# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=536 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 537 --- ## [Dial tcp (ip number):5044: getsockopt: connection refused](https://discuss.elastic.co/t/dial-tcp-ip-number-5044-getsockopt-connection-refused/77104)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 11\ **Last updated:** [March 11, 2017, 6:03pm UTC](https://discuss.elastic.co/t/dial-tcp-ip-number-5044-getsockopt-connection-refused/77104 "2017-03-11T18:03:53Z")
Hi, I am trying to transfer logs from filebeats to logstash, but I get this error in the filebeats log: dial tcp (ip number):5044: getsockopt: connection refused In my LogStash config.d the configuration file is: a… --- ## [Heartbeat should support context passing](https://discuss.elastic.co/t/heartbeat-should-support-context-passing/77241)
**Author:** [@anjia0532](https://discuss.elastic.co/u/anjia0532)\ **Replies:** 4\ **Last updated:** [March 11, 2017, 6:03pm UTC](https://discuss.elastic.co/t/heartbeat-should-support-context-passing/77241 "2017-03-11T18:03:17Z")
I want to monitor the web service login do somethings with cookies/params (login response) I don't know how to do it. zabbix it's easy do that --- ## [Possible bug with beats 5.3 and glide?](https://discuss.elastic.co/t/possible-bug-with-beats-5-3-and-glide/77896)
**Author:** [@rzrelyea](https://discuss.elastic.co/u/rzrelyea)\ **Replies:** 4\ **Last updated:** [March 11, 2017, 5:55pm UTC](https://discuss.elastic.co/t/possible-bug-with-beats-5-3-and-glide/77896 "2017-03-11T17:55:04Z")
I am developing a custom beat and was testing the build on a clean directory when I hit a problem with glide. Note that I only have this problem with glide when using version 5.3 of beats. If I use version 5.2 glide do… --- ## [Ship only a percentage of logs to logstash](https://discuss.elastic.co/t/ship-only-a-percentage-of-logs-to-logstash/77393)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 3\ **Last updated:** [March 11, 2017, 4:55pm UTC](https://discuss.elastic.co/t/ship-only-a-percentage-of-logs-to-logstash/77393 "2017-03-11T16:55:18Z")
How can I configure filebeat to only ship a percentage of logs (a sample if you will) In my application's log folder the logs are chunked to about 20 megs each. I want filebeat to ship only 1/300th of that log volume … --- ## [Collecting docker logs using filebeat](https://discuss.elastic.co/t/collecting-docker-logs-using-filebeat/77675)
**Author:** [@rohitC](https://discuss.elastic.co/u/rohitC)\ **Replies:** 2\ **Last updated:** [March 11, 2017, 4:41pm UTC](https://discuss.elastic.co/t/collecting-docker-logs-using-filebeat/77675 "2017-03-11T16:41:56Z")
Hi, I want to collect logs(with container metadata like container id, image name, host machine) of applications running in containers deployed on more than one host machines using Mesos-Marathon. After some initial inv… --- ## [Filebeat harvester never stops running and doesn't detect file changes](https://discuss.elastic.co/t/filebeat-harvester-never-stops-running-and-doesnt-detect-file-changes/77069)
**Author:** [@colinmcintosh](https://discuss.elastic.co/u/colinmcintosh)\ **Replies:** 5\ **Last updated:** [March 11, 2017, 4:29pm UTC](https://discuss.elastic.co/t/filebeat-harvester-never-stops-running-and-doesnt-detect-file-changes/77069 "2017-03-11T16:29:27Z")
We have beats running and watching a single log file that is updated a few times per second constantly. The log file is generated by the Python3.6 logging.handlers.WatchedFileHandler and is rotated by logrotate once it r… --- ## [Filebeat doesn't update rotated log file's new content](https://discuss.elastic.co/t/filebeat-doesnt-update-rotated-log-files-new-content/77798)
**Author:** [@Haley](https://discuss.elastic.co/u/Haley)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 4:27pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-update-rotated-log-files-new-content/77798 "2017-03-11T16:27:05Z")
Hi, I need your help. I have in trouble with dealing with filebeat. Until now, I created new log files every day like /home/haley/2017-01/01/session.log /home/haley/2017-01/02/session.log /home/haley/2017-01/03/sess… --- ## [HAProxy module has issues with metricbeat](https://discuss.elastic.co/t/haproxy-module-has-issues-with-metricbeat/77637)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 4:05pm UTC](https://discuss.elastic.co/t/haproxy-module-has-issues-with-metricbeat/77637 "2017-03-11T16:05:47Z")
