.elastic.co/u/ankit_rawat)\ **Replies:** 6\ **Last updated:** [March 28, 2017, 6:10am UTC](https://discuss.elastic.co/t/not-able-to-see-the-apache-status-using-metricbeat/79416 "2017-03-28T06:10:35Z")
Hi Team I have set up Metricbeat in my client server and sending the logs to the Elasticsearch and then showing the logs in Kibana. Everything is working fine i am able to get the logs in kibana, But when i load the das… --- ## [Parse JSON data with filebeat](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008)
**Author:** [@calmandniceperson](https://discuss.elastic.co/u/calmandniceperson)\ **Replies:** 7\ **Last updated:** [March 27, 2017, 7:34pm UTC](https://discuss.elastic.co/t/parse-json-data-with-filebeat/80008 "2017-03-27T19:34:16Z")
I'm trying to parse JSON logs our server application is producing. It's writing to 3 log files in a directory I'm mounting in a Docker container running Filebeat. So far so good, it's reading the log files all right. How… --- ## [Metricbeat not collecting memory info](https://discuss.elastic.co/t/metricbeat-not-collecting-memory-info/80145)
**Author:** [@francopp](https://discuss.elastic.co/u/francopp)\ **Replies:** 5\ **Last updated:** [March 27, 2017, 6:40pm UTC](https://discuss.elastic.co/t/metricbeat-not-collecting-memory-info/80145 "2017-03-27T18:40:53Z")
After some Swap configuration changes metricbeat stop sending memory info I got any other type but memory info. About an hour ago we made some changes in our server configuration and now we got this The changes we … --- ## [Error in Filebeat](https://discuss.elastic.co/t/error-in-filebeat/79146)
**Author:** [@AHK](https://discuss.elastic.co/u/AHK)\ **Replies:** 3\ **Last updated:** [March 27, 2017, 5:25pm UTC](https://discuss.elastic.co/t/error-in-filebeat/79146 "2017-03-27T17:25:07Z")
Hello, I am trying to learn how to install & use ELK Stack on Centos7 I have installed JAVA and every thing according to this link now on my Server every thing is running fine, and when i test systemctl status logsta… --- ## [Non-zero metrics in the last 30s](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/78255)
**Author:** [@korsdecaying](https://discuss.elastic.co/u/korsdecaying)\ **Replies:** 4\ **Last updated:** [March 27, 2017, 5:15pm UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s/78255 "2017-03-27T17:15:35Z")
Non-zero metrics in the last 30s: libbeat.es.call\_count.PublishEvents=4 libbeat.es.published\_and\_acked\_events=61 libbeat.publisher.messages\_in\_worker\_queues=4 libbeat.es.publish.write\_bytes=37185 libbeat.es.publish.read… --- ## [Documentation for what goes in fields.yml?](https://discuss.elastic.co/t/documentation-for-what-goes-in-fields-yml/78611)
**Author:** [@rzrelyea](https://discuss.elastic.co/u/rzrelyea)\ **Replies:** 1\ **Last updated:** [March 27, 2017, 4:51pm UTC](https://discuss.elastic.co/t/documentation-for-what-goes-in-fields-yml/78611 "2017-03-27T16:51:23Z")
I've read the blog on how to build lsbeat and I've gone through the tutorial on creating a custom beat, but I can't seem to find documentation on what needs to go into \_meta\\fields.yml. I'm not sure if the documentatio… --- ## [Adding conditional tags or fields in filebeat.yml](https://discuss.elastic.co/t/adding-conditional-tags-or-fields-in-filebeat-yml/79952)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 3:33pm UTC](https://discuss.elastic.co/t/adding-conditional-tags-or-fields-in-filebeat-yml/79952 "2017-03-27T15:33:18Z")
A) Is there a way to add tags or fields - conditionally in filebeat. For eg: if the input file is xyz then add tag or field XYZ if the input file is abc then add tag or field ABC OR b) Alternativel… --- ## [How to start Filebeat?](https://discuss.elastic.co/t/how-to-start-filebeat/80133)
**Author:** [@bobbysidhartha](https://discuss.elastic.co/u/bobbysidhartha)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 3:02pm UTC](https://discuss.elastic.co/t/how-to-start-filebeat/80133 "2017-03-27T15:02:21Z")
Hi, I am a new comer to Beats and Im trying to learn it starting with Filebeats. I understood that filebeats.yml is the file where you define your input and output file. In my Linux system, I gave them as below. - in… --- ## [How to switch off default ES output of filebeat](https://discuss.elastic.co/t/how-to-switch-off-default-es-output-of-filebeat/80120)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 11:47am UTC](https://discuss.elastic.co/t/how-to-switch-off-default-es-output-of-filebeat/80120 "2017-03-27T11:47:11Z")
Dear all, I would like to get know how to switch off default ES output of filebeat. I need enable just output to redis. My output config: output.elasticsearch: enabled: false output.redis: enabled: true host… --- ## [I only see metricbeat container as host](https://discuss.elastic.co/t/i-only-see-metricbeat-container-as-host/80025)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 11:43am UTC](https://discuss.elastic.co/t/i-only-see-metricbeat-container-as-host/80025 "2017-03-27T11:43:35Z")
