# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=540 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 541 --- ## [No connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/75516)
**Author:** [@sayanisameer](https://discuss.elastic.co/u/sayanisameer)\ **Replies:** 4\ **Last updated:** [February 21, 2017, 4:10am UTC](https://discuss.elastic.co/t/no-connection-could-be-made-because-the-target-machine-actively-refused-it/75516 "2017-02-21T04:10:37Z")
Hi All, I am getting error while running for ELK. Below is the error. "2017-02-18T01:49:07+11:00 ERR Connecting error publishing events (retrying): dial tcp Y.Y.Y.Y:5044: connectex: No connection could be made because th… --- ## [How to pass multiple arguments to shell script in execbeat?](https://discuss.elastic.co/t/how-to-pass-multiple-arguments-to-shell-script-in-execbeat/75715)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 20, 2017, 11:38pm UTC](https://discuss.elastic.co/t/how-to-pass-multiple-arguments-to-shell-script-in-execbeat/75715 "2017-02-20T23:38:44Z")
Hi, I use execbeat to execute my shellscript, which accept multiple arguments. I have my execbeat configuration like; execbeat: execs: - cron: "@every 5s" command: "/shellscripts/test.sh" args… --- ## [RTT/Duration Increasing for Heartbeat agent on Windows 10](https://discuss.elastic.co/t/rtt-duration-increasing-for-heartbeat-agent-on-windows-10/75780)
**Author:** [@misabel](https://discuss.elastic.co/u/misabel)\ **Replies:** 5\ **Last updated:** [February 20, 2017, 7:06pm UTC](https://discuss.elastic.co/t/rtt-duration-increasing-for-heartbeat-agent-on-windows-10/75780 "2017-02-20T19:06:55Z")
I've noticed an add behavior for the Heartbeat agent running on Windows 10. I haven't tested with other OS yet but I figured I would ask if anyone hit that problem. Basically it seems the duration for the checks is incre… --- ## [Custom fields for Heartbeat check](https://discuss.elastic.co/t/custom-fields-for-heartbeat-check/75571)
**Author:** [@misabel](https://discuss.elastic.co/u/misabel)\ **Replies:** 3\ **Last updated:** [February 20, 2017, 5:59pm UTC](https://discuss.elastic.co/t/custom-fields-for-heartbeat-check/75571 "2017-02-20T17:59:38Z")
Is it possible to add custom field for a particular check in Heartbeat? I.e. Have an environment field for a URL test. I know you can do it at the beat level but I couldn't find how for a check. --- ## [Watch.poll\_file](https://discuss.elastic.co/t/watch-poll-file/75761)
**Author:** [@SargeSilver](https://discuss.elastic.co/u/SargeSilver)\ **Replies:** 1\ **Last updated:** [February 20, 2017, 3:53pm UTC](https://discuss.elastic.co/t/watch-poll-file/75761 "2017-02-20T15:53:32Z")
When removing a monitor from a poll\_file i can see in the heartbeat log that the change is read into heartbeat, but the removed entry is still being polled. To resolve i have had to restart heartbeat, should this be th… --- ## [Multiple IIS applications logs configurations (multiple filebeat.prospectors)](https://discuss.elastic.co/t/multiple-iis-applications-logs-configurations-multiple-filebeat-prospectors/75580)
**Author:** [@ancross](https://discuss.elastic.co/u/ancross)\ **Replies:** 1\ **Last updated:** [February 20, 2017, 2:07pm UTC](https://discuss.elastic.co/t/multiple-iis-applications-logs-configurations-multiple-filebeat-prospectors/75580 "2017-02-20T14:07:04Z")
Hi. I'm trying to configure filebeat for IIS logs for multiple IIS application. IIS logs are stored in separate folders for each app. My main goal to achieve, is to have separate set of tags fields for each applicati… --- ## [Metricbeats does not start Win2012 R1 x64](https://discuss.elastic.co/t/metricbeats-does-not-start-win2012-r1-x64/75474)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [February 20, 2017, 1:14pm UTC](https://discuss.elastic.co/t/metricbeats-does-not-start-win2012-r1-x64/75474 "2017-02-20T13:14:44Z")
Hi, I installed metricbeats 5.1.2 on Win2012 R1 x64. On DEV and QA stage everything is fine. Using same OS, same configuration, etc. Copied the the files from there to prod, but on prod I have a strange behavior: The… --- ## [Filebeat error to publish event because EOF](https://discuss.elastic.co/t/filebeat-error-to-publish-event-because-eof/74997)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 8\ **Last updated:** [February 20, 2017, 2:59am UTC](https://discuss.elastic.co/t/filebeat-error-to-publish-event-because-eof/74997 "2017-02-20T02:59:00Z")
