# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=542 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 543 --- ## [Multiple Filebeat instance](https://discuss.elastic.co/t/multiple-filebeat-instance/71904)
**Author:** [@pc2856](https://discuss.elastic.co/u/pc2856)\ **Replies:** 7\ **Last updated:** [February 7, 2017, 3:19pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instance/71904 "2017-02-07T15:19:25Z")
I am using Filebeat 5.1 on Centos Linux and have following constraints =\> 1) need to run multiple Filebeat instances on same hosts. 2) Each instance shall work with its own config yml. 3) Start and stop individual Filebe… --- ## [How to Use S3 Bucket to index and retrieve data from Elasticsearch?](https://discuss.elastic.co/t/how-to-use-s3-bucket-to-index-and-retrieve-data-from-elasticsearch/74198)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [February 7, 2017, 3:13pm UTC](https://discuss.elastic.co/t/how-to-use-s3-bucket-to-index-and-retrieve-data-from-elasticsearch/74198 "2017-02-07T15:13:55Z")
Hi Please let me know how to index data to elasticsearch and data location to be in s3 bucket and data to be retrieved from s3 bucket. --- ## [Filebeat poor performance when publishing existing file to ES](https://discuss.elastic.co/t/filebeat-poor-performance-when-publishing-existing-file-to-es/74044)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 7\ **Last updated:** [February 7, 2017, 1:18pm UTC](https://discuss.elastic.co/t/filebeat-poor-performance-when-publishing-existing-file-to-es/74044 "2017-02-07T13:18:30Z")
Hello, I am using filebeat to load existing log file directly into ES. Sample config: spool\_size : 4049 publish\_async: true filebeat.prospectors: - paths: \[ "/data/test.log" \] harvester\_buffer\_size: 163840 fie… --- ## [Monitoring core files?](https://discuss.elastic.co/t/monitoring-core-files/73986)
**Author:** [@test\_user](https://discuss.elastic.co/u/test_user)\ **Replies:** 3\ **Last updated:** [February 7, 2017, 1:10am UTC](https://discuss.elastic.co/t/monitoring-core-files/73986 "2017-02-07T01:10:41Z")
Hi folks, in order to check our test application against core dump files currently I have cronjob which is checking specific entries on related folder. Can I perform same task with filebeat, so I can remove my cronjob? --- ## [Filebeat multiline problem with logs containing backticks](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logs-containing-backticks/73357)
**Author:** [@Babadofar](https://discuss.elastic.co/u/Babadofar)\ **Replies:** 9\ **Last updated:** [February 6, 2017, 3:51pm UTC](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logs-containing-backticks/73357 "2017-02-06T15:51:05Z")
I am trying to get multline logs into filebeat from an ASP.Net MVC solution. I noticed a problem when testing out the multiline pattern due to the logs contain backtick\` characters, but hoped it was just due to the multi… --- ## [How can I temporary disable filebeat in a Kafka downtime?](https://discuss.elastic.co/t/how-can-i-temporary-disable-filebeat-in-a-kafka-downtime/74011)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 3:35pm UTC](https://discuss.elastic.co/t/how-can-i-temporary-disable-filebeat-in-a-kafka-downtime/74011 "2017-02-06T15:35:40Z")
Hi, I have a number of filebeats, sending data to Kafka, with number worker set to 2. I have Kafka downtimes, and when it becomes available, Filebeats sends a huge data as a bulk. Refer the below trace; \[2017-02-03 0… --- ## [Filebeat connection reset by peer - new install](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer-new-install/73495)
**Author:** [@Charles\_Holtzkampf](https://discuss.elastic.co/u/Charles_Holtzkampf)\ **Replies:** 8\ **Last updated:** [February 6, 2017, 9:50am UTC](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer-new-install/73495 "2017-02-06T09:50:51Z")
ELK stack versions Logstash: 5.1.2 Kibana: 5.1.2 Elasticsearch:5.1.2 Logstash stack successfully receives syslog events on port 5514, but any filebeat logs send to port 5044 are failing. This has never worked. /var… --- ## [Sample Dashboards broken with ES 5.2](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854)
