# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=535 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 536 --- ## [Couldn't start the Wmibeat as Windows Service](https://discuss.elastic.co/t/couldnt-start-the-wmibeat-as-windows-service/78829)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [March 17, 2017, 9:45am UTC](https://discuss.elastic.co/t/couldnt-start-the-wmibeat-as-windows-service/78829 "2017-03-17T09:45:36Z")
Hi - I've added the wmibeats as a service on a windows-7 server, when I tried to start the service, its throwing the below error: Could you please let me know, how do I fix this issue ? I had put my configuration bel… --- ## [Split "event\_data" to only show the original field](https://discuss.elastic.co/t/split-event-data-to-only-show-the-original-field/78587)
**Author:** [@peanut](https://discuss.elastic.co/u/peanut)\ **Replies:** 2\ **Last updated:** [March 16, 2017, 10:46pm UTC](https://discuss.elastic.co/t/split-event-data-to-only-show-the-original-field/78587 "2017-03-16T22:46:26Z")
Good afternoon elastic community, I posted this question on the Logstash section but I figured it would be helpful to get your Winlogbeat expertise too. Is it best practice to mutate all the fields with the "event\_data… --- ## [Where do these OLD Indexes come from?](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 7\ **Last updated:** [March 16, 2017, 8:25pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532 "2017-03-16T20:25:08Z")
Looking at my cluster, I am seeing some clusters with dates back to (logstash-2007.02.26). How on earth did these get created? Is some sending devices data/time off? --- ## [Kibana Still Displays Data From Uninstalled Filebeat](https://discuss.elastic.co/t/kibana-still-displays-data-from-uninstalled-filebeat/78527)
**Author:** [@peter.alfafara](https://discuss.elastic.co/u/peter.alfafara)\ **Replies:** 3\ **Last updated:** [March 16, 2017, 3:47pm UTC](https://discuss.elastic.co/t/kibana-still-displays-data-from-uninstalled-filebeat/78527 "2017-03-16T15:47:37Z")
Hi, We are currently experiencing an issue where Kibana still displays data gathered by our uninstalled Filebeat. We initially installed Filebeat along with ElasticSearch, Kibana and Logstash. Then we decided to use… --- ## [Process Monitoring using Topbeat](https://discuss.elastic.co/t/process-monitoring-using-topbeat/77746)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 5\ **Last updated:** [March 16, 2017, 3:43pm UTC](https://discuss.elastic.co/t/process-monitoring-using-topbeat/77746 "2017-03-16T15:43:54Z")
Hi, Can somebody throw some light on how to do process monitoring using topbeat and show it on dashboard highlighting the processes which are not running. Thank you! Sam --- ## [Monitor Siebel URL : Heartbeat](https://discuss.elastic.co/t/monitor-siebel-url-heartbeat/78162)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 4\ **Last updated:** [March 16, 2017, 1:51pm UTC](https://discuss.elastic.co/t/monitor-siebel-url-heartbeat/78162 "2017-03-16T13:51:59Z")
Hi All, We have couple of siebel instances and we want to monitor their urls. The YML i use looks like this. How ever i could only see Kibana url in elastic search. Am i missing anything ? - type: http urls: \["h… --- ## [Parse the past - How to manage my log files](https://discuss.elastic.co/t/parse-the-past-how-to-manage-my-log-files/78481)
**Author:** [@Pierre\_Vincent\_Ledou](https://discuss.elastic.co/u/Pierre_Vincent_Ledou)\ **Replies:** 2\ **Last updated:** [March 16, 2017, 9:35am UTC](https://discuss.elastic.co/t/parse-the-past-how-to-manage-my-log-files/78481 "2017-03-16T09:35:14Z")
Hi, I have installed a ELK stack in production to get stats from our cdn logs. I have about 6 month of past logs to parse, with between 50 and 200 millions of event per day. Logs are stored in gz. Currently, I have a… --- ## [Add Docker metadata to logs shipped with filebeat?](https://discuss.elastic.co/t/add-docker-metadata-to-logs-shipped-with-filebeat/78789)
