# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=537 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 538 --- ## [Metricbeat cannot monitor network io?](https://discuss.elastic.co/t/metricbeat-cannot-monitor-network-io/77384)
**Author:** [@anjia0532](https://discuss.elastic.co/u/anjia0532)\ **Replies:** 2\ **Last updated:** [March 7, 2017, 5:12am UTC](https://discuss.elastic.co/t/metricbeat-cannot-monitor-network-io/77384 "2017-03-07T05:12:49Z")
Hi I want to monitor my network traffic ( Recived / Sent data per seconds) . like the windows network traffic . sent 152k/s recived 8k/s . but the network dashboard . out243.774m/30s in 166.448m/30s may be (out\_… --- ## [Metricbeat: upload output file to elasticsearch manually](https://discuss.elastic.co/t/metricbeat-upload-output-file-to-elasticsearch-manually/76825)
**Author:** [@WiemDW](https://discuss.elastic.co/u/WiemDW)\ **Replies:** 5\ **Last updated:** [March 6, 2017, 3:34pm UTC](https://discuss.elastic.co/t/metricbeat-upload-output-file-to-elasticsearch-manually/76825 "2017-03-06T15:34:13Z")
Hi, I'd like to post-process the metricbeat output, so I am using the "File output" module. However, when uploading the data to elasticsearch, I am getting an "illegal\_argument\_exception": A single example message ta… --- ## [ERR Failed to publish events caused by: write tcp 10.0.0.1:40716-\>10.0.0.2:5044: write: connection reset by peer only with one type of log](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-10-0-0-1-40716-10-0-0-2-5044-write-connection-reset-by-peer-only-with-one-type-of-log/77459)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 3:14pm UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-write-tcp-10-0-0-1-40716-10-0-0-2-5044-write-connection-reset-by-peer-only-with-one-type-of-log/77459 "2017-03-06T15:14:13Z")
Hi, I am putting in filebeats 3 types of logs: 2 raw logs (not jsons) and it reads it perfectly. Then when I put in a log (Json type) I get: ERR Failed to publish events caused by: write tcp 10.0.0.1:40716-\>10.0.0.2:50… --- ## [Filebeat combining all log lines starting with the same timestamps to a single event](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418)
**Author:** [@alex88](https://discuss.elastic.co/u/alex88)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/77418 "2017-03-06T15:05:19Z")
i have apache wsgi log: \[Sun Mar 05 14:26:12.858516 2017\] \[wsgi:error\] \[pid 11254:tid 140473096181504\] \[Sun Mar 05 14:26:12.859199 2017\] \[wsgi:error\] \[pid 11254:tid 140473096181504\] /usr/local/lib/python3.5/dist-packag… --- ## [Read the same file several times](https://discuss.elastic.co/t/read-the-same-file-several-times/76655)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 3\ **Last updated:** [March 6, 2017, 2:43pm UTC](https://discuss.elastic.co/t/read-the-same-file-several-times/76655 "2017-03-06T14:43:07Z")
Hi, I have a file that I want to harvest many time with filebeat. That means the file has some logs (say 1000 logs lines) which don't change. Once filebeat has finish harvesting these 1000 logs, I want it to reharvest … --- ## [Include relative file to a log file, as a custom field](https://discuss.elastic.co/t/include-relative-file-to-a-log-file-as-a-custom-field/76593)
**Author:** [@PicoCreator](https://discuss.elastic.co/u/PicoCreator)\ **Replies:** 5\ **Last updated:** [March 6, 2017, 2:25pm UTC](https://discuss.elastic.co/t/include-relative-file-to-a-log-file-as-a-custom-field/76593 "2017-03-06T14:25:59Z")
Conceptual filebeat.yml configuration filebeat: prospectors: paths: "/var/lib/docker/containers/\*/\*-json.log" relativeFields: container\_name: "./hostname" The idea is not to do a heavy parsing, but c… --- ## [Filebeat not sending data to logstash getting EOF and tcp io timeout](https://discuss.elastic.co/t/filebeat-not-sending-data-to-logstash-getting-eof-and-tcp-io-timeout/77190)
**Author:** [@sgora1](https://discuss.elastic.co/u/sgora1)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-logstash-getting-eof-and-tcp-io-timeout/77190 "2017-03-06T13:59:28Z")
Hi Team, I am trying to send logs using filebeat to logstash. It was working fine, but then suddenly stopped working and is no longer working now. Can you kindly help me fix this. 2017/03/02 16:37:37.620616 beat.go:… --- ## [Advice Needed on Beats](https://discuss.elastic.co/t/advice-needed-on-beats/77370)