Dear folks, Another issue is coming with HAProxy module for Metricbeat, Today I just enabled Haproxy module within metricbeat, but I got some error messages from metricbeat for collect Haprox metrics 1xx to 5xx etc. … --- ## [\[ES5.1.2\] Help with Detecting DNS Tunnels with PacketBeat+Watcher](https://discuss.elastic.co/t/es5-1-2-help-with-detecting-dns-tunnels-with-packetbeat-watcher/72522)
**Author:** [@Snowman](https://discuss.elastic.co/u/Snowman)\ **Replies:** 8\ **Last updated:** [March 11, 2017, 6:03am UTC](https://discuss.elastic.co/t/es5-1-2-help-with-detecting-dns-tunnels-with-packetbeat-watcher/72522 "2017-03-11T06:03:47Z")
Hi, thanks a lot for your reply. I am using Packetbeat - 5.1.2 (My Kibana and also Elastic are 5.1.2) from elasticsearch repo. curl -XGET "http://localhost:9200/packetbeat-\*/dns/\_search?pretty&q=dns.question.etld\_plus\_… --- ## [Not able to send the data from one machine to primary machine](https://discuss.elastic.co/t/not-able-to-send-the-data-from-one-machine-to-primary-machine/77306)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 2\ **Last updated:** [March 11, 2017, 12:36am UTC](https://discuss.elastic.co/t/not-able-to-send-the-data-from-one-machine-to-primary-machine/77306 "2017-03-11T00:36:31Z")
Hi Team, I am trying to send the Event logs from Machine 1 to Machine 2 (Which is having the ELK stack on it) but not able to post the data even on changing the winlogbeat.yml (hosts: \["Machine2IP:9200"\]) of 1st mach… --- ## [Winlog config](https://discuss.elastic.co/t/winlog-config/77819)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 12:33am UTC](https://discuss.elastic.co/t/winlog-config/77819 "2017-03-11T00:33:06Z")
hello I have the following config for my network : Winlogbeats =======\>Logstash====\> Redis=====\>logstash ======\>Client node======\> Cluster of elasticsearch now I want to create cluster for my Logstash inputs an… --- ## [Filebeat Process multilne XML](https://discuss.elastic.co/t/filebeat-process-multilne-xml/77761)
**Author:** [@Sourabh\_Narang](https://discuss.elastic.co/u/Sourabh_Narang)\ **Replies:** 2\ **Last updated:** [March 11, 2017, 12:29am UTC](https://discuss.elastic.co/t/filebeat-process-multilne-xml/77761 "2017-03-11T00:29:12Z")
I have a log file where I am printing request and response XML bodies. This log file also has some additional lines that are not XML. Example below -- =========================================== \ \ … --- ## [Connecting redis through proxy](https://discuss.elastic.co/t/connecting-redis-through-proxy/77771)
**Author:** [@Sandhya\_Rathinapandi](https://discuss.elastic.co/u/Sandhya_Rathinapandi)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 12:13am UTC](https://discuss.elastic.co/t/connecting-redis-through-proxy/77771 "2017-03-11T00:13:13Z")
I have my filebeat connecting to redis where filebeat is in one server and redis in other server. I will have to connect to the redis through a proxy. Is there any way I can do this? --- ## [Filebeat Connecting error publishing events Error](https://discuss.elastic.co/t/filebeat-connecting-error-publishing-events-error/77710)
**Author:** [@Erik\_Chubb](https://discuss.elastic.co/u/Erik_Chubb)\ **Replies:** 6\ **Last updated:** [March 11, 2017, 12:07am UTC](https://discuss.elastic.co/t/filebeat-connecting-error-publishing-events-error/77710 "2017-03-11T00:07:46Z")
Hello Everyone, I am having an issue with trying to get logs on a linux server using filebeat to be delivered to my ELK server. They are both on the same network, I can ping each server and I can telnet from the clien… --- ## [Start Filebeat in the foreground for supervisord](https://discuss.elastic.co/t/start-filebeat-in-the-foreground-for-supervisord/77694)
**Author:** [@Vinod\_Rai](https://discuss.elastic.co/u/Vinod_Rai)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 12:04am UTC](https://discuss.elastic.co/t/start-filebeat-in-the-foreground-for-supervisord/77694 "2017-03-11T00:04:10Z")
From the official filebeat docs : If you use an init.d script to start Filebeat on deb or rpm, you can’t specify command line flags (see Command Line Options). To specify flags, start Filebeat in the foreground. I'm … --- ## [Cannot get winlogbeats to send to logstash](https://discuss.elastic.co/t/cannot-get-winlogbeats-to-send-to-logstash/77648)
