# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=543 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 544 --- ## [Filters in filebeat](https://discuss.elastic.co/t/filters-in-filebeat/73313)
**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 1\ **Last updated:** [January 31, 2017, 1:18pm UTC](https://discuss.elastic.co/t/filters-in-filebeat/73313 "2017-01-31T13:18:49Z")
Is there anything similar to "grok filters in logstash" in filebeat? I want to filter out different fields from a single string which is originally sent to ES as message field. --- ## [Ship Kubernetes metadata with Filebeat](https://discuss.elastic.co/t/ship-kubernetes-metadata-with-filebeat/72231)
**Author:** [@jstangroome](https://discuss.elastic.co/u/jstangroome)\ **Replies:** 3\ **Last updated:** [January 31, 2017, 1:13pm UTC](https://discuss.elastic.co/t/ship-kubernetes-metadata-with-filebeat/72231 "2017-01-31T13:13:40Z")
Hi, We have an established Filebeat ==(lumberjack)==\> Logstash =\> Elasticsearch deployment for Docker container logs coming from a bespoke orchestration platform. We are now replacing our bespoke platform with Kubernet… --- ## [Is it possible notify metricbeat to recheck some given metricsets/events?](https://discuss.elastic.co/t/is-it-possible-notify-metricbeat-to-recheck-some-given-metricsets-events/73286)
**Author:** [@Alexandre\_Vermeerber](https://discuss.elastic.co/u/Alexandre_Vermeerber)\ **Replies:** 1\ **Last updated:** [January 31, 2017, 12:52pm UTC](https://discuss.elastic.co/t/is-it-possible-notify-metricbeat-to-recheck-some-given-metricsets-events/73286 "2017-01-31T12:52:12Z")
Hello, I understand that metricBeat periodically schedules modules in order to fetch metricset or events on observed components. In some situations, i.e., when the sampled metrics leads to an alert, it is useful to p… --- ## [FileBeat - Logstash - Filter CSV - Elastic](https://discuss.elastic.co/t/filebeat-logstash-filter-csv-elastic/71760)
**Author:** [@Ajay1](https://discuss.elastic.co/u/Ajay1)\ **Replies:** 5\ **Last updated:** [January 31, 2017, 12:34pm UTC](https://discuss.elastic.co/t/filebeat-logstash-filter-csv-elastic/71760 "2017-01-31T12:34:56Z")
Hi @magnusbaeck, I have installed Filebeat in local server where i want to pick some log files from different folders on daily basis . But also the folder contains data for past 30 days . Will File beat work based on t… --- ## [Backfilling with filebeat "projectwide" -- how best to enrich?](https://discuss.elastic.co/t/backfilling-with-filebeat-projectwide-how-best-to-enrich/72796)
**Author:** [@cprior](https://discuss.elastic.co/u/cprior)\ **Replies:** 7\ **Last updated:** [January 31, 2017, 12:10pm UTC](https://discuss.elastic.co/t/backfilling-with-filebeat-projectwide-how-best-to-enrich/72796 "2017-01-31T12:10:59Z")
Hi there! Occasionally I get a bunch of logfiles from several machines, dating back a couple of weeks. These are similar machines in terms of hardware and software, and have a few different config items like hostname /… --- ## [CPU/Memory consumption after upgrading to Version 5.1.2](https://discuss.elastic.co/t/cpu-memory-consumption-after-upgrading-to-version-5-1-2/72735)
**Author:** [@tokraft](https://discuss.elastic.co/u/tokraft)\ **Replies:** 8\ **Last updated:** [January 31, 2017, 12:04pm UTC](https://discuss.elastic.co/t/cpu-memory-consumption-after-upgrading-to-version-5-1-2/72735 "2017-01-31T12:04:09Z")
Hi, last week I upgraded metricbeat from version 5.1.1 to version 5.1.2. When I take a look at the memory and also the CPU consumption of metricbeat itself for the last 7 days it seems that metricbeat is continuously c… --- ## [Query ElasticSearchData USING Ruby ElasticsearchGem](https://discuss.elastic.co/t/query-elasticsearchdata-using-ruby-elasticsearchgem/70634)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 15\ **Last updated:** [January 30, 2017, 1:36pm UTC](https://discuss.elastic.co/t/query-elasticsearchdata-using-ruby-elasticsearchgem/70634 "2017-01-30T13:36:13Z")
Hi - I have a setup with Elastic Search, Kibana and MetricBeat running with 5.1.1 version on my Windows-7 machine. Am trying to create a test case to check CPU rate at the API level; using Ruby elasticsearch-5.0.0 gem. … --- ## [More prospectors?](https://discuss.elastic.co/t/more-prospectors/73003)