**Author:** [@zbay](https://discuss.elastic.co/u/zbay)\ **Replies:** 4\ **Last updated:** [March 5, 2017, 9:39pm UTC](https://discuss.elastic.co/t/advice-needed-on-beats/77370 "2017-03-05T21:39:27Z")
Good evening, I'm looking for a little advice on the best way to get streaming api's information into log-stash for real time analysis. Currently I'm looking for a facebook, google, and hootsuite. I've managed to get … --- ## [Array support for YML environment values](https://discuss.elastic.co/t/array-support-for-yml-environment-values/76657)
**Author:** [@PicoCreator](https://discuss.elastic.co/u/PicoCreator)\ **Replies:** 5\ **Last updated:** [March 3, 2017, 3:49pm UTC](https://discuss.elastic.co/t/array-support-for-yml-environment-values/76657 "2017-03-03T15:49:56Z")
For example, the environment value of LOG\_EXCLUDE\_LINES='\["^A", "^B"\]' With yml configuration line exclude\_lines: "${LOG\_EXCLUDE\_LINES}" Is currently not possible, as it will be replaced with quotes. Though, t… --- ## [Collect Windows Performance counters with \*Beats?](https://discuss.elastic.co/t/collect-windows-performance-counters-with-beats/43699)
**Author:** [@sylbae](https://discuss.elastic.co/u/sylbae)\ **Replies:** 8\ **Last updated:** [March 3, 2017, 12:04pm UTC](https://discuss.elastic.co/t/collect-windows-performance-counters-with-beats/43699 "2017-03-03T12:04:30Z")
Hello, I am looking forward a way to collect Windows performance counters locally on a server and forward collected data to central Logstash servers. Remote WMI collection is not an option (too many servers, physical… --- ## [Parsing Azure json multiline logs by filebeat](https://discuss.elastic.co/t/parsing-azure-json-multiline-logs-by-filebeat/76812)
**Author:** [@111148](https://discuss.elastic.co/u/111148)\ **Replies:** 1\ **Last updated:** [March 3, 2017, 11:55am UTC](https://discuss.elastic.co/t/parsing-azure-json-multiline-logs-by-filebeat/76812 "2017-03-03T11:55:28Z")
Hello, Please advise is it possible to parse by filebeat json multiline logs with comma delimiters and send it to Elasticsearch? Json files sctucture are the next: { "time": "2017-02-28T12:04:25.7263914Z", "r… --- ## [How to tag log files in filebeat for logstash ingestion?](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 11\ **Last updated:** [March 3, 2017, 9:37am UTC](https://discuss.elastic.co/t/how-to-tag-log-files-in-filebeat-for-logstash-ingestion/44713 "2017-03-03T09:37:35Z")
If I have several different log files in a directory, and I'm wanting to forward them to logstash for grok'ing and buffering, and then to downstream Elasticsearch. As the files are coming out of Filebeat, how do I tag t… --- ## [Filebeat OOM error](https://discuss.elastic.co/t/filebeat-oom-error/76892)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 2\ **Last updated:** [March 3, 2017, 8:13am UTC](https://discuss.elastic.co/t/filebeat-oom-error/76892 "2017-03-03T08:13:42Z")
We've been running filebeat to tail logs using the following prospector configuration - input\_type: log scan\_frequency: "30s" close\_older: "24h" ignore\_older: "15h" clean\_inactive: "24h" … --- ## [Add support to access remote logs](https://discuss.elastic.co/t/add-support-to-access-remote-logs/77081)
**Author:** [@procule](https://discuss.elastic.co/u/procule)\ **Replies:** 3\ **Last updated:** [March 3, 2017, 3:57am UTC](https://discuss.elastic.co/t/add-support-to-access-remote-logs/77081 "2017-03-03T03:57:40Z")
Hi again, Following this topic: https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079/1 In the Winlogbeat code, "localhost" is hardcoded as the Event Log session/log: Here … --- ## [Consult everybody how on Windows Settings filebeat - 5.1 boot from the start](https://discuss.elastic.co/t/consult-everybody-how-on-windows-settings-filebeat-5-1-boot-from-the-start/77115)