**Author:** [@L33T](https://discuss.elastic.co/u/L33T)\ **Replies:** 1\ **Last updated:** [March 11, 2017, 12:01am UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-to-send-to-logstash/77648 "2017-03-11T00:01:33Z")
Hi, Trying to get a new installation up and running but getting the following in my winlogbeats log: 2017-03-07T11:25:46Z ERR Connecting error publishing events (retrying): Get http://192.168.50.181:9200: dial tcp 19… --- ## [Send real-time logs from windows server to ELK stack](https://discuss.elastic.co/t/send-real-time-logs-from-windows-server-to-elk-stack/78170)
**Author:** [@dcdfs](https://discuss.elastic.co/u/dcdfs)\ **Replies:** 1\ **Last updated:** [March 10, 2017, 11:45pm UTC](https://discuss.elastic.co/t/send-real-time-logs-from-windows-server-to-elk-stack/78170 "2017-03-10T23:45:31Z")
Hi, I'm new to elasticsearch I have a requirement to send a specific log file(not .log format) from a remote location to ELK stack on another server(linux). What is the best approach for this? I looked at filebeat, b… --- ## [How to disable loading template for Elasticsearch 2.x?](https://discuss.elastic.co/t/how-to-disable-loading-template-for-elasticsearch-2-x/77701)
**Author:** [@Wojter](https://discuss.elastic.co/u/Wojter)\ **Replies:** 9\ **Last updated:** [March 10, 2017, 4:36pm UTC](https://discuss.elastic.co/t/how-to-disable-loading-template-for-elasticsearch-2-x/77701 "2017-03-10T16:36:16Z")
Hi everyone! @Update: Head to first comment to see my current problem I try to load JSON formatted logs from log file into elasticsearch. Everything works OK, but I have those json.message, json.@timestamp, json.whate… --- ## [Metricbeat user and Elasticsearch connection](https://discuss.elastic.co/t/metricbeat-user-and-elasticsearch-connection/75952)
**Author:** [@prodrg](https://discuss.elastic.co/u/prodrg)\ **Replies:** 5\ **Last updated:** [March 10, 2017, 3:19pm UTC](https://discuss.elastic.co/t/metricbeat-user-and-elasticsearch-connection/75952 "2017-03-10T15:19:40Z")
I have been configuring Metricbeat on my ELK configuration using these two documents: Securing Communication With Elasticsearch Beats and Security The Metricbeat user I configured is based on the Packetbeat user exampl… --- ## [Heartbeat not starting when second monitor is added](https://discuss.elastic.co/t/heartbeat-not-starting-when-second-monitor-is-added/77360)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 4\ **Last updated:** [March 10, 2017, 3:14pm UTC](https://discuss.elastic.co/t/heartbeat-not-starting-when-second-monitor-is-added/77360 "2017-03-10T15:14:36Z")
Hi I'm new to ELK stack . Im Using ELK 5.2 and Heartbeat Version 5.2.2. After changing the heartbeat.yml to following , i couldn't start heartbeat service. So i tried validating heartbeat.yml and i got error "Exiting… --- ## [Does filebeat need java?](https://discuss.elastic.co/t/does-filebeat-need-java/78140)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 2\ **Last updated:** [March 10, 2017, 12:38pm UTC](https://discuss.elastic.co/t/does-filebeat-need-java/78140 "2017-03-10T12:38:26Z")
Dear all, Does filebeat need java? I would like to install filebeat on every application hosts to transport logs to logstash forwarder. So, i need to get know. Does filebeat installation need java? Should me inst… --- ## [Metricbeat apache status non-standard URL](https://discuss.elastic.co/t/metricbeat-apache-status-non-standard-url/78006)
**Author:** [@lmalossi](https://discuss.elastic.co/u/lmalossi)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 10:31pm UTC](https://discuss.elastic.co/t/metricbeat-apache-status-non-standard-url/78006 "2017-03-09T22:31:05Z")
Hi, I'd like to use metricbeat apache plugin using a non standard apache status URL (/public/apache-status) Is there some way to accomplish that? thanks --- ## [Drop\_event config issue](https://discuss.elastic.co/t/drop-event-config-issue/77405)