**Author:** [@Arthur\_Francis](https://discuss.elastic.co/u/Arthur_Francis)\ **Replies:** 2\ **Last updated:** [January 30, 2017, 1:15pm UTC](https://discuss.elastic.co/t/more-prospectors/73003 "2017-01-30T13:15:46Z")
Will increasing the number of prospectors increase how fast Filebeat sends events through to output? --- ## [Multiline max\_lines not set](https://discuss.elastic.co/t/multiline-max-lines-not-set/73122)
**Author:** [@mjasion](https://discuss.elastic.co/u/mjasion)\ **Replies:** 2\ **Last updated:** [January 30, 2017, 12:07pm UTC](https://discuss.elastic.co/t/multiline-max-lines-not-set/73122 "2017-01-30T12:07:19Z")
Hi I'm working on harvesting large csv files using multiline option and It looks like that default option of multiline.max\_lines is not overriden by value set in filebeat.yml When filebeat is parsing record which tak… --- ## [Topbeat alerting](https://discuss.elastic.co/t/topbeat-alerting/73007)
**Author:** [@bini](https://discuss.elastic.co/u/bini)\ **Replies:** 2\ **Last updated:** [January 30, 2017, 8:47am UTC](https://discuss.elastic.co/t/topbeat-alerting/73007 "2017-01-30T08:47:43Z")
Hi, i want to trigger an email whenever the C: drive reaches 40 Gb. How can this be done? any help would be appreciated. Thanks :slight\_smile: --- ## [Store latest metrics in "current" index for query based on latest values?](https://discuss.elastic.co/t/store-latest-metrics-in-current-index-for-query-based-on-latest-values/72751)
**Author:** [@cyrilleverrier](https://discuss.elastic.co/u/cyrilleverrier)\ **Replies:** 5\ **Last updated:** [January 30, 2017, 8:22am UTC](https://discuss.elastic.co/t/store-latest-metrics-in-current-index-for-query-based-on-latest-values/72751 "2017-01-30T08:22:29Z")
Hi, My "simple" use case turns out to be more difficult than expected. considering many sensors that send a numeric metric (@timestamp + key/value pair) I want to get a sorted list of the top XXX sensors based on the… --- ## [Not able to create a new Beat](https://discuss.elastic.co/t/not-able-to-create-a-new-beat/73099)
**Author:** [@newcoder99](https://discuss.elastic.co/u/newcoder99)\ **Replies:** 2\ **Last updated:** [January 30, 2017, 7:16am UTC](https://discuss.elastic.co/t/not-able-to-create-a-new-beat/73099 "2017-01-30T07:16:29Z")
Hello Everyone, I am trying to a custom beat. I have done the installation of Go and cookiecutter. Now when I am trying to execute the below command, it gives following error. "A valid repository for "D:\\ELSTACK\\Crea… --- ## [MetricBeat and FileBeat CPU overhead](https://discuss.elastic.co/t/metricbeat-and-filebeat-cpu-overhead/72215)
**Author:** [@rherr63](https://discuss.elastic.co/u/rherr63)\ **Replies:** 2\ **Last updated:** [January 27, 2017, 5:00pm UTC](https://discuss.elastic.co/t/metricbeat-and-filebeat-cpu-overhead/72215 "2017-01-27T17:00:51Z")
Looking to deploy MetricBeat and FileBeat on potentially 1000's of AWS Linux EC2 instances. Is there a published CPU overhead number for each of these agents? Obviously, developers are concerned about the agentry consumi… --- ## [No Index for winlogbeat-\*](https://discuss.elastic.co/t/no-index-for-winlogbeat/73028)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 1\ **Last updated:** [January 27, 2017, 3:09pm UTC](https://discuss.elastic.co/t/no-index-for-winlogbeat/73028 "2017-01-27T15:09:42Z")
For some reason, my winlogbeat indexes are not being created. I have installed the template manually and verified that it is there along with my default logstash template. I also see data hitting my logstash listening po… --- ## [Optional leading character on multine pattern](https://discuss.elastic.co/t/optional-leading-character-on-multine-pattern/72920)
**Author:** [@mhooper](https://discuss.elastic.co/u/mhooper)\ **Replies:** 3\ **Last updated:** [January 27, 2017, 1:21pm UTC](https://discuss.elastic.co/t/optional-leading-character-on-multine-pattern/72920 "2017-01-27T13:21:31Z")
Hello. I am process log files with filebeats and have come across a format that starts a multi line mess that may or may not have a character before the timestamp. eg. Normal: "\[20170126," New case: "\[20170126," I w… --- ## [Ibm as/400](https://discuss.elastic.co/t/ibm-as-400/72769)