hi sir, I have a problem about filebeat, the problem need to solve soon( its important), so i sorry because need to send message direct to ask you. :(. I have a folder, have some log file, its synchronous with folder tf… --- ## [Multiline FIlebeat configuration for custom log](https://discuss.elastic.co/t/multiline-filebeat-configuration-for-custom-log/75301)
**Author:** [@prosenjit](https://discuss.elastic.co/u/prosenjit)\ **Replies:** 2\ **Last updated:** [February 17, 2017, 11:00am UTC](https://discuss.elastic.co/t/multiline-filebeat-configuration-for-custom-log/75301 "2017-02-17T11:00:39Z")
Hi , I have successfully set up real time centralized logging. The only issue that remains is the custom logs. It has mutiple lines for a single event. Since my shipper(filebeat) sends these logs to the buffer(Redis), I … --- ## [Aggregated CPU User and System Load Percentage](https://discuss.elastic.co/t/aggregated-cpu-user-and-system-load-percentage/75307)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [February 17, 2017, 7:16am UTC](https://discuss.elastic.co/t/aggregated-cpu-user-and-system-load-percentage/75307 "2017-02-17T07:16:30Z")
Am trying to get a sum value of CPU USER and CPU SYSTEM percentage thru Ruby client. Is there any single API parameter to pull out the both the values ? I believe, it does have 2 separate parameters. I wanted to check,… --- ## [Understanding the filebeat loglines](https://discuss.elastic.co/t/understanding-the-filebeat-loglines/75292)
**Author:** [@cyb3rjithu](https://discuss.elastic.co/u/cyb3rjithu)\ **Replies:** 1\ **Last updated:** [February 16, 2017, 9:56pm UTC](https://discuss.elastic.co/t/understanding-the-filebeat-loglines/75292 "2017-02-16T21:56:30Z")
I was just going through the loglines created by filebeat. Can someone please explain to me what exactly the following logline indicate, 2017-02-14T10:28:57+05:30 INFO Total non-zero values: registrar.states.cleanup=… --- ## [Using packetbeat to extract user's IP](https://discuss.elastic.co/t/using-packetbeat-to-extract-users-ip/75258)
**Author:** [@bobpurewal](https://discuss.elastic.co/u/bobpurewal)\ **Replies:** 9\ **Last updated:** [February 16, 2017, 7:50pm UTC](https://discuss.elastic.co/t/using-packetbeat-to-extract-users-ip/75258 "2017-02-16T19:50:06Z")
Hello, I'm trying to get Packetbeat to add the user's IP address to the incoming payload, and then submit that to ES. I'm running ES and I can see the data that's being submitted (it's all correct). I then ran Packetbe… --- ## [Error loading config file](https://discuss.elastic.co/t/error-loading-config-file/75260)
**Author:** [@hong\_qiu](https://discuss.elastic.co/u/hong_qiu)\ **Replies:** 4\ **Last updated:** [February 16, 2017, 7:46pm UTC](https://discuss.elastic.co/t/error-loading-config-file/75260 "2017-02-16T19:46:55Z")
I generate a custom beat based on metricbeat and try to run it. But it gives me the error like this: CRIT Exiting: error loading config file: config file ("xxx.yml") can only be writable by the owner but the permissi… --- ## [Is the document of develop a new protocol up to date](https://discuss.elastic.co/t/is-the-document-of-develop-a-new-protocol-up-to-date/75180)
**Author:** [@jerome\_tan](https://discuss.elastic.co/u/jerome_tan)\ **Replies:** 4\ **Last updated:** [February 16, 2017, 5:22pm UTC](https://discuss.elastic.co/t/is-the-document-of-develop-a-new-protocol-up-to-date/75180 "2017-02-16T17:22:52Z")
Is the document "https://www.elastic.co/guide/en/beats/packetbeat/current/protocol-modules.html" up to date? In the document All protocol modules implement the TcpProtocolPlugin or the UdpProtocolPlugin (or both) from … --- ## [External actions after file transfer](https://discuss.elastic.co/t/external-actions-after-file-transfer/74937)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 3\ **Last updated:** [February 16, 2017, 5:09pm UTC](https://discuss.elastic.co/t/external-actions-after-file-transfer/74937 "2017-02-16T17:09:04Z")
