# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=541 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 542 --- ## [MetricBeat and CloudWatch Graphs not matching up](https://discuss.elastic.co/t/metricbeat-and-cloudwatch-graphs-not-matching-up/74057)
**Author:** [@geek876](https://discuss.elastic.co/u/geek876)\ **Replies:** 10\ **Last updated:** [February 14, 2017, 12:18pm UTC](https://discuss.elastic.co/t/metricbeat-and-cloudwatch-graphs-not-matching-up/74057 "2017-02-14T12:18:18Z")
Hi, We have been using Kibana/ES since few months now and as TimeLion is now built-in in ES5 it makes a great combination. Are thinking of using Beats (metric-beats) to start with on all our servers and hence have been … --- ## [Best Practice for handling gz, bz2 compressed file](https://discuss.elastic.co/t/best-practice-for-handling-gz-bz2-compressed-file/74731)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 1\ **Last updated:** [February 14, 2017, 9:13am UTC](https://discuss.elastic.co/t/best-practice-for-handling-gz-bz2-compressed-file/74731 "2017-02-14T09:13:56Z")
Does Filebeat have capability to decode compressed file - gz, bz2 input ? If not, what is the best practice suggested ? (filebeat in conjunction with other utilities, plugins etc) --- ## [Filebeat and Logstash](https://discuss.elastic.co/t/filebeat-and-logstash/74942)
**Author:** [@mattgolding](https://discuss.elastic.co/u/mattgolding)\ **Replies:** 1\ **Last updated:** [February 14, 2017, 6:52am UTC](https://discuss.elastic.co/t/filebeat-and-logstash/74942 "2017-02-14T06:52:01Z")
I have a question around the interaction between filebeat and logstash. I have read that filebeat will slow down if logstash is under the pump a little. My question is what happens if logstash goes down or I turn it of… --- ## [Bulk\_max\_size](https://discuss.elastic.co/t/bulk-max-size/74620)
**Author:** [@veroverona](https://discuss.elastic.co/u/veroverona)\ **Replies:** 1\ **Last updated:** [February 13, 2017, 3:36pm UTC](https://discuss.elastic.co/t/bulk-max-size/74620 "2017-02-13T15:36:52Z")
Hi, I would like Winlogbeat to publish singol events, so I tried to set bulk\_max\_size to 0, but then Winlogbeat didn't start. I tried to set bulk\_max\_size to -1, in this way Winlogbeat starts but it keeps publishing even… --- ## [Exported fields in filebeat processors](https://discuss.elastic.co/t/exported-fields-in-filebeat-processors/74815)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 1\ **Last updated:** [February 13, 2017, 10:41am UTC](https://discuss.elastic.co/t/exported-fields-in-filebeat-processors/74815 "2017-02-13T10:41:29Z")
Hello, Documentation about filebeat's processors https://www.elastic.co/guide/en/beats/filebeat/current/configuration-processors.html references fields like http.response.code, etc: equals: http.response.code:… --- ## [Combining Metricbeat/Filebeat agents into a single agent](https://discuss.elastic.co/t/combining-metricbeat-filebeat-agents-into-a-single-agent/74536)
**Author:** [@rherr63](https://discuss.elastic.co/u/rherr63)\ **Replies:** 3\ **Last updated:** [February 13, 2017, 9:52am UTC](https://discuss.elastic.co/t/combining-metricbeat-filebeat-agents-into-a-single-agent/74536 "2017-02-13T09:52:10Z")
Is there a roadmap item for combining the agents? If so, do you have a target date? Thanks. --- ## [Fetch information from API](https://discuss.elastic.co/t/fetch-information-from-api/74640)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 1\ **Last updated:** [February 13, 2017, 9:23am UTC](https://discuss.elastic.co/t/fetch-information-from-api/74640 "2017-02-13T09:23:53Z")
Hi I have a requirement where I want to fetch more information from another system by calling a REST API with the value of a field (say userid) from the elasticsearch document. I want this to work on Kibana when user … --- ## [Metricbeats timeout](https://discuss.elastic.co/t/metricbeats-timeout/73890)