**Author:** [@bini](https://discuss.elastic.co/u/bini)\ **Replies:** 2\ **Last updated:** [January 27, 2017, 11:32am UTC](https://discuss.elastic.co/t/ibm-as-400/72769 "2017-01-27T11:32:27Z")
Hi, i wanted to know the options for connecting to an AS 400 machine. And also can ELK be used for AS 400. Kindly help me out . :slight\_smile: --- ## [File beat to switch logstash host in case of failure](https://discuss.elastic.co/t/file-beat-to-switch-logstash-host-in-case-of-failure/72911)
**Author:** [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)\ **Replies:** 3\ **Last updated:** [January 27, 2017, 1:03am UTC](https://discuss.elastic.co/t/file-beat-to-switch-logstash-host-in-case-of-failure/72911 "2017-01-27T01:03:03Z")
Hi, I am using filebeat to export logs from client machine to logstash server.. My scenario is: I have installed logstash (ELK server) in two servers. both the logstash will be listening always. I need to export … --- ## [Filebeat captured log data not making it to LogStash (Errors resulting)](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914)
**Author:** [@CodingRiot](https://discuss.elastic.co/u/CodingRiot)\ **Replies:** 1\ **Last updated:** [January 27, 2017, 12:42am UTC](https://discuss.elastic.co/t/filebeat-captured-log-data-not-making-it-to-logstash-errors-resulting/72914 "2017-01-27T00:42:07Z")
I have setup a new ELK stack using Elasticsearch, Kibana, LogStash, and Filebeat, however the files that should be picked up from the Filebeat service and transferred over to LogStash are not currently making it there fo… --- ## [Filebeat configtest not working as expected](https://discuss.elastic.co/t/filebeat-configtest-not-working-as-expected/72955)
**Author:** [@pc2856](https://discuss.elastic.co/u/pc2856)\ **Replies:** 6\ **Last updated:** [January 27, 2017, 12:29am UTC](https://discuss.elastic.co/t/filebeat-configtest-not-working-as-expected/72955 "2017-01-27T00:29:07Z")
I have installed Filebeat 5.1 as rpm package on Linux. I added my own sample config yml (at my home dir, not default location) and tested with filebeat which works as expected. Now I make small typo (purposely) in samp… --- ## [Install older beats version from repo](https://discuss.elastic.co/t/install-older-beats-version-from-repo/72847)
**Author:** [@pipazarro](https://discuss.elastic.co/u/pipazarro)\ **Replies:** 2\ **Last updated:** [January 26, 2017, 7:50pm UTC](https://discuss.elastic.co/t/install-older-beats-version-from-repo/72847 "2017-01-26T19:50:50Z")
Hi, I tried installing filebeat v5.1.1 from APT repo and it throws an error: E: Version '5.1.1' for 'filebeat' was not found It looks like it is a known issue: https://discuss.elastic.co/t/install-old-beats-version-f… --- ## [Packetbeat use mem too many when monitor cassandra](https://discuss.elastic.co/t/packetbeat-use-mem-too-many-when-monitor-cassandra/72554)
**Author:** [@ymyjohnny](https://discuss.elastic.co/u/ymyjohnny)\ **Replies:** 5\ **Last updated:** [January 26, 2017, 1:11pm UTC](https://discuss.elastic.co/t/packetbeat-use-mem-too-many-when-monitor-cassandra/72554 "2017-01-26T13:11:55Z")
when i use packetbeat to monitor cassandra,the packetbeat use too many mem and after a while,the packetbeat process will be dead. version is 5.1.2 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMA… --- ## [Metricbeat 5.1.2 - Docker Diskio and network, always 0.00000](https://discuss.elastic.co/t/metricbeat-5-1-2-docker-diskio-and-network-always-0-00000/72742)
**Author:** [@sureshs](https://discuss.elastic.co/u/sureshs)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 12:07pm UTC](https://discuss.elastic.co/t/metricbeat-5-1-2-docker-diskio-and-network-always-0-00000/72742 "2017-01-26T12:07:19Z")
The metric beat on docker container is not able to get the values for the diskio and network, however the docker stats is returning the values, docker version is 1.10.3 and API version is 1.22. Running it on debug does n… --- ## [New community beat Perfmonbeat](https://discuss.elastic.co/t/new-community-beat-perfmonbeat/70688)
**Author:** [@maddin2016](https://discuss.elastic.co/u/maddin2016)\ **Replies:** 24\ **Last updated:** [January 26, 2017, 8:13am UTC](https://discuss.elastic.co/t/new-community-beat-perfmonbeat/70688 "2017-01-26T08:13:41Z")
Hi @all, i would like to show you a new community beat i created. It's called Perfmonbeat and it is a beat to collect perfomance counters from windows. It's yet very basic and there is a lot more to do ( exception hand… --- ## [Need configuration to send JSON string to ELK server through Filebeat](https://discuss.elastic.co/t/need-configuration-to-send-json-string-to-elk-server-through-filebeat/72493)