**Author:** [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\ **Replies:** 2\ **Last updated:** [March 16, 2017, 3:41am UTC](https://discuss.elastic.co/t/add-docker-metadata-to-logs-shipped-with-filebeat/78789 "2017-03-16T03:41:22Z")
Is there any way to attach Docker information from hosts like container images, ids, etc. with filebeat? If not, is there any other way to get this metadata from hosts into Logstash? It looks like the Fluentd client d… --- ## [New To Beats : Unable to build custom beat for cross-environment](https://discuss.elastic.co/t/new-to-beats-unable-to-build-custom-beat-for-cross-environment/78765)
**Author:** [@deepujain](https://discuss.elastic.co/u/deepujain)\ **Replies:** 4\ **Last updated:** [March 15, 2017, 11:03pm UTC](https://discuss.elastic.co/t/new-to-beats-unable-to-build-custom-beat-for-cross-environment/78765 "2017-03-15T23:03:08Z")
I was able to create a sample beat using developer guide (kudos to it). However when i make a beat in Mac am unable to run it on a linux x86 box. I provided "GOOS=linux GOARCH=386" in Makefile and then ran make. However… --- ## [New to beats development](https://discuss.elastic.co/t/new-to-beats-development/78425)
**Author:** [@Vinicius\_Carvalho](https://discuss.elastic.co/u/Vinicius_Carvalho)\ **Replies:** 1\ **Last updated:** [March 15, 2017, 10:51pm UTC](https://discuss.elastic.co/t/new-to-beats-development/78425 "2017-03-15T22:51:44Z")
Hi there, I'm checking beats for the first time. I've been a long time ES user in the past, it's amazing to see how much the ecosystem has evolved. So, beats is amazing, and I would like to integrate into my java app, … --- ## [Filebeat incorrectly tailing an XML log file](https://discuss.elastic.co/t/filebeat-incorrectly-tailing-an-xml-log-file/77916)
**Author:** [@gtvmark](https://discuss.elastic.co/u/gtvmark)\ **Replies:** 4\ **Last updated:** [March 15, 2017, 10:48pm UTC](https://discuss.elastic.co/t/filebeat-incorrectly-tailing-an-xml-log-file/77916 "2017-03-15T22:48:21Z")
I have the worst logfile to try and parse. It is a complete XML document with a trailing closing tag. Each time the logfile is written to, new entries are being inserted before the closing tag. This is playing havoc… --- ## [Metricbeat index date timezone](https://discuss.elastic.co/t/metricbeat-index-date-timezone/78296)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 5\ **Last updated:** [March 15, 2017, 9:59pm UTC](https://discuss.elastic.co/t/metricbeat-index-date-timezone/78296 "2017-03-15T21:59:42Z")
How do you control the timezone metricbeat uses for the date part of the index name: For ex: metricbeat-2017.03.12 Is there a way I can tell metricbeat to use a particular timezone when generating the date part abo… --- ## [Filebeat to Logstash error wsarecv](https://discuss.elastic.co/t/filebeat-to-logstash-error-wsarecv/78185)
**Author:** [@dkota](https://discuss.elastic.co/u/dkota)\ **Replies:** 4\ **Last updated:** [March 15, 2017, 9:58pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-error-wsarecv/78185 "2017-03-15T21:58:46Z")
I'm running beat on windows server 2012 and ELK stack on Ubuntu 16. I have checked the firewall and port 5044 is open, telnet also proves the same. Logstash.conf input { beats { port =\> 5044 } } output { … --- ## [Filebeat, send log file again](https://discuss.elastic.co/t/filebeat-send-log-file-again/78750)
**Author:** [@hurg](https://discuss.elastic.co/u/hurg)\ **Replies:** 3\ **Last updated:** [March 15, 2017, 8:08pm UTC](https://discuss.elastic.co/t/filebeat-send-log-file-again/78750 "2017-03-15T20:08:06Z")
Hello guys. Can someone help me? I've tested with a new log. After testing I've removed all this data from elasticsearch. So how I can re-send this log files? Thanks for the help! --- ## [Kafka formatting output](https://discuss.elastic.co/t/kafka-formatting-output/78603)
**Author:** [@jimnelson2](https://discuss.elastic.co/u/jimnelson2)\ **Replies:** 1\ **Last updated:** [March 15, 2017, 6:31pm UTC](https://discuss.elastic.co/t/kafka-formatting-output/78603 "2017-03-15T18:31:40Z")
Using 5.2.2, trying to send just my log message to Kafka by defining the codec in filebeat.yml as shown below: filebeat: prospectors: \[\] registry\_file: "/var/lib/filebeat/registry" config\_dir: "/etc/filebeat/conf… --- ## [Security between filebeat and logstash](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523)