**Author:** [@jochen\_st](https://discuss.elastic.co/u/jochen_st)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 8:54am UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854 "2017-02-06T08:54:50Z")
After upgradeing KIbana and Elasticsearch 5.2 from 5.1.2, the sample winlogbeat dashboards / visualizations provided from https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.1.2.zip do not wo… --- ## [Failed to create a new Beat](https://discuss.elastic.co/t/failed-to-create-a-new-beat/72675)
**Author:** [@romain.dequidt](https://discuss.elastic.co/u/romain.dequidt)\ **Replies:** 13\ **Last updated:** [February 5, 2017, 6:24pm UTC](https://discuss.elastic.co/t/failed-to-create-a-new-beat/72675 "2017-02-05T18:24:50Z")
Hi, I tried to follow the instructions from: https://www.elastic.co/guide/en/beats/libbeat/current/newbeat-generate.html I executed the following command: cookiecutter $GOPATH/src/github.com/elastic/beats/generat… --- ## [Clarification about Filebeat usage is needed](https://discuss.elastic.co/t/clarification-about-filebeat-usage-is-needed/73943)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 1\ **Last updated:** [February 4, 2017, 2:48pm UTC](https://discuss.elastic.co/t/clarification-about-filebeat-usage-is-needed/73943 "2017-02-04T14:48:11Z")
Hello, my application writes log file /var/log/app.log. At 00:00, this log file is rotated: mv /var/log/app.log /var/log/app.log.bak kill -1 --\> re-opens /var/log/app.log Do I understand it correctly that: 1) file… --- ## [Simple log processing without Logstash](https://discuss.elastic.co/t/simple-log-processing-without-logstash/73249)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 6\ **Last updated:** [February 4, 2017, 1:35pm UTC](https://discuss.elastic.co/t/simple-log-processing-without-logstash/73249 "2017-02-04T13:35:45Z")
Hello, I want to use filebeat to send logs to elasticsearch with simple structure (date in custom format, http code, processing time in ms, query text). So log line should be parsed and these data should go to differen… --- ## [Filebeat wildcard drectory](https://discuss.elastic.co/t/filebeat-wildcard-drectory/72113)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 4\ **Last updated:** [February 3, 2017, 8:29pm UTC](https://discuss.elastic.co/t/filebeat-wildcard-drectory/72113 "2017-02-03T20:29:15Z")
It looks like filebeat does not support wildcards in directories like this: /opt/cloudera/yarn/\*/\*/yarn.log --- ## [Add ability to cache HTTP redirects in Elasticsearch output](https://discuss.elastic.co/t/add-ability-to-cache-http-redirects-in-elasticsearch-output/73901)
**Author:** [@rayharris-ibm](https://discuss.elastic.co/u/rayharris-ibm)\ **Replies:** 0\ **Last updated:** [February 3, 2017, 6:56pm UTC](https://discuss.elastic.co/t/add-ability-to-cache-http-redirects-in-elasticsearch-output/73901 "2017-02-03T18:56:46Z")
Hi everyone! I'm a software engineer at IBM in the logging service. We run several large multi-tenant Elasticsearch clusters to support both internal and external customers. An issue we're running into is that we need th… --- ## [\[pgsql\] Flow stop](https://discuss.elastic.co/t/pgsql-flow-stop/73536)
**Author:** [@kim\_85](https://discuss.elastic.co/u/kim_85)\ **Replies:** 4\ **Last updated:** [February 3, 2017, 4:12pm UTC](https://discuss.elastic.co/t/pgsql-flow-stop/73536 "2017-02-03T16:12:56Z")
Hi, I have many installation of packetbeat connected to elasticsearch. Sometimes on a few vm, the packetbeat flow stop with this mistake : 2017-01-30T06:39:30+01:00 ERR Pgsql invalid column\_length=4294967295, buffer\_l… --- ## [Testers wanted: \*beat integration with Apache NiFi](https://discuss.elastic.co/t/testers-wanted-beat-integration-with-apache-nifi/73671)
**Author:** [@trixpan](https://discuss.elastic.co/u/trixpan)\ **Replies:** 3\ **Last updated:** [February 3, 2017, 4:07pm UTC](https://discuss.elastic.co/t/testers-wanted-beat-integration-with-apache-nifi/73671 "2017-02-03T16:07:00Z")
Hi there, For those using beats but also using Hadoop or stack I have baked an experimental listener that allows Apache NiFi (which happens to be the base of Hortonworks Dataflow) to accept connections from libbeats ag… --- ## [How to setup File Beat for Logstash and Compare the Logstash vs Filebeat, Which one we can use?](https://discuss.elastic.co/t/how-to-setup-file-beat-for-logstash-and-compare-the-logstash-vs-filebeat-which-one-we-can-use/73537)
