# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=534 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 535 --- ## [FileBeats with Redis](https://discuss.elastic.co/t/filebeats-with-redis/36009)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 8\ **Last updated:** [March 22, 2017, 4:44pm UTC](https://discuss.elastic.co/t/filebeats-with-redis/36009 "2017-03-22T16:44:31Z")
Hi My Current setup is - File Beat --\> Log Stash ---\> Elastic Search The expected log volume is say 10 GB per hour to LS (as current version of FB doesn't have regexp feature and ships all logs). Hence would li… --- ## [Overload of Filebeat?](https://discuss.elastic.co/t/overload-of-filebeat/79468)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 4\ **Last updated:** [March 22, 2017, 2:19pm UTC](https://discuss.elastic.co/t/overload-of-filebeat/79468 "2017-03-22T14:19:35Z")
Hello, I try to uplaod 53 000 000 lines split into about 600 files with Filebeat 5.1 (Stack in 5.1) I was surprised by the slowness of the upload of lines and i was look the log of filebeat and surprise there is 2 er… --- ## [Failed opening... too many open files](https://discuss.elastic.co/t/failed-opening-too-many-open-files/38045)
**Author:** [@Adam\_Bozsik](https://discuss.elastic.co/u/Adam_Bozsik)\ **Replies:** 6\ **Last updated:** [March 22, 2017, 1:37pm UTC](https://discuss.elastic.co/t/failed-opening-too-many-open-files/38045 "2017-03-22T13:37:45Z")
Hi, I'd like to send my logfiles (about 5000 files) from a syslog server but I get error messages like this: /usr/bin/filebeat\[8209\]: log.go:197: Failed opening /var/log/remote/cts/daemon.log: open /var/log/remote/c… --- ## [Question about system.process.cpu.total.pct](https://discuss.elastic.co/t/question-about-system-process-cpu-total-pct/78926)
**Author:** [@misabel](https://discuss.elastic.co/u/misabel)\ **Replies:** 6\ **Last updated:** [March 22, 2017, 11:11am UTC](https://discuss.elastic.co/t/question-about-system-process-cpu-total-pct/78926 "2017-03-22T11:11:18Z")
Hi, If I look at the documentation for metricbeat I see the definition of system.process.cpu.total.pct as: The percentage of CPU time spent by the process since the last update. Its value is similar to the %CPU value o… --- ## [Heartbeat: Ignore SSL errors](https://discuss.elastic.co/t/heartbeat-ignore-ssl-errors/79477)
**Author:** [@dosera](https://discuss.elastic.co/u/dosera)\ **Replies:** 3\ **Last updated:** [March 22, 2017, 8:18am UTC](https://discuss.elastic.co/t/heartbeat-ignore-ssl-errors/79477 "2017-03-22T08:18:06Z")
Input heartbeat.monitors - type: 'http' schedule: '@every60s' urls: - https://someurl.com:443/path/ timeout: 20 status: 200 Now, when the certifcate cannot be validated, I get an error: Outp… --- ## [Filebeat error shipping logs =\> read: connection reset by peer (no TLS/SSL)](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438)
**Author:** [@zokratez](https://discuss.elastic.co/u/zokratez)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438 "2017-03-21T17:28:55Z")
I searched in the other topics but cannot find the solution to my problem.... Scenary: FileBeat 5.2.2.1 Filebeat-input-plugin 3.1.14 ELK 5.2 I have 4 server successfully sending logs to the logstash servers... I cre… --- ## [Indexes at work Packetbeat](https://discuss.elastic.co/t/indexes-at-work-packetbeat/79424)
**Author:** [@korsdecaying](https://discuss.elastic.co/u/korsdecaying)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 3:51pm UTC](https://discuss.elastic.co/t/indexes-at-work-packetbeat/79424 "2017-03-21T15:51:08Z")
How to understand in which the index writes a packetbeat. Why so many indexes were created and how to make everything be written in one. Kibina defines the packetbeat- \* and outputs the information only for 12.03.2017 --- ## [ERR Connecting error publishing events](https://discuss.elastic.co/t/err-connecting-error-publishing-events/79419)