Hi, I have a requirement to perform an action after successful harvesting by FileBeats (e.g. move the file to archive dir) and was wondering what the best practices/options are for this ? There is nothing I can see i… --- ## [How to ignore a specific IP?](https://discuss.elastic.co/t/how-to-ignore-a-specific-ip/75097)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 3\ **Last updated:** [February 16, 2017, 5:03pm UTC](https://discuss.elastic.co/t/how-to-ignore-a-specific-ip/75097 "2017-02-16T17:03:14Z")
So I am doing a data visualization of netflow traffic, and I am running packetbeat in "af mode" to gather all of the netflow data. The problem is that the IP that I am connecting to the box with packetbeat on it, is s… --- ## [SSL for FIlebeat -\> Logstash (remote error: tls: handshake failure)](https://discuss.elastic.co/t/ssl-for-filebeat-logstash-remote-error-tls-handshake-failure/75371)
**Author:** [@sadsfae](https://discuss.elastic.co/u/sadsfae)\ **Replies:** 3\ **Last updated:** [February 16, 2017, 5:01pm UTC](https://discuss.elastic.co/t/ssl-for-filebeat-logstash-remote-error-tls-handshake-failure/75371 "2017-02-16T17:01:50Z")
Hi Folks, I've been working on upgrading my Ansible playbooks for ELK/EFK to the latest 5.2.x versions and I'm having problems with TLS/SSL connections from filebeat --\> logstash. For the purpose of this post I am set… --- ## [Execbeat is not outputting ps -ef|grep](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [February 16, 2017, 12:04pm UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177 "2017-02-16T12:04:11Z")
Hi, I am using latest execbeat with ELK GA 5.0.0. I would like to know if certain process is running in my PC, say, Filebeat. Running the command ps -ef|grep filebeat returns the output; mypc 688 1 0 Jan16 ? … --- ## [Error sending logs - Failed to publish events caused by: EOF](https://discuss.elastic.co/t/error-sending-logs-failed-to-publish-events-caused-by-eof/75178)
**Author:** [@reeno](https://discuss.elastic.co/u/reeno)\ **Replies:** 2\ **Last updated:** [February 16, 2017, 8:47am UTC](https://discuss.elastic.co/t/error-sending-logs-failed-to-publish-events-caused-by-eof/75178 "2017-02-16T08:47:38Z")
Hi, Seems a few people have this issue and different things resolve for different users - I have read a lot of topics and tried many things but I am still unable to get my windows eventlogs to elsaticsearh. Note I am … --- ## [Filebeat container config](https://discuss.elastic.co/t/filebeat-container-config/73574)
**Author:** [@DougD](https://discuss.elastic.co/u/DougD)\ **Replies:** 6\ **Last updated:** [February 16, 2017, 6:13am UTC](https://discuss.elastic.co/t/filebeat-container-config/73574 "2017-02-16T06:13:33Z")
Greetings, I'm new to filebeat and trying to understand how to setup a filebeat container to process the logs from several application containers each creating logs at /app/log/\*.log Will this work? docker run -d -… --- ## [Creating custom fields and populating them from log data](https://discuss.elastic.co/t/creating-custom-fields-and-populating-them-from-log-data/75105)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 4\ **Last updated:** [February 15, 2017, 8:59pm UTC](https://discuss.elastic.co/t/creating-custom-fields-and-populating-them-from-log-data/75105 "2017-02-15T20:59:21Z")
HI, Can somebody help me in creating and populating the custom fields from log data which is being ingested in to ES using file beats? I have gone through some of the documentation which discusses about Fields and Fields… --- ## [Filebeat process exits daily automatically](https://discuss.elastic.co/t/filebeat-process-exits-daily-automatically/74925)
**Author:** [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-process-exits-daily-automatically/74925 "2017-02-15T15:54:48Z")
Hi, The filebeat process exits automatically everyday. I manually start it every day for the agent to start shipping. The command I use to start the process is sudo nohup ./filebeat -c /etc/filebeat/filebeat.yml -… --- ## [About extends a new protocol](https://discuss.elastic.co/t/about-extends-a-new-protocol/75152)