**Author:** [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)\ **Replies:** 3\ **Last updated:** [February 2, 2017, 7:40pm UTC](https://discuss.elastic.co/t/how-to-setup-file-beat-for-logstash-and-compare-the-logstash-vs-filebeat-which-one-we-can-use/73537 "2017-02-02T19:40:14Z")
Hi am newbie for ELK stack.. I want to automate the file parsing insertion into the Elastic search via Log stash. How to configure the Filebeat in windows 10? --- ## [Is there any way to constantly send some ping to Logstash?](https://discuss.elastic.co/t/is-there-any-way-to-constantly-send-some-ping-to-logstash/73672)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 2, 2017, 7:38pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-constantly-send-some-ping-to-logstash/73672 "2017-02-02T19:38:59Z")
Hi, i am using ELK GA 5.0.0. I would like to know if its possible to send some pings to Logstash with timestamp so that it can be passed to some dedicated index, and there by confirm that the beat is alive. Is there an… --- ## [Filebeat configuration - i/o errors and connection resets](https://discuss.elastic.co/t/filebeat-configuration-i-o-errors-and-connection-resets/73222)
**Author:** [@Arthur\_Francis](https://discuss.elastic.co/u/Arthur_Francis)\ **Replies:** 6\ **Last updated:** [February 2, 2017, 4:33pm UTC](https://discuss.elastic.co/t/filebeat-configuration-i-o-errors-and-connection-resets/73222 "2017-02-02T16:33:18Z")
I am using filebeat to send huge numbers of logs from 2 log servers to logstash machines. My POC basically has a 24 hour window to process all the logs for one 24 hour period, 2 days in arrears. Filebeat seems to be th… --- ## [Filebeat to read logs from Remote server location](https://discuss.elastic.co/t/filebeat-to-read-logs-from-remote-server-location/73700)
**Author:** [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)\ **Replies:** 3\ **Last updated:** [February 2, 2017, 3:16pm UTC](https://discuss.elastic.co/t/filebeat-to-read-logs-from-remote-server-location/73700 "2017-02-02T15:16:14Z")
Hello All, I have a question on Filebeat. Is it possible filebeat to read the log file data from remote server location? Anybody have configured for this situation? Can I get advice on this? Thanks --- ## [How to check if Filebeat instances are alive or not and display it in a Kibana dashboard?](https://discuss.elastic.co/t/how-to-check-if-filebeat-instances-are-alive-or-not-and-display-it-in-a-kibana-dashboard/73660)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 2, 2017, 1:16pm UTC](https://discuss.elastic.co/t/how-to-check-if-filebeat-instances-are-alive-or-not-and-display-it-in-a-kibana-dashboard/73660 "2017-02-02T13:16:57Z")
Hi, I have a Logstash instance and several filebeat instances listening specific directories. All filebeats push data to Logstash. The files in log directories wont come in a regular basis, and the intervals can be sec… --- ## [Port name lookup for Memcache packetbeat](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 2\ **Last updated:** [February 2, 2017, 1:05pm UTC](https://discuss.elastic.co/t/port-name-lookup-for-memcache-packetbeat/73584 "2017-02-02T13:05:38Z")
Hi, I use packetbeat to monitor our memcache instances. I have two linux boxes running multiple instances of memcache. For example I have the following instances defined like this. Port = 11211 == App1 11212 == App2 1… --- ## [Can't start filebeat on windows-machine](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954)
**Author:** [@moo2k](https://discuss.elastic.co/u/moo2k)\ **Replies:** 7\ **Last updated:** [February 2, 2017, 9:55am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954 "2017-02-02T09:55:06Z")
Hello, guys. I have installed and configured ElasticSearch, Logstash and Kibana on my windows-machine. I downloaded a FileBeat product. But I can't start filebeat service via PowerShell or manually. Service installs. but… --- ## [Get Performance counters data From Beats](https://discuss.elastic.co/t/get-performance-counters-data-from-beats/73165)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 2\ **Last updated:** [February 2, 2017, 9:04am UTC](https://discuss.elastic.co/t/get-performance-counters-data-from-beats/73165 "2017-02-02T09:04:00Z")