Hi, I am using metricbeat inside a container and want this beat to monitor the host and all other neighboring containers. Unfortunately I can only see my metricbeat docker as host in most of the dashboards views. Bu… --- ## [DNS Port Selection packetbeat](https://discuss.elastic.co/t/dns-port-selection-packetbeat/80030)
**Author:** [@korsdecaying](https://discuss.elastic.co/u/korsdecaying)\ **Replies:** 1\ **Last updated:** [March 26, 2017, 7:08pm UTC](https://discuss.elastic.co/t/dns-port-selection-packetbeat/80030 "2017-03-26T19:08:25Z")
Can I listen to all DNS traffic in the packetbeat without being bound to the port. Windows dynamically selects the port to send and needs to listen for traffic. --- ## [I'm using ELK stack on ubuntu 14.0.4 , I want to send log files from my local machine using filebeat to my server,Someone help me out with this scenario](https://discuss.elastic.co/t/im-using-elk-stack-on-ubuntu-14-0-4-i-want-to-send-log-files-from-my-local-machine-using-filebeat-to-my-server-someone-help-me-out-with-this-scenario/79848)
**Author:** [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Replies:** 8\ **Last updated:** [March 25, 2017, 9:54pm UTC](https://discuss.elastic.co/t/im-using-elk-stack-on-ubuntu-14-0-4-i-want-to-send-log-files-from-my-local-machine-using-filebeat-to-my-server-someone-help-me-out-with-this-scenario/79848 "2017-03-25T21:54:46Z")
Guide me with all configuration file for client ,step by step --- ## [Unable to process the log files to logstash and to kibana](https://discuss.elastic.co/t/unable-to-process-the-log-files-to-logstash-and-to-kibana/79896)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [March 25, 2017, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-process-the-log-files-to-logstash-and-to-kibana/79896 "2017-03-25T21:03:20Z")
Hi All - I am brand new to the Elasticsearch products and just trying to learn and getting my hands into it. I need your help / suggestions to overcome with the issues. Can you please guide me here pls? Here is where … --- ## [More performatic design for Filebeat and Logstash](https://discuss.elastic.co/t/more-performatic-design-for-filebeat-and-logstash/79829)
**Author:** [@caputo](https://discuss.elastic.co/u/caputo)\ **Replies:** 1\ **Last updated:** [March 25, 2017, 8:48pm UTC](https://discuss.elastic.co/t/more-performatic-design-for-filebeat-and-logstash/79829 "2017-03-25T20:48:38Z")
Hello all. I'm building a monitoring environment with the follow features: - 1 Windows servers monitoring more 4 windows server - Topbeat in each machine saving the information in log files - Applications saving lo… --- ## [Filebeat compatiibility with Logstash](https://discuss.elastic.co/t/filebeat-compatiibility-with-logstash/79895)
**Author:** [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\ **Replies:** 1\ **Last updated:** [March 24, 2017, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-compatiibility-with-logstash/79895 "2017-03-24T14:00:35Z")
I have logstash 2.4, what is the filebeat version compatible with this?? Is it enough if I have installed beats in logstash? --- ## [This is the error im getting ,When i tried to import\_dashboard for filebeat](https://discuss.elastic.co/t/this-is-the-error-im-getting-when-i-tried-to-import-dashboard-for-filebeat/79844)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 2\ **Last updated:** [March 24, 2017, 11:31am UTC](https://discuss.elastic.co/t/this-is-the-error-im-getting-when-i-tried-to-import-dashboard-for-filebeat/79844 "2017-03-24T11:31:11Z")
import\_dashboards -only-index import\_dashboards -only-index fail to set the mapping. Error: Put http://127.0.0.1:9200/.kibana/\_mapping/search: dial tcp 127.0.0.1:9200: connectex: No connection could be made because the … --- ## [Filebeat: Reading the log files remotely](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 7\ **Last updated:** [March 24, 2017, 7:06am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577 "2017-03-24T07:06:36Z")
Whether filebeat can be used to read the log files (Webserver, Application,.etc) remotely, instead of installing it on the server where the logs reside? --- ## [Filebeat is unable to read file for 4 hours every day](https://discuss.elastic.co/t/filebeat-is-unable-to-read-file-for-4-hours-every-day/79436)
**Author:** [@luckyswede](https://discuss.elastic.co/u/luckyswede)\ **Replies:** 2\ **Last updated:** [March 23, 2017, 9:19pm UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-read-file-for-4-hours-every-day/79436 "2017-03-23T21:19:50Z")
Hi all, I have had filebeat 2.3 running successfully for several months on several Ubuntu 16.04 servers. The other week I installed logrotate and configured cron to run it every hour. After logrotate was installed filebe… --- ## [Simple Filebeat Windows -\> Linux integration](https://discuss.elastic.co/t/simple-filebeat-windows-linux-integration/79787)