**Author:** [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)\ **Replies:** 7\ **Last updated:** [January 25, 2017, 7:31pm UTC](https://discuss.elastic.co/t/need-configuration-to-send-json-string-to-elk-server-through-filebeat/72493 "2017-01-25T19:31:01Z")
Hello, I am trying to export log message (JSON) from client side log to ELK Server through FileBeat. My custom log (log4j) will produce JSON output in a file through log4j.RollingFileAppender. I know, I have to have… --- ## [Filebeat not using configured path on Windows](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688)
**Author:** [@kpaulsenegain](https://discuss.elastic.co/u/kpaulsenegain)\ **Replies:** 3\ **Last updated:** [January 25, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688 "2017-01-25T12:40:46Z")
For this configuration: ###################### Filebeat Configuration Example ######################### # This file is an example configuration file highlighting only the most common # options. The filebeat.full.yml … --- ## [How To Capture Java Application Client Side Log](https://discuss.elastic.co/t/how-to-capture-java-application-client-side-log/72586)
**Author:** [@soumya\_iiitc](https://discuss.elastic.co/u/soumya_iiitc)\ **Replies:** 1\ **Last updated:** [January 25, 2017, 12:05pm UTC](https://discuss.elastic.co/t/how-to-capture-java-application-client-side-log/72586 "2017-01-25T12:05:45Z")
We have a client side application for windows and mac. Our customers install and run them on different Mac and Windows machine. Currently, we are collecting application and user interaction logs in a log file into client… --- ## [Packetbeat is not capturing process name for mysql client process configured to do so](https://discuss.elastic.co/t/packetbeat-is-not-capturing-process-name-for-mysql-client-process-configured-to-do-so/72707)
**Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 10:04pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-capturing-process-name-for-mysql-client-process-configured-to-do-so/72707 "2017-01-24T22:04:40Z")
I have packetbeat configured to listen to 3306 and for mysql client processes ( mysql -h my\_host ... -e "my\_query" ...). I see the Query. However, I don't see the corresponding client process information. I have this pro… --- ## [Packetbeat - no way to discover failed TCP connection attempts](https://discuss.elastic.co/t/packetbeat-no-way-to-discover-failed-tcp-connection-attempts/72106)
**Author:** [@FlorinAndrei](https://discuss.elastic.co/u/FlorinAndrei)\ **Replies:** 6\ **Last updated:** [January 24, 2017, 2:08pm UTC](https://discuss.elastic.co/t/packetbeat-no-way-to-discover-failed-tcp-connection-attempts/72106 "2017-01-24T14:08:33Z")
This is a basic task that could easily be done with tcpdump and I was hoping to do it with packetbeat as well. Let's say a process on the current instance is trying to connect to an external endpoint on port 443. This … --- ## [Building custom filebeat debian](https://discuss.elastic.co/t/building-custom-filebeat-debian/71163)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 7\ **Last updated:** [January 24, 2017, 1:03am UTC](https://discuss.elastic.co/t/building-custom-filebeat-debian/71163 "2017-01-24T01:03:21Z")
So i've been following https://discuss.elastic.co/t/how-to-create-a-new-beats-output/61074/3 to create a custom beats output. So now i have two repositories as discussed in the post : 1. filebeat 2. custom-output I… --- ## [Make package: yaml.v2': No such file or directory](https://discuss.elastic.co/t/make-package-yaml-v2-no-such-file-or-directory/66357)
**Author:** [@Aliaksandr\_Zabrodski](https://discuss.elastic.co/u/Aliaksandr_Zabrodski)\ **Replies:** 29\ **Last updated:** [January 24, 2017, 1:01am UTC](https://discuss.elastic.co/t/make-package-yaml-v2-no-such-file-or-directory/66357 "2017-01-24T01:01:27Z")
Hello, I am getting the following error when i try to package a newly generated beat (with cookiecutter) on debian jessie: $ make package Cloning into '/go/src/github.com/tsg/gotpl'... cp: cannot stat '/go/src/github… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=542) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=544)