**Author:** [@rherr63](https://discuss.elastic.co/u/rherr63)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 10:13pm UTC](https://discuss.elastic.co/t/drop-event-config-issue/77405 "2017-03-09T22:13:31Z")
I found a similar issue to what I am dealing with and tried the filters solution but still not able to start Metricbeat successfully. I reviewed https://discuss.elastic.co/t/processors-drop-event-no-worky/70970/3 and tri… --- ## [How to compile packetbeat from source on a linux distribution where the libpcap library is installed in the custom location](https://discuss.elastic.co/t/how-to-compile-packetbeat-from-source-on-a-linux-distribution-where-the-libpcap-library-is-installed-in-the-custom-location/77463)
**Author:** [@Dibyendu\_Das](https://discuss.elastic.co/u/Dibyendu_Das)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 9:56pm UTC](https://discuss.elastic.co/t/how-to-compile-packetbeat-from-source-on-a-linux-distribution-where-the-libpcap-library-is-installed-in-the-custom-location/77463 "2017-03-09T21:56:59Z")
Hi, I'm trying to build packet-beat from source following the guide here. I'm using a 64bit linux distribution where the libpcap library is installed in a different location than its default path i.e /usr/local/lib. How … --- ## [Filebeat exec](https://discuss.elastic.co/t/filebeat-exec/77850)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 13\ **Last updated:** [March 8, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850 "2017-03-08T17:28:17Z")
Is there a way to run an exec on a file and then ship that output to logstash? --- ## [Read logs from another server and ship to logstash using filebeat](https://discuss.elastic.co/t/read-logs-from-another-server-and-ship-to-logstash-using-filebeat/75327)
**Author:** [@paya](https://discuss.elastic.co/u/paya)\ **Replies:** 2\ **Last updated:** [March 8, 2017, 4:05pm UTC](https://discuss.elastic.co/t/read-logs-from-another-server-and-ship-to-logstash-using-filebeat/75327 "2017-03-08T16:05:58Z")
Hi all, I am setting up a an independent machine to run all ELK services together, but I have to read the log files from other servers, in specific they are all haproxy. so my question is: is it possible to setup and… --- ## [Make setup fails](https://discuss.elastic.co/t/make-setup-fails/77511)
**Author:** [@kmyokoyama](https://discuss.elastic.co/u/kmyokoyama)\ **Replies:** 4\ **Last updated:** [March 8, 2017, 3:36pm UTC](https://discuss.elastic.co/t/make-setup-fails/77511 "2017-03-08T15:36:12Z")
Hi, everyone. I'm following the Countbeat example tutorial and make setup fails with the following error: mkdir -p vendor/github.com/elastic/ cp -R /home/kmyokoyama/go/src/github.com/elastic/beats vendor/github.com/… --- ## [Hsbeat: how to map the fields to what their represent](https://discuss.elastic.co/t/hsbeat-how-to-map-the-fields-to-what-their-represent/77050)
**Author:** [@Parisa](https://discuss.elastic.co/u/Parisa)\ **Replies:** 1\ **Last updated:** [March 8, 2017, 3:14pm UTC](https://discuss.elastic.co/t/hsbeat-how-to-map-the-fields-to-what-their-represent/77050 "2017-03-08T15:14:27Z")
Hi, I'm using hsbeat and it is fantastic. However I have a hard time matching the field names to what they represent. For example from the visualization I can say that the "hotspot.hsperfdata.sun/gc/generation/1/space/… --- ## [Metricbeat can't collect nginx metrics](https://discuss.elastic.co/t/metricbeat-cant-collect-nginx-metrics/76911)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 6\ **Last updated:** [March 7, 2017, 10:14am UTC](https://discuss.elastic.co/t/metricbeat-cant-collect-nginx-metrics/76911 "2017-03-07T10:14:23Z")
Hi folks, :slight\_smile:We encountered an issue while we trying to collect the nginx metrics from a nginx server via metricbeat, the thing that we installed the newest nginx version and also enabled nginx status module… --- ## [Winlogbeat ignores registry file with forwarded events](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 6\ **Last updated:** [March 7, 2017, 6:19am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601 "2017-03-07T06:19:25Z")
Hi there I think I discovered a bug and wanted the community's opinion before I submit an issue on GitHub. First, this only happens with forwarded events. I haven't been able to reproduce with locally generated event… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=535) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=537)