**Author:** [@faustf](https://discuss.elastic.co/u/faustf)\ **Replies:** 14\ **Last updated:** [February 13, 2017, 9:20am UTC](https://discuss.elastic.co/t/metricbeats-timeout/73890 "2017-02-13T09:20:56Z")
Hi guys, I've a Cluster of 30 computers with 25 Virtual Machine. Every virtual machine has MetricBeat and FileBeat installed that send metrics and logs to a physical Elasticsearch server. Randomly I've some timeout err… --- ## [401 "unauthorised" error in Filebeat](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488)
**Author:** [@111148](https://discuss.elastic.co/u/111148)\ **Replies:** 3\ **Last updated:** [February 9, 2017, 11:59pm UTC](https://discuss.elastic.co/t/401-unauthorised-error-in-filebeat/74488 "2017-02-09T23:59:07Z")
Hello, I am trying to load template for Kibana in Filebeat PS C:\\filebeat-5.2.0-windows-x86\_64\\scripts\> .\\import\_dashboards.exe -file .\\beats-dashboards-5.2.0.zip.\\import\_dashboards.exe -file .\\beats-dashboards-5.2.0.… --- ## [To retrieve backlfill log files data](https://discuss.elastic.co/t/to-retrieve-backlfill-log-files-data/74653)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 2\ **Last updated:** [February 12, 2017, 2:22am UTC](https://discuss.elastic.co/t/to-retrieve-backlfill-log-files-data/74653 "2017-02-12T02:22:20Z")
Hi Experts, I need to retrieve log file data based on specific data range on epoch timestamp using Filebeat? Can any one let me know where can i apply the filter or query? Ex: My Log file had data from Oct 01 2016 till… --- ## [Filebeat - It is not creating index on Kibana](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-kibana/74402)
**Author:** [@Sujith](https://discuss.elastic.co/u/Sujith)\ **Replies:** 5\ **Last updated:** [February 11, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-kibana/74402 "2017-02-11T14:41:11Z")
Hello! I am using ELK stack version 5.2 latest. I'm trying to configure the FIlebeat. My configuration is Filebeat \> Elasticsearch \> Kibana. However there is something wrong and I couldn't figure it out. There are so… --- ## [Can I harvest .txt file from filebeat?](https://discuss.elastic.co/t/can-i-harvest-txt-file-from-filebeat/74600)
**Author:** [@asgoh05](https://discuss.elastic.co/u/asgoh05)\ **Replies:** 1\ **Last updated:** [February 10, 2017, 10:50pm UTC](https://discuss.elastic.co/t/can-i-harvest-txt-file-from-filebeat/74600 "2017-02-10T22:50:14Z")
I'm trying to send my system\_log to logstash. But unfortunately my system\_log file is text file(.txt) rather than (.log) For this reason I can't send it to logstash. (It is available when I change my file extension to .l… --- ## [Metricbeat cpu metricset: what is sample rate?](https://discuss.elastic.co/t/metricbeat-cpu-metricset-what-is-sample-rate/74679)
**Author:** [@leigh](https://discuss.elastic.co/u/leigh)\ **Replies:** 1\ **Last updated:** [February 10, 2017, 4:57pm UTC](https://discuss.elastic.co/t/metricbeat-cpu-metricset-what-is-sample-rate/74679 "2017-02-10T16:57:29Z")
We can set the period of the cpu metricset using the metricbeat.yml config file (which I believe represents the frequency with which the metricset is run). What is the minimum value that can be set? is it one second. If… --- ## [Winlogbeat configuration issues](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360)
**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\ **Replies:** 4\ **Last updated:** [February 10, 2017, 10:06am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360 "2017-02-10T10:06:52Z")
hi everyone, I have recently installed winlogbeat and configured it to forward the logs but i am unable to receive the logs. Can anyone help me with this? --- ## [Packetbeat - “ERR Failed to read integer reply: Expected digit”](https://discuss.elastic.co/t/packetbeat-err-failed-to-read-integer-reply-expected-digit/74352)
**Author:** [@moooofly](https://discuss.elastic.co/u/moooofly)\ **Replies:** 5\ **Last updated:** [February 10, 2017, 2:31am UTC](https://discuss.elastic.co/t/packetbeat-err-failed-to-read-integer-reply-expected-digit/74352 "2017-02-10T02:31:00Z")
when analyzing pcap file for redis protocol with packetbeat, I get outputs as follow: ➜ packetbeat git:(master) ✗ ./packetbeat -c ./packetbeat.yml -e -I redis\_xg-bjdev-rediscluster-1\_prot-7101\_20161222110711\_20161222… --- ## [Timestamps do not match](https://discuss.elastic.co/t/timestamps-do-not-match/41305)