Hi - I'd like to get the Performance Counters from a Windows server using Beats, Would you please let me know if there is any way to do this ? WMi may not be feasible solution because of the different domains in VMs. T… --- ## [How to reduce filebeat lag time?](https://discuss.elastic.co/t/how-to-reduce-filebeat-lag-time/73429)
**Author:** [@pixelrebel](https://discuss.elastic.co/u/pixelrebel)\ **Replies:** 5\ **Last updated:** [February 2, 2017, 8:43am UTC](https://discuss.elastic.co/t/how-to-reduce-filebeat-lag-time/73429 "2017-02-02T08:43:44Z")
I'm trying to get a near-realtime logstash output from filebeat on windows. The logs are updated frequently, but with periods of no updates for 1-120 seconds at a time. The logging application never produces more than … --- ## [Winlogbeat Getting Started](https://discuss.elastic.co/t/winlogbeat-getting-started/73638)
**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\ **Replies:** 1\ **Last updated:** [February 2, 2017, 8:15am UTC](https://discuss.elastic.co/t/winlogbeat-getting-started/73638 "2017-02-02T08:15:19Z")
hi everyone I have recently installed winlogbeat service. can anyone help me with the config files as to how to forward the windows log to logstash? --- ## [Can Packetbeat capture DHCP packets?](https://discuss.elastic.co/t/can-packetbeat-capture-dhcp-packets/73571)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 2\ **Last updated:** [February 1, 2017, 7:20pm UTC](https://discuss.elastic.co/t/can-packetbeat-capture-dhcp-packets/73571 "2017-02-01T19:20:57Z")
I am curious if a Packetbeat install on a Windows DHCP server could see and capture the DHCP traffic? --- ## [Windows log forwarding using filebeat](https://discuss.elastic.co/t/windows-log-forwarding-using-filebeat/73523)
**Author:** [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\ **Replies:** 10\ **Last updated:** [February 1, 2017, 2:35pm UTC](https://discuss.elastic.co/t/windows-log-forwarding-using-filebeat/73523 "2017-02-01T14:35:04Z")
hi everyone I am kind of new to ELK. I am using filebeat to send huge numbers of logs from log servers to logstash machines. I need to know as to how to forward windows audit logs, event logs IIS logs to the server? What… --- ## [Custom Fields Value From Path Element](https://discuss.elastic.co/t/custom-fields-value-from-path-element/73153)
**Author:** [@gariels](https://discuss.elastic.co/u/gariels)\ **Replies:** 3\ **Last updated:** [February 1, 2017, 12:44pm UTC](https://discuss.elastic.co/t/custom-fields-value-from-path-element/73153 "2017-02-01T12:44:12Z")
Let's say I have this prospector definitions: filebeat.prospectors: # log for \`app-a\` - input\_type: log paths: - /progs/app-a/\*/tomcat/\*/logs/app-a.log - /progs/app-a/\*/tomcat/\*/logs/catalina.out tags: \["t… --- ## [Filebeat not closing opened files,consuming around 60GB on Production systems](https://discuss.elastic.co/t/filebeat-not-closing-opened-files-consuming-around-60gb-on-production-systems/72350)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 11\ **Last updated:** [February 1, 2017, 9:02am UTC](https://discuss.elastic.co/t/filebeat-not-closing-opened-files-consuming-around-60gb-on-production-systems/72350 "2017-02-01T09:02:57Z")
Hello, We have filebeat installed on the production system. I see disk getting full after every 3-4 days. For the temporary purpose, we are restarting filebeat and everything comes back to normal. My understanding is… --- ## [Filebeat not picking the files as expected](https://discuss.elastic.co/t/filebeat-not-picking-the-files-as-expected/72851)
**Author:** [@Ajay1](https://discuss.elastic.co/u/Ajay1)\ **Replies:** 11\ **Last updated:** [February 1, 2017, 8:59am UTC](https://discuss.elastic.co/t/filebeat-not-picking-the-files-as-expected/72851 "2017-02-01T08:59:34Z")
I have the following config , /var/lib/transfers/report/\*/archive/processed/ABC-Reconciliation\*.csv --\> which is new reports files everyday Each day new files with different name file for one of the defined prospect… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=541) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=543)