**Author:** [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 3:09pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events/79419 "2017-03-21T15:09:16Z")
Hello: I am brand new to this and I have installed the ELK server based on this - https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04 It appears… --- ## [Collecting logfiles of Docker containers with filebeat running as Docker container](https://discuss.elastic.co/t/collecting-logfiles-of-docker-containers-with-filebeat-running-as-docker-container/77548)
**Author:** [@MartinAhrer](https://discuss.elastic.co/u/MartinAhrer)\ **Replies:** 5\ **Last updated:** [March 21, 2017, 3:07pm UTC](https://discuss.elastic.co/t/collecting-logfiles-of-docker-containers-with-filebeat-running-as-docker-container/77548 "2017-03-21T15:07:54Z")
I have added docker containers with the ELK components plus filebeat networks: elk: external: name: elk services: elasticsearch: environment: http.host: 0.0.0.0 transport.host: 127.0.0.… --- ## [Index packetbeat](https://discuss.elastic.co/t/index-packetbeat/79361)
**Author:** [@korsdecaying](https://discuss.elastic.co/u/korsdecaying)\ **Replies:** 4\ **Last updated:** [March 21, 2017, 2:01pm UTC](https://discuss.elastic.co/t/index-packetbeat/79361 "2017-03-21T14:01:01Z")
How do I determine which index the data from the packetbeat is written to. For some reason, they created a lot. And what query can I read the data from this index. As I understand it is necessary to determine what types … --- ## [Custom fields in metricset](https://discuss.elastic.co/t/custom-fields-in-metricset/79360)
**Author:** [@shweta\_chugh](https://discuss.elastic.co/u/shweta_chugh)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 1:57pm UTC](https://discuss.elastic.co/t/custom-fields-in-metricset/79360 "2017-03-21T13:57:59Z")
Can we add custom/user defined fields in inbuild modules in metricset. for instance adding filed description in MySQL module? --- ## [Duplicate events with Filebeat on windows on service restart](https://discuss.elastic.co/t/duplicate-events-with-filebeat-on-windows-on-service-restart/78743)
**Author:** [@eirc](https://discuss.elastic.co/u/eirc)\ **Replies:** 14\ **Last updated:** [March 21, 2017, 12:43pm UTC](https://discuss.elastic.co/t/duplicate-events-with-filebeat-on-windows-on-service-restart/78743 "2017-03-21T12:43:16Z")
We have a log file we are harvesting with Filebeat on some Windows hosts (2008 R2 Datacenter). Whenever the filebeat service is restarted the file gets fully resent. Here the log of filebeat shutting down: 2017-03-15… --- ## [Error creating a Metricset](https://discuss.elastic.co/t/error-creating-a-metricset/79346)
**Author:** [@shweta\_chugh](https://discuss.elastic.co/u/shweta_chugh)\ **Replies:** 4\ **Last updated:** [March 21, 2017, 7:12am UTC](https://discuss.elastic.co/t/error-creating-a-metricset/79346 "2017-03-21T07:12:20Z")
I am trying to create a metricset using command make create-metricset which gives me this error. I have Golang 1.8 installed on my system. Please help in resolving this. Thanks --- ## [Drop "event\_data." from data field](https://discuss.elastic.co/t/drop-event-data-from-data-field/78608)
**Author:** [@peanut](https://discuss.elastic.co/u/peanut)\ **Replies:** 6\ **Last updated:** [March 20, 2017, 11:43pm UTC](https://discuss.elastic.co/t/drop-event-data-from-data-field/78608 "2017-03-20T23:43:15Z")
Good afternoon Elastic team, I am sending Sysmon logs to my ELK stack with Winlogbeat 5.2.1 and all of them have the "event\_data" string in the field names. For example: event\_data.CommandLine should be only CommandL… --- ## [Dynamic modification of \[beats\].yml file for providing list of hosts/urls dynamically](https://discuss.elastic.co/t/dynamic-modification-of-beats-yml-file-for-providing-list-of-hosts-urls-dynamically/78646)
**Author:** [@shweta\_chugh](https://discuss.elastic.co/u/shweta_chugh)\ **Replies:** 6\ **Last updated:** [March 20, 2017, 12:46pm UTC](https://discuss.elastic.co/t/dynamic-modification-of-beats-yml-file-for-providing-list-of-hosts-urls-dynamically/78646 "2017-03-20T12:46:27Z")
Hi, My application code is written in Java. I am running heartbeat and metricbeat on one application module and some devices are getting connected to this module randomly thus I get an IP address of the connected devi… --- ## [Filebeat is not taking new entries from overwritten file](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 3\ **Last updated:** [March 20, 2017, 10:24am UTC](https://discuss.elastic.co/t/filebeat-is-not-taking-new-entries-from-overwritten-file/79062 "2017-03-20T10:24:40Z")