**Author:** [@Patrik\_Soderstrom](https://discuss.elastic.co/u/Patrik_Soderstrom)\ **Replies:** 1\ **Last updated:** [March 15, 2017, 5:20pm UTC](https://discuss.elastic.co/t/security-between-filebeat-and-logstash/78523 "2017-03-15T17:20:10Z")
Hi, I have setup ELK-stack without X-pack and it works great. Data is getting in to logstash and then sent to elasticsearch. Now I wanted to add security so I have added x-pack to Elasticsearch, Kibana and Logstash. I ca… --- ## [Filebeat to Logstash connection fails](https://discuss.elastic.co/t/filebeat-to-logstash-connection-fails/78396)
**Author:** [@prodrg](https://discuss.elastic.co/u/prodrg)\ **Replies:** 5\ **Last updated:** [March 14, 2017, 3:09pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-connection-fails/78396 "2017-03-14T15:09:31Z")
Hello guys, I'm trying to connect a Filebeat instance with Logstash. Filebeat and Logstash are on version 5.2.1. These are my config files. filebeat.yml output.logstash: hosts: \["130.164.67.34:5044"\] ssl.certif… --- ## [Monitor multiple URLs yml configiration](https://discuss.elastic.co/t/monitor-multiple-urls-yml-configiration/78478)
**Author:** [@dmihic](https://discuss.elastic.co/u/dmihic)\ **Replies:** 2\ **Last updated:** [March 15, 2017, 8:24am UTC](https://discuss.elastic.co/t/monitor-multiple-urls-yml-configiration/78478 "2017-03-15T08:24:08Z")
Hi! I have a question regarding heartbeat configuration inside heartbeat.yml file. I want to monitor multiple urls using http. I have added needed urls into heartbeat.yml and it is working. I am getting data in Elast… --- ## [Message Field missing](https://discuss.elastic.co/t/message-field-missing/78421)
**Author:** [@negeric](https://discuss.elastic.co/u/negeric)\ **Replies:** 3\ **Last updated:** [March 15, 2017, 1:40am UTC](https://discuss.elastic.co/t/message-field-missing/78421 "2017-03-15T01:40:40Z")
Hello, I've been using Logstash to parse my IIS logs for some time now. I decided to start using Filebeat to send logs directly to Logstash to make things easier. My problem is that the message field appears to be miss… --- ## [Heartbeat: Monitor based tags](https://discuss.elastic.co/t/heartbeat-monitor-based-tags/78363)
**Author:** [@dosera](https://discuss.elastic.co/u/dosera)\ **Replies:** 2\ **Last updated:** [March 14, 2017, 7:52am UTC](https://discuss.elastic.co/t/heartbeat-monitor-based-tags/78363 "2017-03-14T07:52:54Z")
Hi, I have a heartbeat that checks many different hosts; the urls of these hosts are usually not very expressive, e.g. heartbeat.monitors: -type: 'http' urls: \["1.2.3.4"\] -type 'http' urls: \["5.6.7.8"\] ... It w… --- ## [Source file path transfer to Logstash](https://discuss.elastic.co/t/source-file-path-transfer-to-logstash/74708)
**Author:** [@DenysK](https://discuss.elastic.co/u/DenysK)\ **Replies:** 7\ **Last updated:** [March 13, 2017, 8:45pm UTC](https://discuss.elastic.co/t/source-file-path-transfer-to-logstash/74708 "2017-03-13T20:45:55Z")
Hello, I'm not new with ELK stuck already. But I did not use all functionality of ELK. i have a question for community about Filebeat v1.3 configuration. I need to transfer Source file location(path) as a field to L… --- ## [Heartbeat visibility in Kibana](https://discuss.elastic.co/t/heartbeat-visibility-in-kibana/78364)
**Author:** [@martin.dew-hattens](https://discuss.elastic.co/u/martin.dew-hattens)\ **Replies:** 1\ **Last updated:** [March 13, 2017, 5:34pm UTC](https://discuss.elastic.co/t/heartbeat-visibility-in-kibana/78364 "2017-03-13T17:34:54Z")
SO I have had an ELK setup running nicely for some time. Sending logs files with filebeats from various servers. Now I want to extend this to heartbeat. Installed the software. configure the heartbeat.yml and starte… --- ## [Understanding Multiline](https://discuss.elastic.co/t/understanding-multiline/77920)
**Author:** [@Louuu](https://discuss.elastic.co/u/Louuu)\ **Replies:** 2\ **Last updated:** [March 13, 2017, 4:20pm UTC](https://discuss.elastic.co/t/understanding-multiline/77920 "2017-03-13T16:20:30Z")
Hi, I have started using filebeat recently and have been looking at the multiline configurations as shown in the documentation. https://play.golang.org/p/LQpFDR34t9 According to that, my multiline regex works as e… --- ## [Filebeat keeps crashing](https://discuss.elastic.co/t/filebeat-keeps-crashing/75444)
