# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=538 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 539 --- ## [Failed to install filebeat RPM on EL5 Linux machine](https://discuss.elastic.co/t/failed-to-install-filebeat-rpm-on-el5-linux-machine/76638)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 9\ **Last updated:** [March 1, 2017, 4:34pm UTC](https://discuss.elastic.co/t/failed-to-install-filebeat-rpm-on-el5-linux-machine/76638 "2017-03-01T16:34:58Z")
I am trying to install filebeat-5.0.1 and getting the following error: error: /petavm/abpapp1/inf/petavm2/Beats/packages/filebeat-5.0.1-x86\_64.rpm: Header V4 RSA/SHA512 signature: BAD, key ID d88e42b4 error: /petavm/ab… --- ## [Add original message to documents logged with decode\_json\_fields](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 3\ **Last updated:** [March 1, 2017, 3:59pm UTC](https://discuss.elastic.co/t/add-original-message-to-documents-logged-with-decode-json-fields/76772 "2017-03-01T15:59:47Z")
Hi folks. I am using Filebeat to log a bunch of JSON-formatted log-files into ES, and occasionally I get records with a json error such as Error decoding JSON: invalid character ',' in numeric literal Can I add the o… --- ## [Metricbeat 5.1.2 Windows service times out at startup](https://discuss.elastic.co/t/metricbeat-5-1-2-windows-service-times-out-at-startup/76993)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [March 1, 2017, 3:52pm UTC](https://discuss.elastic.co/t/metricbeat-5-1-2-windows-service-times-out-at-startup/76993 "2017-03-01T15:52:51Z")
Hi, metricbeat service is not starting in Win2012 R2 terminal server. When running manually it takes very long until until the first metrics is fetched. There are many errors like this in debug log: error getting proce… --- ## [Correct @timestamp format for JSON ingress](https://discuss.elastic.co/t/correct-timestamp-format-for-json-ingress/76653)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 1\ **Last updated:** [March 1, 2017, 9:28am UTC](https://discuss.elastic.co/t/correct-timestamp-format-for-json-ingress/76653 "2017-03-01T09:28:05Z")
Hi. I'm using Filebeat to import data from a log file that is putting a JSON object in a log file. I am getting parser errors on import: @timestamp not overwritten (parse error on 2017-02-27T16:19:08) An example of … --- ## [Trying to work out the expected JSON format for Varnish logging](https://discuss.elastic.co/t/trying-to-work-out-the-expected-json-format-for-varnish-logging/76185)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 4\ **Last updated:** [March 1, 2017, 9:27am UTC](https://discuss.elastic.co/t/trying-to-work-out-the-expected-json-format-for-varnish-logging/76185 "2017-03-01T09:27:06Z")
I am trying to log data from Varnish, which can be coerced into producing a JSON log file. When I import this using Filebeat, I'm getting a json\_error of Error decoding JSON: invalid character '}' looking for beginn… --- ## [Logrotate problems (I think)](https://discuss.elastic.co/t/logrotate-problems-i-think/76840)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 1\ **Last updated:** [March 1, 2017, 8:38am UTC](https://discuss.elastic.co/t/logrotate-problems-i-think/76840 "2017-03-01T08:38:49Z")
I have a fairly high-volume log file source (Varnish) that I'm trying to push into ES. What I'm seeing, is FileBeat seems to start logging every hour, roughly on the hour, but only for a few minutes (seems to vary betwe… --- ## [Filebeat, File was truncated. Begin reading file from offset 0](https://discuss.elastic.co/t/filebeat-file-was-truncated-begin-reading-file-from-offset-0/74526)
**Author:** [@KDerksen](https://discuss.elastic.co/u/KDerksen)\ **Replies:** 9\ **Last updated:** [March 1, 2017, 8:13am UTC](https://discuss.elastic.co/t/filebeat-file-was-truncated-begin-reading-file-from-offset-0/74526 "2017-03-01T08:13:09Z")
Filebeat version: 5.1.2 OS: Debian Jessie I am trying to set up an IIS log dashboard for the company i work for. So i set up a Filebeat\>Logstash\>Elasticsearch\>Grafana server. For a few days i thought everything was wor… --- ## ["keyword" field shows up as "analyzed" in Kibana](https://discuss.elastic.co/t/keyword-field-shows-up-as-analyzed-in-kibana/76883)