Hi, I am using ELK GA 5.0.0. In my Linux box, I am pushing vmstat entries to a file using the following shell script; #!/bin/bash while true do \>vmstatlog.log echo "\`vmstat\`"$'\\n' \>\> vmstatlog.log sleep 2 done Th… --- ## [Capturing Traffic over websockets](https://discuss.elastic.co/t/capturing-traffic-over-websockets/78940)
**Author:** [@jnmoore](https://discuss.elastic.co/u/jnmoore)\ **Replies:** 1\ **Last updated:** [March 20, 2017, 9:26am UTC](https://discuss.elastic.co/t/capturing-traffic-over-websockets/78940 "2017-03-20T09:26:39Z")
Can packetbeat capture websocket traffic? If so, what kind of information is it able to log? --- ## [Filebeat on Windows seem to not use the registry file](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241)
**Author:** [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Replies:** 12\ **Last updated:** [March 20, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241 "2017-03-20T08:52:39Z")
Hello, We have just migrated to Elastic Stack 5.2. Filebeat version 5.2.1 We have filebeats running on Windows Server 2012 R2 and every time the filebeat service is restart all lines from all harvested logs gets se… --- ## [Filebeat - logstash performances troubleshooting](https://discuss.elastic.co/t/filebeat-logstash-performances-troubleshooting/77037)
**Author:** [@gleroy](https://discuss.elastic.co/u/gleroy)\ **Replies:** 14\ **Last updated:** [March 20, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-logstash-performances-troubleshooting/77037 "2017-03-20T08:52:10Z")
Hello, I have an application which generates ~50 files/minute with 10000 events (monoline). Previously, I read these files with logstash, processed them and sent them to Elasticsearch. Unfortunately, I was CPU-bound, s… --- ## [Systemctl start filebeat does not start filebeat](https://discuss.elastic.co/t/systemctl-start-filebeat-does-not-start-filebeat/78330)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 5\ **Last updated:** [March 20, 2017, 1:58am UTC](https://discuss.elastic.co/t/systemctl-start-filebeat-does-not-start-filebeat/78330 "2017-03-20T01:58:10Z")
after changing some configuration (I added json.message\_key: message json.keys\_under\_root: true ) and doing restart to filebeat, filebeat refuses to start with nothing showing on the logs... --- ## [Is it good practice to exclude Packetbeat traffic?](https://discuss.elastic.co/t/is-it-good-practice-to-exclude-packetbeat-traffic/79072)
**Author:** [@jnmoore](https://discuss.elastic.co/u/jnmoore)\ **Replies:** 3\ **Last updated:** [March 18, 2017, 7:01pm UTC](https://discuss.elastic.co/t/is-it-good-practice-to-exclude-packetbeat-traffic/79072 "2017-03-18T19:01:16Z")
Greetings all, I'm new to packetbeat, and dived straight into exploring packetbeat events in Kibana setup to listen to a small preproduction environment. And I noticed a reoccuring spike every 10 seconds of 300 events … --- ## [Want to Install ELK Stack for my app logs](https://discuss.elastic.co/t/want-to-install-elk-stack-for-my-app-logs/79065)
**Author:** [@AHK](https://discuss.elastic.co/u/AHK)\ **Replies:** 1\ **Last updated:** [March 17, 2017, 5:16pm UTC](https://discuss.elastic.co/t/want-to-install-elk-stack-for-my-app-logs/79065 "2017-03-17T17:16:44Z")
Hello, I am trying to install ELK Stack for my App logs on my Centos7 Server and Get Logs from CentOS Client. I was searching and find this video how to install and configure but the issue is i can't find Logstash … --- ## [Global config of filebeat](https://discuss.elastic.co/t/global-config-of-filebeat/79035)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 2\ **Last updated:** [March 17, 2017, 4:29pm UTC](https://discuss.elastic.co/t/global-config-of-filebeat/79035 "2017-03-17T16:29:53Z")