**Author:** [@romspacenut](https://discuss.elastic.co/u/romspacenut)\ **Replies:** 3\ **Last updated:** [February 9, 2017, 4:52pm UTC](https://discuss.elastic.co/t/timestamps-do-not-match/41305 "2017-02-09T16:52:05Z")
I've noticed that the @timestamp and the timestamp in the message do not match. I'm using Filebeats to push syslog to my ES cluster. Here's a screenshot of what I'm talking about. I'm currently using the index template … --- ## [Help needed | Issue - panic: runtime error: invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119)
**Author:** [@jatin03k](https://discuss.elastic.co/u/jatin03k)\ **Replies:** 4\ **Last updated:** [February 9, 2017, 4:07pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119 "2017-02-09T16:07:01Z")
Filebeat is failing with above mentioned error when trying to read a standard tomcat error log (stderr.log). I tried to debug the issue by testing with subset, and found that the header might be creating the failure, but… --- ## [Elasticsearch Integration with Kafka, Zookeeper using filebeat](https://discuss.elastic.co/t/elasticsearch-integration-with-kafka-zookeeper-using-filebeat/74504)
**Author:** [@gauravbhutani30](https://discuss.elastic.co/u/gauravbhutani30)\ **Replies:** 1\ **Last updated:** [February 9, 2017, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-integration-with-kafka-zookeeper-using-filebeat/74504 "2017-02-09T15:18:12Z")
Hi Everyone, I am have a Elastic cluster running with nodes spread across multiple datacenters. Now, I have to ensure the data synchronization across the nodes. I came across Kafka which is used to process large data a… --- ## [Filebeat: duplicate events](https://discuss.elastic.co/t/filebeat-duplicate-events/73693)
**Author:** [@N31LR](https://discuss.elastic.co/u/N31LR)\ **Replies:** 7\ **Last updated:** [February 9, 2017, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-duplicate-events/73693 "2017-02-09T15:10:33Z")
I have a very simple elkstack POC environment using Filebeat \> logstash \> elasticsearch \> kibana All have been updated to 5.2 previously used 5.0 None of the elk stack components are clustered If I remove filebeat and … --- ## [Beats with multiline](https://discuss.elastic.co/t/beats-with-multiline/35957)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 14\ **Last updated:** [February 9, 2017, 2:10pm UTC](https://discuss.elastic.co/t/beats-with-multiline/35957 "2017-02-09T14:10:16Z")
can i use FileBeat With multiline? --- ## [Is it possible to avoid unwanted log fields in Filebeat?](https://discuss.elastic.co/t/is-it-possible-to-avoid-unwanted-log-fields-in-filebeat/74489)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 9, 2017, 1:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-avoid-unwanted-log-fields-in-filebeat/74489 "2017-02-09T13:47:04Z")
Hi, I am using Filebeat GA 5.0.0. I have log files having entries like; \ \ \ \ \ \ \ \ \ \ \ \ I d… --- ## [One filebeat server for multiple logs server](https://discuss.elastic.co/t/one-filebeat-server-for-multiple-logs-server/74394)
**Author:** [@ericpietro](https://discuss.elastic.co/u/ericpietro)\ **Replies:** 2\ **Last updated:** [February 9, 2017, 8:33am UTC](https://discuss.elastic.co/t/one-filebeat-server-for-multiple-logs-server/74394 "2017-02-09T08:33:57Z")
hello, I have an architecture choice to do. Very strategic. I have 200 hundred log servers. choice #1 : i install filebeat on every 200 servers choice #2 : i install filebeat on a windows 'central' server and i write m… --- ## [Filebeat will not start CentOS 7](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 2\ **Last updated:** [February 9, 2017, 5:20am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460 "2017-02-09T05:20:50Z")