**Author:** [@Parisa](https://discuss.elastic.co/u/Parisa)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 10:15pm UTC](https://discuss.elastic.co/t/keyword-field-shows-up-as-analyzed-in-kibana/76883 "2017-02-28T22:15:00Z")
Hi, I'm using Elasticsearch stack 5.x and using the metricbeat and hsbeat. They both have similar mapping templates and for the common fields like beat,name & beat.hostname the mapping is exactly the same. I have suc… --- ## [Network bytes per second example](https://discuss.elastic.co/t/network-bytes-per-second-example/76845)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 8:13pm UTC](https://discuss.elastic.co/t/network-bytes-per-second-example/76845 "2017-02-28T20:13:30Z")
The "system.network.out.bytes" metric gives you the total bytes, can someone give me a Timelion expression using derivative to show bytes per second. Thanks, E --- ## [I am getting a Error in kibana dashboard creation](https://discuss.elastic.co/t/i-am-getting-a-error-in-kibana-dashboard-creation/76449)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 9\ **Last updated:** [February 28, 2017, 6:56pm UTC](https://discuss.elastic.co/t/i-am-getting-a-error-in-kibana-dashboard-creation/76449 "2017-02-28T18:56:38Z")
Hello It seems i keep receiving this issue on both the newest version of ELK and also a previous version. Error: \[unsupported\_operation\_exception\] custom format isn't supported is the error. It only shows up when i try… --- ## [Load balancing with ERR : Failed to publish events caused by: write tcp](https://discuss.elastic.co/t/load-balancing-with-err-failed-to-publish-events-caused-by-write-tcp/76585)
**Author:** [@Suin\_You](https://discuss.elastic.co/u/Suin_You)\ **Replies:** 4\ **Last updated:** [February 28, 2017, 4:20pm UTC](https://discuss.elastic.co/t/load-balancing-with-err-failed-to-publish-events-caused-by-write-tcp/76585 "2017-02-28T16:20:33Z")
I got the error message from filebeat. 2017-02-27T16:12:07+09:00 ERR Failed to publish events caused by: write tcp clientIP:44036-\>HostIP1:5044: write: connection reset by peer 2017-02-27T16:12:07+09:00 INFO Error publ… --- ## [Filebeat fails to start for multiple prospectors(Exiting: error loading config file: yaml: line 16: did not find expected key)](https://discuss.elastic.co/t/filebeat-fails-to-start-for-multiple-prospectors-exiting-error-loading-config-file-yaml-line-16-did-not-find-expected-key/76652)
**Author:** [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\ **Replies:** 3\ **Last updated:** [February 28, 2017, 4:11pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-for-multiple-prospectors-exiting-error-loading-config-file-yaml-line-16-did-not-find-expected-key/76652 "2017-02-28T16:11:37Z")
I configured filebeat to pull two types of log files and my config looks something like this. filebeat: prospectors: - input\_type: log paths: - C:\\softwares\\syslog fields: {log\_type: syslog} … --- ## [Beats to syslog](https://discuss.elastic.co/t/beats-to-syslog/76816)
**Author:** [@matt](https://discuss.elastic.co/u/matt)\ **Replies:** 0\ **Last updated:** [February 28, 2017, 4:03pm UTC](https://discuss.elastic.co/t/beats-to-syslog/76816 "2017-02-28T16:03:39Z")
Is there a plugin that could move data from one server to a remote syslog-ng server. I know the logstash + syslog plugin could do it, just looking for a lighter option. Currently we are using filebeats --\> logstash --\>s… --- ## [Can we run filebeat in silent mode with command line option /s](https://discuss.elastic.co/t/can-we-run-filebeat-in-silent-mode-with-command-line-option-s/76763)
**Author:** [@Neelesh\_Sahu](https://discuss.elastic.co/u/Neelesh_Sahu)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 3:51pm UTC](https://discuss.elastic.co/t/can-we-run-filebeat-in-silent-mode-with-command-line-option-s/76763 "2017-02-28T15:51:54Z")
Hi All, I have requirement to run Filebeat in Silent mode instead of normal mode. Is there any option available to run in silent mode (ps: not as service). Example : Filebeat\*\*\*\*\*\*\*.exe" /S (/S is the command to ru… --- ## [Packetbeat File Output Options](https://discuss.elastic.co/t/packetbeat-file-output-options/76625)