**Author:** [@itanqian](https://discuss.elastic.co/u/itanqian)\ **Replies:** 1\ **Last updated:** [March 2, 2017, 6:39pm UTC](https://discuss.elastic.co/t/consult-everybody-how-on-windows-settings-filebeat-5-1-boot-from-the-start/77115 "2017-03-02T18:39:58Z")
Consult everybody how on Windows Settings filebeat - 5.1 boot from the start --- ## [Filebeat works for Centos 5.7](https://discuss.elastic.co/t/filebeat-works-for-centos-5-7/76800)
**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\ **Replies:** 3\ **Last updated:** [March 2, 2017, 4:39pm UTC](https://discuss.elastic.co/t/filebeat-works-for-centos-5-7/76800 "2017-03-02T16:39:50Z")
I'm trying for while but not sure filebeat supports centos 5.7 able to install but no luck to strat it any sugessition would be helpful. uname -a 2.6.18-274.el5 #1 SMP Fri Jul 8 17:36:59 EDT 2011 x86\_64 x86\_64 x86\_64… --- ## [Log feed doesn't work from Filebeats to Logstash (Ping Request failed)](https://discuss.elastic.co/t/log-feed-doesnt-work-from-filebeats-to-logstash-ping-request-failed/77168)
**Author:** [@chebs](https://discuss.elastic.co/u/chebs)\ **Replies:** 1\ **Last updated:** [March 2, 2017, 4:39pm UTC](https://discuss.elastic.co/t/log-feed-doesnt-work-from-filebeats-to-logstash-ping-request-failed/77168 "2017-03-02T16:39:14Z")
Log feed doesn't work from Filebeats to Logstash with below error however it works when i tried to feed from file beats to elastic search directly. My infra structure is : Filebeats - remote server ELK - another r… --- ## [Socket module reports incorrect IP version](https://discuss.elastic.co/t/socket-module-reports-incorrect-ip-version/77125)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 2\ **Last updated:** [March 2, 2017, 2:28pm UTC](https://discuss.elastic.co/t/socket-module-reports-incorrect-ip-version/77125 "2017-03-02T14:28:25Z")
I am posting here first before opening an issue on Github. While conducting some testing on the new TCP socket module I have found that in some situations an incorrect value is reported for system.socket.family. I have o… --- ## [Filebeats @timestamp can remove or modify the format?](https://discuss.elastic.co/t/filebeats-timestamp-can-remove-or-modify-the-format/77098)
**Author:** [@zhenxing914](https://discuss.elastic.co/u/zhenxing914)\ **Replies:** 1\ **Last updated:** [March 2, 2017, 1:02pm UTC](https://discuss.elastic.co/t/filebeats-timestamp-can-remove-or-modify-the-format/77098 "2017-03-02T13:02:15Z")
I want to pass filebeats collect logs to eagle. but eagle cant parse the time format (2017-03-02T06:02:47.859Z) i can remove the @timestamp or modify time format ? i want @timestamp is 2017-03-2 06:02:48,859. --- ## [File beats 5.1 consume a mount of disk space](https://discuss.elastic.co/t/file-beats-5-1-consume-a-mount-of-disk-space/76953)
**Author:** [@whybangbang](https://discuss.elastic.co/u/whybangbang)\ **Replies:** 2\ **Last updated:** [March 2, 2017, 8:37am UTC](https://discuss.elastic.co/t/file-beats-5-1-consume-a-mount-of-disk-space/76953 "2017-03-02T08:37:17Z")
file beats 5.1 consume a mount of disk space --- ## [Filebeat index is not happening on the elastic search](https://discuss.elastic.co/t/filebeat-index-is-not-happening-on-the-elastic-search/76968)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 2\ **Last updated:** [March 2, 2017, 8:03am UTC](https://discuss.elastic.co/t/filebeat-index-is-not-happening-on-the-elastic-search/76968 "2017-03-02T08:03:09Z")
I m using ELK stack 5.2 version. I have changed the output to elasticsearch in filebeat.yml. I dont see any index on elasticsearch and kibana. I want to move the file with logs on machine A to machine B\[elk server\]. … --- ## [Wmibeats](https://discuss.elastic.co/t/wmibeats/77083)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 0\ **Last updated:** [March 2, 2017, 4:10am UTC](https://discuss.elastic.co/t/wmibeats/77083 "2017-03-02T04:10:44Z")
Hi- I've to collect the Windows metrics like Performance Counters, I found wmibeat does it. I've downloaded the latest release version from the GIT. Which has got wmibeat.exe and wmibeat.yml file. How do I run this beat… --- ## [Winlogbeat.yml should specify the "api" attribute is available](https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079)