**Author:** [@franck.lefebure](https://discuss.elastic.co/u/franck.lefebure)\ **Replies:** 1\ **Last updated:** [March 23, 2017, 8:13pm UTC](https://discuss.elastic.co/t/simple-filebeat-windows-linux-integration/79787 "2017-03-23T20:13:19Z")
Hi, This is my first try with FileBeat and I have some difficulties My test conf is very simple On the filebeat side : Filebeat windows 5.2.2 windows 64 filebeat.prospectors: input\_type: log paths: C:\\Users\\fle… --- ## [Nvidiagpubeat: Monitor Nvidia GPUs using this beat](https://discuss.elastic.co/t/nvidiagpubeat-monitor-nvidia-gpus-using-this-beat/79644)
**Author:** [@deepujain](https://discuss.elastic.co/u/deepujain)\ **Replies:** 3\ **Last updated:** [March 23, 2017, 4:26pm UTC](https://discuss.elastic.co/t/nvidiagpubeat-monitor-nvidia-gpus-using-this-beat/79644 "2017-03-23T16:26:49Z")
nvidiagpubeat can be used to monitor NVIDIA GPUs. nvidiagpubeat.yml has two configurations query By default, it can query "utilization.gpu,utilization.memory,memory.total,memory.free,memory.used,temperature.gpu,p… --- ## [How to send only the newly added log events instead of the entire content of a log file?](https://discuss.elastic.co/t/how-to-send-only-the-newly-added-log-events-instead-of-the-entire-content-of-a-log-file/79127)
**Author:** [@Sharath\_Vutpala](https://discuss.elastic.co/u/Sharath_Vutpala)\ **Replies:** 17\ **Last updated:** [March 23, 2017, 3:54pm UTC](https://discuss.elastic.co/t/how-to-send-only-the-newly-added-log-events-instead-of-the-entire-content-of-a-log-file/79127 "2017-03-23T15:54:30Z")
Hi, I have a log file that need to be sent to logstash using filebeat. My log file of size ~500 MB. Whenever a new event is added to the log file, filebeat is sending the whole log file to logstash. I am interested in… --- ## [Unable to import\_dashboards](https://discuss.elastic.co/t/unable-to-import-dashboards/79739)
**Author:** [@michaelmaass](https://discuss.elastic.co/u/michaelmaass)\ **Replies:** 8\ **Last updated:** [March 23, 2017, 2:17pm UTC](https://discuss.elastic.co/t/unable-to-import-dashboards/79739 "2017-03-23T14:17:34Z")
trying to find out how to install Dashboards I face the challenge that Import\_dashboards.exe Fails to download file: https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.2.2.zip that is how… --- ## [Specific Libpcap](https://discuss.elastic.co/t/specific-libpcap/79616)
**Author:** [@billjonesdomain](https://discuss.elastic.co/u/billjonesdomain)\ **Replies:** 4\ **Last updated:** [March 23, 2017, 1:22pm UTC](https://discuss.elastic.co/t/specific-libpcap/79616 "2017-03-23T13:22:55Z")
Hi - I'm just wondering if it is possible to compile or run packetbeat with the system (or a specific) libpcap library? I have a specially-created libpcap library from a hardware vendor that allows me to see my physical… --- ## [Duplicate Windows User Names when filtering](https://discuss.elastic.co/t/duplicate-windows-user-names-when-filtering/79709)
**Author:** [@frederict](https://discuss.elastic.co/u/frederict)\ **Replies:** 4\ **Last updated:** [March 23, 2017, 12:41pm UTC](https://discuss.elastic.co/t/duplicate-windows-user-names-when-filtering/79709 "2017-03-23T12:41:22Z")
Hi, I'm new here and I am trying to set up a Windows centralised log for the first time with ELK. So far, everything is working out for me. I want to make a visualisation in Kibana to view succesful account logons on… --- ## [Keys\_under\_root option in configuration](https://discuss.elastic.co/t/keys-under-root-option-in-configuration/79602)
**Author:** [@krhubert](https://discuss.elastic.co/u/krhubert)\ **Replies:** 3\ **Last updated:** [March 23, 2017, 12:07pm UTC](https://discuss.elastic.co/t/keys-under-root-option-in-configuration/79602 "2017-03-23T12:07:42Z")
Hi, Just wonder how to put keys\_under\_root like filebeat do in my own beat? Is this supported or documented somewhere? --- ## [Beginner question - searching for string containing \[\] chars](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696)
**Author:** [@msr](https://discuss.elastic.co/u/msr)\ **Replies:** 4\ **Last updated:** [March 23, 2017, 10:44am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696 "2017-03-23T10:44:54Z")
I've just installed filebeats and I am trying to configure it to include\_lines that contain square brackets. For example, the log file entry would be something like "Storage swapped on \[DBName\].\[TableName1\]". I tried c… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=532) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=534)