**Author:** [@sdeshpande](https://discuss.elastic.co/u/sdeshpande)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 1:00pm UTC](https://discuss.elastic.co/t/packetbeat-file-output-options/76625 "2017-02-28T13:00:07Z")
Hi Guys, I have couple of questions with Packetbeat. I am trying to implement Packetbeat to sniff traffic on my network so that we can feed the collected data to a analytics platform. I have a span port configured on o… --- ## [Parsing metricbeat json log in filebeat -\> got processing timestamp, not log timestamp](https://discuss.elastic.co/t/parsing-metricbeat-json-log-in-filebeat-got-processing-timestamp-not-log-timestamp/76610)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 10:23am UTC](https://discuss.elastic.co/t/parsing-metricbeat-json-log-in-filebeat-got-processing-timestamp-not-log-timestamp/76610 "2017-02-28T10:23:07Z")
Hi, I use following workstream: metricbeat for gathering metrics -\> using file output to buffer on disk -\> transfer the log via filebeat to logstash -\> do further enrichment -\> send to elasticsearch. Here is my fil… --- ## [Metricbeat Mongodb dbstats release?](https://discuss.elastic.co/t/metricbeat-mongodb-dbstats-release/76109)
**Author:** [@Musashisan](https://discuss.elastic.co/u/Musashisan)\ **Replies:** 3\ **Last updated:** [February 28, 2017, 8:14am UTC](https://discuss.elastic.co/t/metricbeat-mongodb-dbstats-release/76109 "2017-02-28T08:14:52Z")
Hi ! Great job with the metricbeat and mongodb module. Im using the last metricbeat tagged version (5.2.1) but i cannot enable the dbstats metricset. Looking around the github commits, i've found that it is at the Mast… --- ## [Metricbeat with AWS EFS](https://discuss.elastic.co/t/metricbeat-with-aws-efs/75950)
**Author:** [@Joey\_Coleman](https://discuss.elastic.co/u/Joey_Coleman)\ **Replies:** 6\ **Last updated:** [February 28, 2017, 7:31am UTC](https://discuss.elastic.co/t/metricbeat-with-aws-efs/75950 "2017-02-28T07:31:19Z")
Hey, has anyone configured metricbeat on a system with a AWS EFS share mounted? Because AWS shows that the volume has 9223372036854775808 bytes (8 Exabytes) free, I'm getting warnings like below showing up in the log. … --- ## [Bulk\_max\_body\_size support?](https://discuss.elastic.co/t/bulk-max-body-size-support/76611)
**Author:** [@PicoCreator](https://discuss.elastic.co/u/PicoCreator)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 2:36am UTC](https://discuss.elastic.co/t/bulk-max-body-size-support/76611 "2017-02-28T02:36:23Z")
An alternative limit to bulk\_max\_size. That functions based on the payload size instead. output: ### Elasticsearch as output elasticsearch: # Array of hosts to connect to. hosts: \["${ES\_HOST}:${ES\_PORT}"\]… --- ## [System module period](https://discuss.elastic.co/t/system-module-period/75923)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 6\ **Last updated:** [February 28, 2017, 12:11am UTC](https://discuss.elastic.co/t/system-module-period/75923 "2017-02-28T00:11:17Z")
I'm using version 5.2.1 on Win10-x64, the metricbeat.yml is setup with a period of 10s see below, outputting to elasticsearch but the log shows the logging period always 30 seconds, I'm a new user what am I missing ? m… --- ## [Winlogbeat maximum size of event?](https://discuss.elastic.co/t/winlogbeat-maximum-size-of-event/73708)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 12\ **Last updated:** [February 22, 2017, 4:20am UTC](https://discuss.elastic.co/t/winlogbeat-maximum-size-of-event/73708 "2017-02-22T04:20:17Z")
Hi! I'm curious whether there is a maximum size of events winlogbeat can forward. While I need to know this for current versions I also need this information about version 1.2 or 1.3. Background: I plan to use winlog… --- ## [Export all monitored metrics to Excel file](https://discuss.elastic.co/t/export-all-monitored-metrics-to-excel-file/76525)
**Author:** [@ChiBiPonD](https://discuss.elastic.co/u/ChiBiPonD)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 12:55pm UTC](https://discuss.elastic.co/t/export-all-monitored-metrics-to-excel-file/76525 "2017-02-27T12:55:43Z")
I would like to export all monitored metrics (cpu, ram, disk) with timestamps to excel file. Can anyone suggest me how to do it? --- ## [How to process apache log files in Filebeat?](https://discuss.elastic.co/t/how-to-process-apache-log-files-in-filebeat/76180)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 3\ **Last updated:** [February 27, 2017, 11:37am UTC](https://discuss.elastic.co/t/how-to-process-apache-log-files-in-filebeat/76180 "2017-02-27T11:37:11Z")