So I am having a pretty big problem... Filebeat will not start as a service at all. It passes the config test so I know that my filebeat.yml is set up correctly. Here is weird part: I am running this in a VM, and if I r… --- ## [Exiting: Could not start registrar: Error loading state: Error decoding states: EOF](https://discuss.elastic.co/t/exiting-could-not-start-registrar-error-loading-state-error-decoding-states-eof/74430)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [February 8, 2017, 10:24pm UTC](https://discuss.elastic.co/t/exiting-could-not-start-registrar-error-loading-state-error-decoding-states-eof/74430 "2017-02-08T22:24:30Z")
My environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.3 (Maipo) # rpm -q filebeat filebeat-5.2.0-1.x86\_64 # systemctl: # systemctl stop filebeat # systemctl start filebeat # echo $? 0 … --- ## [Deploying filebeat on AWS Beanstalk](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246)
**Author:** [@sharadachukka](https://discuss.elastic.co/u/sharadachukka)\ **Replies:** 2\ **Last updated:** [February 8, 2017, 3:36pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246 "2017-02-08T15:36:14Z")
Has anybody deployed filebeat successfully on AWS beanstalk? What is your architecture? Is it best to write directly to elasticsearch?.. or better to have a logstash instances as middle layer to write to elasticsearch. C… --- ## [Filebeat can not publish events to Elastic Search](https://discuss.elastic.co/t/filebeat-can-not-publish-events-to-elastic-search/72438)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 16\ **Last updated:** [February 7, 2017, 1:28am UTC](https://discuss.elastic.co/t/filebeat-can-not-publish-events-to-elastic-search/72438 "2017-02-07T01:28:10Z")
Hi All, I am a newbie in ELK stack and working on a POC. I am trying to ingest some log data using File beats from a RHEL machine to elastic search on a remote windows machine. I keep seeing an error message saying th… --- ## [MetricBeats data to Elastic Search](https://discuss.elastic.co/t/metricbeats-data-to-elastic-search/73335)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 3\ **Last updated:** [February 8, 2017, 12:09pm UTC](https://discuss.elastic.co/t/metricbeats-data-to-elastic-search/73335 "2017-02-08T12:09:30Z")
Hi- I'd like to check, if Metricbeats data is sending data to my Elastic search with out any break. (There might be a scenario server gets restarted) I have a validation, to check if my server is connected to the Elastic… --- ## [Bug in decode\_json\_fields: data loss, tye conflict,](https://discuss.elastic.co/t/bug-in-decode-json-fields-data-loss-tye-conflict/73812)
**Author:** [@fld](https://discuss.elastic.co/u/fld)\ **Replies:** 5\ **Last updated:** [February 8, 2017, 7:46am UTC](https://discuss.elastic.co/t/bug-in-decode-json-fields-data-loss-tye-conflict/73812 "2017-02-08T07:46:22Z")
I think the following behaviour is a bug because it causes some data loss. Please assume the following log file /tmp/sample\_json.log: {"someDate":"2016-09-28T01:40:26.760+0000", "someNumberAsString": "1475026826760… --- ## [Filebeat Fails after Power Failure](https://discuss.elastic.co/t/filebeat-fails-after-power-failure/73967)
**Author:** [@andynz2017](https://discuss.elastic.co/u/andynz2017)\ **Replies:** 3\ **Last updated:** [February 7, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-fails-after-power-failure/73967 "2017-02-07T15:54:24Z")
Hey All, very weird issue. Hoping for some guidance/assistance here. Issue: Filebeat running on CentOS Linux release 7.3.1611 (Core), filebeat 5.1. Server suffers power failure due to host failing. Ungraceful shutdown,… --- ## [Not forwarding filebeat to logstash and no filebeat-\* index in kibana](https://discuss.elastic.co/t/not-forwarding-filebeat-to-logstash-and-no-filebeat-index-in-kibana/73223)
**Author:** [@felixon](https://discuss.elastic.co/u/felixon)\ **Replies:** 11\ **Last updated:** [February 7, 2017, 3:38pm UTC](https://discuss.elastic.co/t/not-forwarding-filebeat-to-logstash-and-no-filebeat-index-in-kibana/73223 "2017-02-07T15:38:40Z")
Hi everybody, i installed elk stack today and configured everything.. to cut long story short: filebeat not forwarding logs as i see it i have 3 servers: xx.xx.xx.233 - elasticsearch v 5.1.2 - \[elk@elasticsearch ~\]… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=540) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=542)