Dear all, What is the need to have and configure parameters in filebeat.full.yml which are the same as in filebeat.yml? What is the sens or reason? Can i ignore this config by means adding comment symbol to every s… --- ## [Zookeeper Metricbeat connection failure](https://discuss.elastic.co/t/zookeeper-metricbeat-connection-failure/79053)
**Author:** [@ab-agni](https://discuss.elastic.co/u/ab-agni)\ **Replies:** 1\ **Last updated:** [March 17, 2017, 4:16pm UTC](https://discuss.elastic.co/t/zookeeper-metricbeat-connection-failure/79053 "2017-03-17T16:16:02Z")
Hello, I have enabled zk module in metricbeat yml file. Both are on same host. yet I am getting connection failure between the 2 as shown in Kibana. Please help. I have other modules like docker working with metricbea… --- ## [Winlogbeat kafka-output seems to be broken](https://discuss.elastic.co/t/winlogbeat-kafka-output-seems-to-be-broken/79008)
**Author:** [@Mugen](https://discuss.elastic.co/u/Mugen)\ **Replies:** 1\ **Last updated:** [March 17, 2017, 4:12pm UTC](https://discuss.elastic.co/t/winlogbeat-kafka-output-seems-to-be-broken/79008 "2017-03-17T16:12:50Z")
I installed winlogbeat 5.2.2 on a windows Server 2012R2 machine. winlogbeat sends to the kafka-node, the node creates a topic, but the topic remains empty. Packages are ariving. I checked via tcpdump . Has someone manag… --- ## [How to get filebeat to output to ES multiple servers](https://discuss.elastic.co/t/how-to-get-filebeat-to-output-to-es-multiple-servers/78835)
**Author:** [@eddie4](https://discuss.elastic.co/u/eddie4)\ **Replies:** 3\ **Last updated:** [March 17, 2017, 4:02pm UTC](https://discuss.elastic.co/t/how-to-get-filebeat-to-output-to-es-multiple-servers/78835 "2017-03-17T16:02:06Z")
Hello everyone, Am using the filebeat for Suricata & ES server. Now my colleague have decided to use filebeat as well. But they are using a completely different setup. I have been attempting to set different configurat… --- ## [Module Redis Authentication](https://discuss.elastic.co/t/module-redis-authentication/78676)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 4\ **Last updated:** [March 17, 2017, 12:05pm UTC](https://discuss.elastic.co/t/module-redis-authentication/78676 "2017-03-17T12:05:55Z")
Hi everyone, I would like to know it there is some way to configure Redis Module when we have authentication in Redis like in MySQL Module. metricbeat.modules: - module: redis metricsets: \["info"\] enabled: true p… --- ## [Http responsetime unrealistic results](https://discuss.elastic.co/t/http-responsetime-unrealistic-results/40276)
**Author:** [@jonatanzafar59](https://discuss.elastic.co/u/jonatanzafar59)\ **Replies:** 16\ **Last updated:** [March 17, 2017, 11:33am UTC](https://discuss.elastic.co/t/http-responsetime-unrealistic-results/40276 "2017-03-17T11:33:46Z")
Hi, I am recording data from a number of Elasticsearch cluster. For some queries, I get huge unrealistic response time numbers (3 mins). When I run the queries on the clusters, they return in 100ms~. note: I didn't… --- ## [SMTP port 25 and 587](https://discuss.elastic.co/t/smtp-port-25-and-587/78810)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 2\ **Last updated:** [March 16, 2017, 7:48pm UTC](https://discuss.elastic.co/t/smtp-port-25-and-587/78810 "2017-03-16T19:48:32Z")
any chance i can shipped smtp on tcp port 25 and 587 using packetbeat --- ## [Network data value resets at 4GB](https://discuss.elastic.co/t/network-data-value-resets-at-4gb/78384)
**Author:** [@patrick1](https://discuss.elastic.co/u/patrick1)\ **Replies:** 3\ **Last updated:** [March 17, 2017, 10:06am UTC](https://discuss.elastic.co/t/network-data-value-resets-at-4gb/78384 "2017-03-17T10:06:23Z")
Hei there, I'm using Timelion to visualize the network data. My problem is that Metricbeat will reset the value to 0 after it exceeds 4GB. To be more specific, its maximum value seems to be an unsigned Int32 in my case… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=533) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=535)