Hi, I have set up Filebeat and Logstash to process the apache access logs. In my filebeat.yml file, I have specified a director from where logs should be picked. When I first copied the file, it got picked and got proc… --- ## [Filebeat Logging configuration - filename](https://discuss.elastic.co/t/filebeat-logging-configuration-filename/76364)
**Author:** [@Suin\_You](https://discuss.elastic.co/u/Suin_You)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 11:25am UTC](https://discuss.elastic.co/t/filebeat-logging-configuration-filename/76364 "2017-02-27T11:25:55Z")
Filebeat has files.name in logging configuration and I wanna write log file name with date. ex. filebeat-log.2017-02-24, ... Is it possible to write file with date like log4j? --- ## [Filebeat agent is causing the other processes (on same server) to crash](https://discuss.elastic.co/t/filebeat-agent-is-causing-the-other-processes-on-same-server-to-crash/76373)
**Author:** [@ntnnrn](https://discuss.elastic.co/u/ntnnrn)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 5:32am UTC](https://discuss.elastic.co/t/filebeat-agent-is-causing-the-other-processes-on-same-server-to-crash/76373 "2017-02-27T05:32:30Z")
Hi, We have a ELK stack setup. It was working fine, till we setup Filebeat agent on one of our servers, where many applications are hosted. We have Filebeat agents setup on other servers, which are working fine. But on… --- ## [Metricbeat: how to add additional field based on path?](https://discuss.elastic.co/t/metricbeat-how-to-add-additional-field-based-on-path/75450)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [February 24, 2017, 5:44pm UTC](https://discuss.elastic.co/t/metricbeat-how-to-add-additional-field-based-on-path/75450 "2017-02-24T17:44:07Z")
Hi, we have a shared servers, which means one server has multiple instances of our application installed, while each installation is used for a different stage. Means we are providing dev and qa environment on the same… --- ## [Best way to ship metricbeat to multiple servers?](https://discuss.elastic.co/t/best-way-to-ship-metricbeat-to-multiple-servers/76409)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [February 24, 2017, 5:32pm UTC](https://discuss.elastic.co/t/best-way-to-ship-metricbeat-to-multiple-servers/76409 "2017-02-24T17:32:44Z")
Hi, We have two kibana instances, which work indepently from each other. One is for customer access with limited data inside, and one for internal use with more detailed data. We use metricbeat for getting data from … --- ## [Fixed: Cannot yum install Filebeat, broken repo](https://discuss.elastic.co/t/fixed-cannot-yum-install-filebeat-broken-repo/42675)
**Author:** [@fadzhli](https://discuss.elastic.co/u/fadzhli)\ **Replies:** 7\ **Last updated:** [February 24, 2017, 3:16pm UTC](https://discuss.elastic.co/t/fixed-cannot-yum-install-filebeat-broken-repo/42675 "2017-02-24T15:16:39Z")
Hi, I try to yum install filebeat but I think the repo is not working. The repo I'm using is \[beats\] name=Elastic Beats Repository baseurl=https://packages.elastic.co/beats/yum/el/$basearch enabled=1 gpgkey=https:/… --- ## [Err: Error decoding JSON](https://discuss.elastic.co/t/err-error-decoding-json/71244)
**Author:** [@dallmon](https://discuss.elastic.co/u/dallmon)\ **Replies:** 17\ **Last updated:** [February 24, 2017, 2:09pm UTC](https://discuss.elastic.co/t/err-error-decoding-json/71244 "2017-02-24T14:09:00Z")
I get this very often with Filebeat 5.1.1. I modified the logp call in json.go to log the input data. Two examples: JSON in input file: {"QuestionId":922254,"Username":"jtberry","Expiration":"2016-12-28T00:04:00","Sour… --- ## [Metricbeat - Capable of following?](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776)
**Author:** [@rherr63](https://discuss.elastic.co/u/rherr63)\ **Replies:** 26\ **Last updated:** [February 24, 2017, 12:20pm UTC](https://discuss.elastic.co/t/metricbeat-capable-of-following/68776 "2017-02-24T12:20:26Z")
I would appreciate if someone could answer the following regarding MetricBeats =\> 1.) Does MetricBeat support secure data transmission? 2.) Regarding stability, is there any built-in agent fail-over? 3.) Is there a known… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=537) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=539)