**Author:** [@procule](https://discuss.elastic.co/u/procule)\ **Replies:** 0\ **Last updated:** [March 2, 2017, 3:10am UTC](https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079 "2017-03-02T03:10:16Z")
Hi, After two days of attempting to change the code of Winlogbeat to access the logs of a remote SAN integrating the Windows Event Log API, I realized that the SAN was using the old "eventlogging" API. While trying … --- ## [No log file created while debugging logs with filebeat 5](https://discuss.elastic.co/t/no-log-file-created-while-debugging-logs-with-filebeat-5/77036)
**Author:** [@Saurabh\_Gupta1](https://discuss.elastic.co/u/Saurabh_Gupta1)\ **Replies:** 1\ **Last updated:** [March 1, 2017, 10:19pm UTC](https://discuss.elastic.co/t/no-log-file-created-while-debugging-logs-with-filebeat-5/77036 "2017-03-01T22:19:38Z")
Hi Filebeat team , For filebeat 5 debugging logs file is not creating in define path. I m using OS linux. logging.level: info logging.to\_files: true logging.to\_syslog: false logging.files: path: /var/log name: m… --- ## [Use logstash or filebeat for sending azure JSON logs?](https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456)
**Author:** [@111148](https://discuss.elastic.co/u/111148)\ **Replies:** 15\ **Last updated:** [March 1, 2017, 8:29pm UTC](https://discuss.elastic.co/t/use-logstash-or-filebeat-for-sending-azure-json-logs/74456 "2017-03-01T20:29:27Z")
Hello, sorry for silly question but I was trying about a week to adjust logstash 5.2 config for sending azure JSON logs to elastic 5.2, but all my attempts were failed. Logstash throws many different exceptions and error… --- ## [Metricbeat conf.d?](https://discuss.elastic.co/t/metricbeat-conf-d/76885)
**Author:** [@ritchierich](https://discuss.elastic.co/u/ritchierich)\ **Replies:** 2\ **Last updated:** [March 1, 2017, 8:02pm UTC](https://discuss.elastic.co/t/metricbeat-conf-d/76885 "2017-03-01T20:02:47Z")
Is there a conf.d or equivalent to manage modules in separate files? I'd like to have a base system module for all my systems then add modules per system role. Ideally, I could create separate yml file for each modu… --- ## [Unable to create Filebeat index](https://discuss.elastic.co/t/unable-to-create-filebeat-index/76935)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 4\ **Last updated:** [March 1, 2017, 5:52pm UTC](https://discuss.elastic.co/t/unable-to-create-filebeat-index/76935 "2017-03-01T17:52:46Z")
Im unable to index filebeat into kibana. Please help in indexing filebeat into kibana. --- ## [FileBeat not logging from a server but it is from other 6](https://discuss.elastic.co/t/filebeat-not-logging-from-a-server-but-it-is-from-other-6/77022)
**Author:** [@francopp](https://discuss.elastic.co/u/francopp)\ **Replies:** 2\ **Last updated:** [March 1, 2017, 5:44pm UTC](https://discuss.elastic.co/t/filebeat-not-logging-from-a-server-but-it-is-from-other-6/77022 "2017-03-01T17:44:38Z")
I have Beats installed in 7 different servers, all with same config but just a little path differences. It results that from one of those 7 they first day that i just start the service it send the logs perfectly but afte… --- ## [URL Check return Certificate detials](https://discuss.elastic.co/t/url-check-return-certificate-detials/76878)
**Author:** [@Kerrywgtn](https://discuss.elastic.co/u/Kerrywgtn)\ **Replies:** 1\ **Last updated:** [March 1, 2017, 4:41pm UTC](https://discuss.elastic.co/t/url-check-return-certificate-detials/76878 "2017-03-01T16:41:24Z")
Can the URL check return the Certificate details (if HTTPS). I like to check and monitor the Certificate expiry date, Serial number, and common name on some servers. Also it would be very useful to do a CRC/hash check… --- ## [Source hostname instead of source\_ip](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 6\ **Last updated:** [March 1, 2017, 4:37pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852 "2017-03-01T16:37:10Z")
Hello, is there any way to have a source\_hostname instead of source\_ip. I am looking to monitor traffic data and it seems there is only a choice by IP but hostname would be more useful since we wouldn't have to keep trac… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=536) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=538)