**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\ **Replies:** 2\ **Last updated:** [March 13, 2017, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-keeps-crashing/75444 "2017-03-13T13:26:25Z")
hi everyone I have recently installed filbeat on to my systems so that i can push the logs to logstash. the problem i am facing is that the systems keep crashing and i believe it is because of the data congestions thr… --- ## [Filebeat - transport.go:125: SSL client failed to connect with: read tcp connection reset by peer](https://discuss.elastic.co/t/filebeat-transport-go-125-ssl-client-failed-to-connect-with-read-tcp-connection-reset-by-peer/44257)
**Author:** [@charannaik](https://discuss.elastic.co/u/charannaik)\ **Replies:** 6\ **Last updated:** [March 13, 2017, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-transport-go-125-ssl-client-failed-to-connect-with-read-tcp-connection-reset-by-peer/44257 "2017-03-13T13:00:19Z")
hi, i configured filebeat as instructed here https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7 (execpt that i did this on Red had server) however i ha… --- ## [Sending logs to ES server with Filebeat connection issues](https://discuss.elastic.co/t/sending-logs-to-es-server-with-filebeat-connection-issues/78315)
**Author:** [@ezequielo](https://discuss.elastic.co/u/ezequielo)\ **Replies:** 1\ **Last updated:** [March 13, 2017, 12:49pm UTC](https://discuss.elastic.co/t/sending-logs-to-es-server-with-filebeat-connection-issues/78315 "2017-03-13T12:49:24Z")
Hi, I have a server with ES + Kibana and I want to start shipping logs from different servers to the "monitoring server". I tried to use ES output like this: output.elasticsearch: # Array of hosts to connect to. h… --- ## [Capture HTTPS Certificate Expiration Dates using Heartbeat](https://discuss.elastic.co/t/capture-https-certificate-expiration-dates-using-heartbeat/77865)
**Author:** [@joedissmeyer](https://discuss.elastic.co/u/joedissmeyer)\ **Replies:** 3\ **Last updated:** [March 13, 2017, 11:18am UTC](https://discuss.elastic.co/t/capture-https-certificate-expiration-dates-using-heartbeat/77865 "2017-03-13T11:18:36Z")
I had the opportunity to ask @tudor this question at ElasticOn17 -- this might be a feature request. Q: For the heartbeat HTTP monitor type, is it possible for Heartbeat to capture the HTTPS certificate expiration date… --- ## [Several questions to introduce PacketBeat to commercial system](https://discuss.elastic.co/t/several-questions-to-introduce-packetbeat-to-commercial-system/77474)
**Author:** [@sisquared79](https://discuss.elastic.co/u/sisquared79)\ **Replies:** 3\ **Last updated:** [March 13, 2017, 6:01am UTC](https://discuss.elastic.co/t/several-questions-to-introduce-packetbeat-to-commercial-system/77474 "2017-03-13T06:01:56Z")
Hello, I am trying to introduce PacketBeat to the enterprise system for the security enhancement purpose. I have several questions. Could you please answer the following questions? What is the maximum bps(supported … --- ## [Can beats be embedded in Android?](https://discuss.elastic.co/t/can-beats-be-embedded-in-android/76146)
**Author:** [@Hyojoung\_Shin](https://discuss.elastic.co/u/Hyojoung_Shin)\ **Replies:** 8\ **Last updated:** [March 13, 2017, 1:41am UTC](https://discuss.elastic.co/t/can-beats-be-embedded-in-android/76146 "2017-03-13T01:41:55Z")
Hi, Thank you for the amazing works! My goal is to send GPS data from android app to elasticsearch. I made a collecting server which is getting GPS data from android using socket communication and send it to ES using… --- ## [Import Dashboard: fail to set the mapping](https://discuss.elastic.co/t/import-dashboard-fail-to-set-the-mapping/75397)
**Author:** [@JB\_ELK](https://discuss.elastic.co/u/JB_ELK)\ **Replies:** 2\ **Last updated:** [March 12, 2017, 11:36pm UTC](https://discuss.elastic.co/t/import-dashboard-fail-to-set-the-mapping/75397 "2017-03-12T23:36:12Z")
I have an endpoint host OS running Winlogbeat and a VMworkstation hosting my ELK stack. I am testing and getting the dashboards is the last step I have. Need help with the script import. PS C:\\Program Files\\winlogbea… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=534) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=536)