**Author:** [@jerome\_tan](https://discuss.elastic.co/u/jerome_tan)\ **Replies:** 4\ **Last updated:** [February 15, 2017, 1:02pm UTC](https://discuss.elastic.co/t/about-extends-a-new-protocol/75152 "2017-02-15T13:02:50Z")
I am extending a new packetbeat, just wondering that the beat can bind and listen a port, if it can get the inbound and outbound byte via the port. i.e.: while listening to a HTTP port like 80, can we get the HTTP reques… --- ## [Collect files from remote machine or install multiple Filebeat or remote](https://discuss.elastic.co/t/collect-files-from-remote-machine-or-install-multiple-filebeat-or-remote/75173)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 12:10pm UTC](https://discuss.elastic.co/t/collect-files-from-remote-machine-or-install-multiple-filebeat-or-remote/75173 "2017-02-15T12:10:57Z")
Hi, From what I understand, if I need Filebeat to collect logs from remote machine, I need to have shared file system with the remote mschine, so the Filebeat will be able to reach the files as if they where local, jus… --- ## [Anyway to force event to logstash which logs only includes line with no line terminator?](https://discuss.elastic.co/t/anyway-to-force-event-to-logstash-which-logs-only-includes-line-with-no-line-terminator/75135)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 1\ **Last updated:** [February 15, 2017, 5:55am UTC](https://discuss.elastic.co/t/anyway-to-force-event-to-logstash-which-logs-only-includes-line-with-no-line-terminator/75135 "2017-02-15T05:55:45Z")
filebeat version : 5.2.0 logstash version : 5.2.0 Hello . I have logs conjunction with a logthat has only one line with no line terminators. I am using multiline to send the whole file to logstash but only log th… --- ## [How to monitor the resource usage of filebeat?](https://discuss.elastic.co/t/how-to-monitor-the-resource-usage-of-filebeat/75001)
**Author:** [@Suin\_You](https://discuss.elastic.co/u/Suin_You)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 1:03am UTC](https://discuss.elastic.co/t/how-to-monitor-the-resource-usage-of-filebeat/75001 "2017-02-15T01:03:47Z")
I want to monitor the resource usage of filebeat like CPU, memory usage, and etc. I know that recently released x-pack can monitor logstash and wonder if it is possible to filebeat. How could I do? Do I use the OS tool… --- ## [Changing Linux bash startup files and history files. Beats](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013)
**Author:** [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\ **Replies:** 3\ **Last updated:** [February 14, 2017, 2:15pm UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013 "2017-02-14T14:15:09Z")
Hi, kindly help me how to write a watcher script (json Script) for Changing Linux bash startup files and history files. Beats. send to alert mail to administrator when some one changing bash startup files and histo… --- ## [Activating "system.process.cpu.total.ticks"](https://discuss.elastic.co/t/activating-system-process-cpu-total-ticks/74991)
**Author:** [@olivierpt](https://discuss.elastic.co/u/olivierpt)\ **Replies:** 4\ **Last updated:** [February 14, 2017, 1:57pm UTC](https://discuss.elastic.co/t/activating-system-process-cpu-total-ticks/74991 "2017-02-14T13:57:22Z")
Hi, The Metricbeat Exported Fields documentation that the System module should allow to get a "system.process.cpu.total.ticks" field. But I don't manage to get it and I can't find the option to activate this field. A… --- ## [Beats compile issue](https://discuss.elastic.co/t/beats-compile-issue/75037)
**Author:** [@jerome\_tan](https://discuss.elastic.co/u/jerome_tan)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 1:39pm UTC](https://discuss.elastic.co/t/beats-compile-issue/75037 "2017-02-14T13:39:27Z")
When I compiled the code of beats, it reported an error like this: ok github.com/elastic/beats/libbeat/outputs/mode/lb 1.190s coverage: 84.1% of statements ? github.com/elastic/beats/libbeat/outputs/mode/modetest \[n… --- ## [Issue while compiling beats](https://discuss.elastic.co/t/issue-while-compiling-beats/74886)
**Author:** [@jerome\_tan](https://discuss.elastic.co/u/jerome_tan)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 1:16pm UTC](https://discuss.elastic.co/t/issue-while-compiling-beats/74886 "2017-02-14T13:16:34Z")
I want to extend packetbeat to support more protocols, while I compiled the beats, it reported an error: ....... ok github.com/elastic/beats/libbeat/logp 0.124s coverage: 30.5% of statements command \[go test -cover -… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=539) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=541)